Loading [a11y]/accessibility-menu.js
Enhancing access control with SysGuard, a reference monitor supporting portable and composable kernel module | IEEE Conference Publication | IEEE Xplore

Enhancing access control with SysGuard, a reference monitor supporting portable and composable kernel module


Abstract:

To install security modules or reference monitors into operating system kernels is a common and effective way for enhancing access control for networks. However, security...Show More

Abstract:

To install security modules or reference monitors into operating system kernels is a common and effective way for enhancing access control for networks. However, security modules in conventional kernel-level reference monitors are usually not portable to other kernels and require detailed knowledge about kernel internals. Furthermore, different security modules are often not composable and conflict with each other. This paper describes a reference monitor called SysGuard that addresses these problems. SysGuard uses modules called guards that are invoked before or after the execution of system calls. Unlike kernel-specific security modules, guards are attached to standard system calls that enhance their portability. The guard scoping on a per-process basis improves composability of individual guards, and it is implemented efficiently by using a per-process jump table of system calls. This paper describes the implementation of restricted execution environments for networks by composing simple and portable guards, and shows the advantages of the SysGuard security framework.
Date of Conference: 16-18 December 2002
Date Added to IEEE Xplore: 20 March 2003
Print ISBN:0-7695-1852-4
Conference Location: Tsukuba, Japan

References

References is not available for this document.