DOCSLIB.ORG

Real-Time Operating System Security T

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Real-Time Operating System Security T Real-Time Operating System Security Weider D. Yu (Dipti Baheti, Jeremy Wai) Computer Engineering Department, San Jose State University, San Jose, CA 95192-0180 6.0 COMMERCIAL SYSTEM DESIGN .......................... 11 Abstract — Real Time Operating Systems 6.1 GREEN HILLS SOFTWARE , INC . .................................. 11 lie at the heart of most embedded systems. 6.2 LYNUX WORKS , INC . ................................................ 12 Connectivity of these systems enable user to 6.3 WIND RIVER , INC . .................................................. 12 monitor and control these systems remotely. 6.4 MICROSOFT , INC . ................................................... 13 This report show current systems have 7.0 SOME KNOWN CASES OF SECURITY LAPSE ......... 13 many faults in which the system is connected to each other, and to the world. 7.1 SECURITY IN VEHICLE NETWORKS .............................. 13 An analysis shows these systems could be 7.2 RISKS IN SCADA SYSTEMS ....................................... 14 significantly more secure if security policies 7.3 ATTACKS ON MOBILE PHONES .................................. 14 were followed and if current computer 8.0 LESSONS LEARNED ............................................. 15 networking security techniques are applied. 9.0 CONCLUSION ..................................................... 15 10.0 REFERENCES ..................................................... 16 Index 0.0 OUR CONTRIBUTIONS .......................................... 1 0.0 OUR CONTRIBUTIONS 1.0 INTRODUCTION .................................................... 1 2.0 DEFINITIONS ........................................................ 2 We contributed to Sections: 3.0 RELATED TECHNOLOGIES AND WORK .................. 3 5.1 Enforcement of security policies 5.2 Improving Existing SCADA 4.0. CURRENT SECURITY ISSUES IN RTOS .................... 4 5.3 Dynamic Security policies through 4.1 INSECURE SCADA .................................................... 5 Heuristics 4.2 CODE INJECTION ...................................................... 6 8.0 Lessons Learned 4.3 INEFFICIENCY OF ENCRYPTION ..................................... 6 4.4 EXPLOITING SHARED MEMORY ................................... 6 4.5 PRIORITY INVERSION ................................................. 7 1.0 INTRODUCTION 4.6 DENIAL OF SERVICE ATTACKS ...................................... 7 4.7 ATTACKING INTER -PROCESS COMMUNICATION .............. 8 he Real Time Operating System (RTOS) 5.0. COMMON APPROACHES AND SOLUTIONS .......... 8 Tis a computing environment used in 5.1 ENFORCEMENT OF SECURITY POLICIES .......................... 8 systems that require a response within very 5.2 IMPROVING EXISTING SCADA .................................... 9 specific time constraints. The correctness of 5.3 DYNAMIC SECURITY POLICIES THROUGH HEURISTICS ....... 9 the system depends not just on the correct 5.4 USE OF PRIVILEGE LEVELS .......................................... 9 logical result but also on the delivery time of 5.5 PROTECTING MEMORY E ! B . RROR OOKMARK NOT DEFINED the result. For most applications, real time 5.6 PRIORITY INHERITANCE PROTOCOL ............................ 10 5.7 MILS (M ULTIPLE INDEPENDENT LEVELS OF SECURITY )... 10 performance is the main criterion in evaluation of RTOS. RTOS employ several methods to ensure that it meets the real time system 1 requirements. This makes RTOS mostly a SCADA, and this may have an even a bigger single purpose system. impact to the industry as SCADA networks requires high rate of reliability and RTOS often There are two folds to security relating to controls sensitive equipments that cannot RTOS. Firstly, security within the RTOS malfunction. revolves around the ability to keep jobs separate so one task does not interrupt another. This problem becomes more complex as RTOS 2.0 DEFINITIONS is needed for more complex applications while still keep its deadline requirement. Security of RTOS – Real-Time Operating System, real a RTOS also relates to the stability of the time in the sense that a process running will overall system because insecure tasks can finish within the deadline specified, or else cause the system to fall into an unknown state even if the process returns useful function, and crash. This is unwanted because RTOS are it would be too late. An example would be often used as mission and safety critical the antilock brake system in a car. If it components of certain applications. returns wheel slip information too late, it would be useless. The second security issue has to do with RTOS in a network. RTOS seldom operate alone in Embedded Systems – Usually has a modern day industry. It usually controls certain microcontroller at the heart of the system. automated machinery and are often linked to a It can vary in function depending on its monitoring system that connects to other programming. But for this article, it is the RTOS for management of an entire facility. It physical component that a RTOS sits. is used in wide variety industry include electrical power grids, traffic signals, water Deadlines – In an RTOS, deadlines are the management systems, oil refineries, chemical amount of time that the system can perform plants, and pharmaceutical manufacturing. a process and return the results. If it cannot These control networks are often called return the results before the deadline, the supervisory control and data acquisition results might as well be incorrect. (SCADA) or distributed control system (DCS). These fields are merging as technology SCADA – Supervisory Control and Data advances. They connect to their companies’ Acquisition, it