Main Content

Specification and Design of a Reference Monitor Architecture Pattern in a Secure Operating System

Author: Eric Wintzler

Supervisors: Prof. Dr. Boris Koldehofe, Dr.-Ing. Peter Amthor

Format: Master's thesis, TU Ilmenau

Due to the large number of critical applications relying on a secure operating system (OS), unauthorised access to the controlled resources should be prevented. Because of this a mechanism to enforce an access control (AC) policy exists in many OS. At the functional side, a mechanism for enforcing AC policies should be able to enforce as many policies as possible. To achieve the desired effect, the implementation of such a mechanism has to follow the reference monitor (RM) principles. In the literature many proposals on how to build an architecture for enforcing AC policies can be found. Most of them have common elements, but they do not define these components and their functionality in a common way nor being applicable for arbitrary policies. Also, many of them do not consider the specific issues an implementation comes with. To solve the issue of a missing, OS-specific RM architecture pattern, this thesis has defined the overall goal of defining such an architecture in a way that allows to enforce many kinds of policies and is clear enough to derive an implementation out of it. For doing so, this thesis defines the first goal of developing the functional and non-functional requirements of an RM architecture. Also, the requirements of the policies to enforce must be known. Therefore, the second goal of this thesis was to analyse the requirements of modern AC policies. For achieving these goals, the requirements of the interfaces of the proposed architectures are analysed by applying the methodology of analysing the contracts between the components of an architecture. Based on this and the identified requirements of AC policies, a new RM architecture was developed analysing the functionality a policy requires and what components identified before can provide this functionality. Based on this the interfaces of the components are defined in terms of their input and output as well as their pre- and postconditions. To evaluate if the proposed design is feasible for a modern OS, the developed design was implemented within a highly modular OS that is written in Rust and provides address space isolation.

Completed: 17.05.2024

References: https://bibliographie.tu-ilmenau.de/servlets/DozBibEntryServlet?mode=show&id=ilm_mods_00017182