A model for verification of data security in operating systems

Abstract

Program verification applied to kernel architectures forms a promising method for providing uncircumventably secure, shared computer systems. A precise definition of data security is developed here in terms of a general model for operating systems. This model is suitable as a basis for verifying many of those properties of an operating system which are necessary to assure reliable enforcement of security. The application of this approach to the UCLA secure operating system is also discussed.

OS Verification- A Survey as a Source of Future Challenges

“…The top level specification described in figure-3 actually contains data security notion. This data security notion has been discussed by G. Popek and D. Farber [1]. The figure in right shows the consistency proofs between the levels.…”

“…The verification of UCLA system is based on data security model provided by G. Popek and D. Farber [1]. The data security model can be used to verify many of those properties in an operating system which are necessary to ensure reliable security enforcement.…”

“…• In UCLA they first generate the nucleus using the approach described in [1]. This nucleus was very close to modern microkernels [27], although at that time microkernels hadn't been invented [5].…”

Patterns for building dependable systems with trusted bases

“…• Security kernel and trusted computing base (TCB): A security kernel [Popek and Farber 1978] refers to a small core of hardware and software components that are responsible for enforcing security policies of a system 1 . A TCB [Lampson et al 1992] generalizes on this concept to include, as part of the trusted components, software processes that may reside outside the kernel; consequently, a TCB can also be used to check end-to-end security properties that extend beyond the kernel boundary.…”

“…Concepts such as the trusted computing base [Lampson et al 1992], security kernel [Popek and Farber 1978], and safety kernel [Rushby 1989] are well known in the fields of security and safety-critical systems. We believe that experienced designers already do this, structuring a system so that the most critical components are kept to small subsets of the system's parts.…”