is a network of machine’s database and mainframes running other control units tied together to a workstation. operations, which are also connected to the The workstation is able to read relevant internet. This meant that RTOS can potentially machine data. Workstation can optionally be reprogrammed by intruders to either crash send commands to the machines. Machines or do harm to those RTOS that controls could be anything from sensors, to motors physical machinery. The obscurity of SCADA opening and closing valves. in the public eye gives SCADA the illusion of anonymity, but this is not security. DCS – Distributed Control System, a network of controllers where each one controls one Security of both intra-RTOS communication or more machinery. A system of controllers and SCADA are similar to that of non real time forms a network for monitoring and operating systems and computer networks. As changes. Availability of off-the-shelf parts technology of control systems merge to that of has made SCADA and DCS virtually the computer networks, problems that control same. system encounters will mirror that of the computer network counterpart. This is a Virus – A computer virus is a small software blessing and a curse because problems that program that spreads from one computer to plague computer networks will also plague another computer and that interferes with 2 the computer operation. A computer virus download new games and features on demand. may corrupt or delete data on a computer, Household appliances can be connected to a use an e-mail program to spread the virus to network to automate management of lighting, other computers, or even delete everything heating and also security. on the hard disk. One of the first examples of a functional Real Denial-of-Service attack – Denial of Service Time Operating System implemented on a (DoS) is an attempt to make a computer large scale was the Transaction Processing resource unavailable to its intended users. Facility developed by IBM. Since then, Real A common method is to flood the target Time Systems have evolved and undergone machine with false requests so that it many changes. Now there are several hundreds cannot respond to legitimate traffic. of Real Time OSs available. Some of these are Usually a DoS attack does not intend very powerful and can be used for several information theft or other security losses, general purpose applications while there are but it can cost the target a great deal of time some simple implementations that are designed or money. for only one particular purpose. Irrespective of the design of the Real Time System, its Encryption – A way to hide plain data with consistent ability to accept and complete a task keys or passwords to deny unauthorized within a limited time remains its key access into sensitive data. characteristic feature. VLSI – Very Large Scale Integration. It is the The connection of embedded systems to process of creating integrated circuits on a networks means that they are not only single chip by combination of very large susceptible to security issues caused by their number of transistor based circuits. own design, but also to security issues faced as a result of interfacing to external networks. The widespread use of RTOS in various domains 3.0 RELATED TECHNOLOGIES AND WORK makes security a critical aspect in their design. Security issues within a RTOS system pose a With advances in VLSI technology, embedded problem that could slow the performance of the systems have become very inexpensive. system. This is why most RTOS systems are Complex circuits can be achieved on chips of especially configured to handle a certain job. very small sizes. Therefore, embedded systems This way, the whole system is optimized to do can be found in devices ranging from aircraft one and only one task, and thus would excel at and military systems to industrial equipment, it. automobiles,
Load more

Recommended publications
  • Formal Modelling of Separation Kernels
    The University of York Department of Computer Science Submitted in part fulfilment for the degree of MSc in Software Engineering. Formal Modelling of Separation Kernels Andrius Velykis 18th September 20091 Supervised by Dr Leo Freitas Number of words = 45327, as counted by detex <report.tex> j wc -w. This report consists of 98 pages in total. This includes the body of the report (without blank pages) and Appendix A, but not Appendices B, C, D, E and F. 1Updated transactional operation proofs, 21st September 2009. Abstract A separation kernel is an architecture for secure applications, which benefits from inherent security of distributed systems. Due to its small size and usage in high-integrity environments, it makes a good target for formal modelling and verification. This project presents results from mechanisation and modelling of separation kernel components: a process table, a process queue and a scheduler. The results have been developed as a part of the pilot project within the international Grand Challenge in Verified Software. This thesis covers full development life-cycle from project initiation through design and evaluation to successful completion. Important findings about kernel properties, formal modelling and design decisions are discussed. The developed formal specification is fully verified and contributes to the pilot project aim of creating a formal kernel model and refining it down to implementation code. Other reusable artefacts, such as general lemmas and a new technique of ensuring transactional properties of operations are defined. The results will be curated within the Verified Software Repository. i Robertai. Aˇci¯u. Acknowledgements I would like to thank Dr Leo Freitas for his supervision, encouragement and getting me hooked on formal methods.
