An Ultra-kernel Model for Dedicated Security Systems

Security, simplicity, efficiency, are three important aspects of system architecture design, especially for dedicated security systems. The legacy horizontal-layered architectures (e.g., microkernel model) suffer from lacking of many desired features, such as flexibility, security and deployability. In this paper, we propose a new kernel model with vertical architecture, called ultra-kernel model, to make kernel smaller and provide application programmers with direct hardware access. We show that this model has visible advantages over the microkernel architecture, among them, fault-code tolerance and application isolation. To test and evaluate our proposed model, we have implemented a prototype firewall system based on our ultra-kernel design in a developing environment. The ultra-kernel with message exchange contains only 870 lines of C/C++ source code. Measurements show that the performances of the prototype firewall is significantly improved, comparing with an optimized Linux system on the same hardware platform.