The Structure of a Security Kernel for the Z8000 Multiprocessor

The security kernel technology has provided the technical foundation for highly reliable protection of computerizedinformation. However, the operating system implementations face two significant challenges: providing (1) adequate computational resources for applications tasks, and (2) a clean, straightforward structure whose correctness can be easily reviewed. This paper presents the experience of an ongoing security kernel implementation using the Advanced Micro Devices 4116 single-board computerbased on the Z8002 microprocessor. The performance issues of process switching, domain changing, and multiprocessor bus contention are explicitly addressed. The strictly hierarchical (i.e.,loop-free) structure provides a series of increasingly capable, separately usable operating system subsets.Security enforcement is structured in two layers: the basic kernel rigorously enforces a non-discretionary (viz.,lattice model) policy,whilean upper layer provides the access refinements for a discretionary policy.