    [Show full text]
  • MILS Architectural Approach Supporting Trustworthiness of the Iiot Solutions
    MILS Architectural Approach Supporting Trustworthiness of the IIoT Solutions An Industrial Internet Consortium Whitepaper Rance J. DeLong (The Open Group); Ekaterina Rudina (Kaspersky) MILS Architectural Approach Context and Overview 1 Context and Overview ...................................................................................................... 4 1.1 Need for Trustworthy System Operation ............................................................................. 5 1.2 What is MILS today .............................................................................................................. 6 1.3 How MILS Addresses Safety ................................................................................................. 7 1.4 How MILS Addresses Security .............................................................................................. 8 1.5 How MILS Supports Reliability, Resilience, and Privacy ........................................................ 9 2 MILS Concepts .................................................................................................................. 9 2.1 Centralized vs Distributed Security Architecture .................................................................. 9 2.1.1 Domain Isolation .................................................................................................................................. 10 2.1.2 Isolation and Information Flow Control ............................................................................................... 11 2.1.3 Separation
    [Show full text]
  • National Information Assurance Partnership
    National Information Assurance Partnership ® TM Common Criteria Evaluation and Validation Scheme Validation Report Green Hills Software INTEGRITY-178B Separation Kernel Report Number: CCEVS-VR-10119-2008 Dated: 01 September 2008 Version: 1.0 National Institute of Standards and Technology National Security Agency Information Technology Laboratory Information Assurance Directorate 100 Bureau Drive 9800 Savage Road STE 6757 Gaithersburg, MD 20899 Fort George G. Meade, MD 20755-6757 VALIDATION REPORT Green Hills Software INTEGRITY-178B Separation Kernel ACKNOWLEDGEMENTS Validation Team Shaun Gilmore Santosh Chokhani Ken Elliott Jerry Myers Paul Bicknell Common Criteria Testing Laboratory SAIC, Inc. Columbia, Maryland ii VALIDATION REPORT Green Hills Software INTEGRITY-178B Separation Kernel Table of Contents 1 Executive Summary................................................................1 1.1 Evaluation Details.............................................................2 2 Identification...........................................................................4 3 Threats to Security ..................................................................5 4 Security Policy........................................................................7 5 Assumptions............................................................................8 5.1 Physical Assumptions .......................................................8 5.2 Personnel Assumptions.....................................................8 5.3 Connectivity Assumptions................................................8
    [Show full text]
  • Partitioned System with Xtratum on Powerpc
    Tesina de M´asteren Autom´aticae Inform´aticaIndustrial Partitioned System with XtratuM on PowerPC Author: Rui Zhou Advisor: Prof. Alfons Crespo i Lorente December 2009 Contents 1. Introduction1 1.1. MILS......................................2 1.2. ARINC 653..................................3 1.3. PikeOS.....................................6 1.4. ADEOS....................................7 2. Overview of XtratuM 11 2.1. Virtualization and Hypervisor........................ 11 2.2. XtratuM.................................... 12 3. Overview of PowerPC 16 3.1. POWER.................................... 16 3.2. PowerPC.................................... 17 3.3. PowerPC in Safety-critical.......................... 19 4. Main PowerPC Drivers to Virtualize 20 4.1. Processors................................... 20 4.2. Timer..................................... 21 4.3. Interrupt.................................... 23 4.4. Memory.................................... 24 5. Porting Implementation 25 5.1. Hypercall................................... 26 5.2. Timer..................................... 27 5.3. Interrupt.................................... 28 5.4. Memory.................................... 31 5.5. Partition.................................... 32 6. Benchmark 34 7. Conclusions and Future Work 38 Abstract Nowadays, the diversity of embedded applications has been developed into a new stage with the availability of various new high-performance processors and low cost on-chip memory. As the result of these new advances in hardware, there is a
