Security architecture for component-based operating systems
Trent Jaeger, Jochen Liedtke, et al.
EW 1998
Transparent monitoring enables the dynamic insertion of monitoring functionality without requiring either the cooperation or the awareness of either of the tasks being monitored. Therefore, it is preferable to traditional overt monitoring mechanisms. However, in order to implement transparent monitoring, the kernel's IPC semantics must be preserved regardless of how many monitors exist and what actions they may take. In this paper, we presented a synchronous IPC mechanism that is preserves IPC semantics over transparent monitors. This mechanism considers system monitors to be an extension of the kernel, so the source can be blocked until all the monitors have completed their actions and forwarded the IPC to the destination. There-fore, synchronous IPC is possible even given a variety of monitor actions, such as redirecting IPCs to a new source, changing the source of an IPC, and changing the communication rate. Also, this mechanism supports useful variations of synchronous IPC semantics, such as requesting unreliable communication, delaying delivery notification, and using untrusted monitors.
Trent Jaeger, Jochen Liedtke, et al.
EW 1998
Trent Jaeger, Reiner Sailer, et al.
SACMAT 2004
Trent Jaeger, Reiner Sailer, et al.
USENIX Security 2003
Trent Jaeger, Xiaolan Zhang, et al.
ACM TISSEC