    [Show full text]
  • Empirical Performance Comparison of Hardware and Software Task Context Switching
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Calhoun, Institutional Archive of the Naval Postgraduate School Calhoun: The NPS Institutional Archive Theses and Dissertations Thesis Collection 2009-06 Empirical Performance Comparison of Hardware and Software Task Context Switching Schultz, Eric A. Monterey, California. Naval Postgraduate School http://hdl.handle.net/10945/46226 NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS EMPIRICAL PERFORMANCE COMPARISON OF HARDWARE AND SOFTWARE TASK CONTEXT SWITCHING by Eric A. Schultz June 2009 Thesis Advisor: Cynthia E. Irvine Second Reader: David J. Shifflett Approved for public release; distribution is unlimited THIS PAGE INTENTIONALLY LEFT BLANK ii Form Approved REPORT DOCUMENTATION PAGE OMB No. 0704–0188 The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704–0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202–4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 1. REPORT DATE (DD–MM–YYYY) 2. REPORT TYPE 3.
    [Show full text]
  • Raytheon Secure Systems and Networks Delivering Mission Assurance in a Hostile Cyberspace Feature the Benefits of Multi-Level Security
    TecHIGhHLIGHTnING RAoYTHEON l’S oTECHNOgLOGY y Tod2a007 Issyue 2 Raytheon Secure Systems and Networks Delivering Mission Assurance in a Hostile Cyberspace Feature The Benefits of Multi-Level Security ulti-level security (MLS) should be accessible to the individ - secret, confidential and unclassified has been a holy grail ever ual. To ameliorate this problem, data all can reside in a single MLS Msince the early days of high-speed guards requiring addi - domain. MLS provides the ability to applying computer systems to meet tional hardware and processing simultaneously receive, process, Col. Roger Shell was the automation needs of military overhead, or labor intensive proce - store and disseminate data of mul - the deputy director of and intelligence systems. In the dures such as manually reviewing tiple classifications within a domain the National Security 1970s, MITRE published a series of data, are commonly used when where not all users have the securi - Agency’s (NSA) papers (by Bell and LaPadua) that moving data between domains. ty clearance to access all the data National Computer describe the issues and rules of within the domain. MLS needs to Security Center (NCSC) determining access rights of individ - The single-level security domain permeate into the computing envi - as it was formed in the ual users to information, based on paradigm is not compatible with ronment (workstations, servers and early 1980s. Dr. Kenneth their credentials. In fact, in 1971, this time-sensitive collaborative pro - operating systems), the network, Kung joined NCSC in Dr. Roger Schell (then a U.S. Air cessing environment needed to the database and the mission appli - 1984 as one of the Force major) conducted his Ph.D.
    [Show full text]
  • Separation Kernels on Commodity Workstations
    Systems and Network Analysis Center Information Assurance Directorate Separation Kernels on Commodity Workstations 11 March 2010 SNAC DoD, 9800 Savage Rd. Ft. Meade, MD 20755-6704 410-854-6632 DSN: 244-6632 FAX: 410-854-6604 www.nsa.gov/snac [email protected] 1 Separation Kernels on Commodity Workstations 1 Executive Summary ................................................................................................. 3 2 Introduction .............................................................................................................. 4 2.1 SKPP Evaluation ................................................................................................ 4 2.2 Assurance Maintenance ..................................................................................... 5 3 Commodity Workstation Security ............................................................................. 7 3.1 Workstation Security Argument .......................................................................... 7 3.1.1 The Applications .......................................................................................... 7 3.1.2 The Operating System ................................................................................. 7 3.1.3 The Hardware Platform ................................................................................ 8 3.2 Evaluating the Workstation Security Argument .................................................. 8 3.3 Too Many Cooks in the Kitchen ........................................................................
    [Show full text]
  • Say Goodbye to Virtualization for a Safer Cloud
    Say Goodbye to Virtualization for a Safer Cloud Dan Williams Ricardo Koller Brandon Lum IBM T.J. Watson Research Center, Yorktown Heights, NY When it comes to isolation on the cloud, conven- The main culprit is the hugely powerful kernel tional wisdom holds that virtual machines (VMs) pro- syscall API that containers use to interact with vide greater isolation than containers because of their the host OS. [23] low-level interface to the host. A lower-level interface reduces the amount of code and complexityneeded in the Yet LightVM then goes on to try to introduce container- kernel that must be relied upon for isolation. However, like properties to VMs, without giving up the complex it is incorrectly assumed that virtualization mechanisms hardware-based virtualization mechanism implementing are required to achieve a low-level interface suitable for the low-level interface to guests. isolation. In this paper, we argue that the interface to In this paper, we make the observation that the level the host can be lowered for any application by moving of the interface between the guest and the host is not kernel components to userspace. We show that using a fundamentally tied to the actual mechanism used to sep- userspace network stack results in a 33% reduction in arate the guest from the host (like the virtualization or kernel code usage, which is 20% better than when re- process mechanism). In Section 3, we describe how the sorting to virtualization mechanisms and using a VM. high-level container interface can be arbitrarily lowered by introducing library OS (libOS) components to appli- cations or using userspace services in a manner we dub 1 Introduction microkernelification.
    [Show full text]
  • Leaving Legacy Behind Reducing Carbon Footprint of Network Services with Mirageos Unikernels
    Leaving legacy behind Reducing carbon footprint of network services with MirageOS unikernels Hannes Mehnert, https://hannes.nqsb.io 36c3, 27th December 2019, Leipzig 1 / 37 Stack Application Binary Configuration Files Programming language runtime • Unix applications depend on System libraries (libc) Crypto (libssl) libraries and configuration files. System calls, Sockets API • Kernel isolates processes from each other using virtual memory. File system Scheduler Network • Compromise is contained to a User Process Hardware Management Management Drivers single process. Hardware (CPU, disk, NIC, memory) • Privilege escalation by flaws in the system call API (568 in sys/syscall.h). 2 / 37 Hypervisor stack Application Binary Configuration Files Programming language runtime • The hypervisor manages the System libraries (libc) Crypto (libssl) resources, and splits them across System calls, Sockets API virtual machines. Hardware is emulated. File system Scheduler Network • Scheduling is done by the User Process Hardware Management Management Drivers hypervisor (VMs) and by each Emulated Hardware and assigned resources virtual machines (processes). • The hypervisor isolates virtual Hypervisor vmm.ko - Resource management - Scheduling of VMs machines from each other. Kernel Hardware (CPU, disk, NIC, memory) 3 / 37 . 4 / 37 . Memory corruption issues are the root-cause of 68% of listed CVEs. Ben Hawkes analysed 108 CVE since start of Google’s Project Zero in 2014, 0day "In the Wild" https://googleprojectzero.blogspot.com/p/0day.html (published 2019-05-15)
    [Show full text]
  • An X86/64 Separation Kernel for High Assurance
    Muen - An x86/64 Separation Kernel for High Assurance Reto Buerki Adrian-Ken Rueegsegger August 29, 2013 University of Applied Sciences Rapperswil (HSR), Switzerland ii Abstract Computer systems are used to store and protect highly sensitive data. At the same time the resources and determination of attackers have increased significantly. Therefore, systems capable of safeguarding critical information must conform to rigorous quality standards to establish trust in the correct functioning. Attaining high assurance for today's monolithic operating systems is exceptionally hard since they tend to be large and include complex functionality. This fact is highlighted by regular security updates provided by operating system vendors. Thus, they are a weak foundation for building secure systems. In contrast, microkernels can be well suited as a basis for systems with strict demands on robustness. They are by definition small, which is a precondition for rigorous verification of correctness. Additionally, they lend themselves to the construction of component-based systems where the incorrect behavior of one partition does not impact the whole system. A separation kernel (SK) is a specialized microkernel that provides an execution environment for multiple components that can only communicate according to a given policy and are otherwise isolated from each other. Hence, the isolation also includes the limitation of potential side- and covert channels. SKs are generally more static and smaller than dynamic microkernels, which minimizes the possibility of kernel failure and should ease the application of formal verification techniques. Recent addition of advanced hardware virtualization support for the Intel x86 architecture has the potential of greatly simplifying the implementation of a separation kernel which can support complex systems.
    [Show full text]
  • Trusted Display on Untrusted Commodity Platforms
    Trusted Display on Untrusted Commodity Platforms ∗ Miao Yu Virgil D. Gligor Zongwei Zhou ECE Department and CyLab ECE Department and CyLab ECE Department and CyLab Carnegie Mellon University Carnegie Mellon University Carnegie Mellon University [email protected] [email protected] [email protected] ABSTRACT Keywords A trusted display service assures the confidentiality and au- GPU separation kernel; Trusted display thenticity of content output by a security-sensitive applica- tion and thus prevents a compromised commodity operating 1. INTRODUCTION system or application from surreptitiously reading or mod- A trusted display service provides a protected channel ifying the displayed output. Past approaches have failed that assures the confidentiality and authenticity of content to provide trusted display on commodity platforms that use output on selected screen areas. With it users can rely modern graphics processing units (GPUs). For example, full on the information output by a security-sensitive applica- GPU virtualization encourages the sharing of GPU address tion (SecApp) without worrying about undetectable screen space with multiple virtual machines without providing ade- \scrapping" or \painting" by malicious software on commod- quate hardware protection mechanisms; e.g., address-space ity systems; i.e., the display output is surreptitiously read separation and instruction execution control. This paper or modified by a compromised commodity operating systems proposes a new trusted display service that has a minimal (OSes) or applications (Apps). trusted code base and maintains full compatibility with com- Security architectures that isolate entire SecApps from un- modity computing platforms. The service relies on a GPU trusted commodity OSes and Applications (Apps) [35] im- separation kernel that (1) defines different types of GPU plement trusted display functions via trusted path [55, 56].
    [Show full text]
  • End-To-End Verification of Memory Isolation
    Secure System Virtualization: End-to-End Verification of Memory Isolation HAMED NEMATI Doctoral Thesis Stockholm, Sweden 2017 TRITA-CSC-A-2017:18 KTH Royal Institute of Technology ISSN 1653-5723 School of Computer Science and Communication ISRN-KTH/CSC/A--17/18-SE SE-100 44 Stockholm ISBN 978-91-7729-478-8 SWEDEN Akademisk avhandling som med tillstånd av Kungl Tekniska högskolan framlägges till offentlig granskning för avläggande av teknologie doktorsexamen i datalogi fre- dagen den 20 oktober 2017 klockan 14.00 i Kollegiesalen, Kungl Tekniska högskolan, Brinellvägen 8, Stockholm. © Hamed Nemati, October 2017 Tryck: Universitetsservice US AB iii Abstract Over the last years, security kernels have played a promising role in re- shaping the landscape of platform security on today’s ubiquitous embedded devices. Security kernels, such as separation kernels, enable constructing high-assurance mixed-criticality execution platforms. They reduce the soft- ware portion of the system’s trusted computing base to a thin layer, which enforces isolation between low- and high-criticality components. The reduced trusted computing base minimizes the system attack surface and facilitates the use of formal methods to ensure functional correctness and security of the kernel. In this thesis, we explore various aspects of building a provably secure separation kernel using virtualization technology. In particular, we examine techniques related to the appropriate management of the memory subsystem. Once these techniques were implemented and functionally verified, they pro- vide reliable a foundation for application scenarios that require strong guar- antees of isolation and facilitate formal reasoning about the system’s overall security. We show how the memory management subsystem can be virtualized to enforce isolation of system components.
    [Show full text]