A Trusted Software Base for Proactive Security Services

Abstract

The invention discloses a trusted software base providing an active security service, comprising a trusted password module and an operating system kernel. The operating system kernel is provided with a kernel-level trusted password module driver, a kernel-level trusted software stack and a kernel-level security service module; a security manager and a security strategy server are arranged in the kernel-level security service module; the trusted password module provides a hardware engine for encryption operation and hash operation, and verifies integrity of a trusted BIOS (Basic Input / Output System); the trusted BIOS is used for verifies the integrity of PC hardware devices and an MBR (Master Boot Record); the MBR is used for guiding an OS (Operating system) Loader, and verifies the integrity of the OS Loader; and the kernel-level security service module captures security related information at a key security control point in a kernel layer of the operating system, and performs access control and least privilege control. The trusted software base effectively prevents unauthorized operations and rogue programs from performing unauthorized modification on application codes and configurations, and prevents secret disclosure of application resources, thereby guaranteeing the privacy and the integrity of an application environment.

Description

technical field [0001] The invention relates to the field of information security, in particular to a trusted software base that provides active security services and is implemented at the kernel layer of an operating system based on a trusted cryptographic module. technical background [0002] Existing security protection systems that provide security services for applications are based on personal computer (PC) systems, and most of them implement security protection at the application layer or operating system layer. [0003] At the beginning of PC design, the main consideration of the system was performance and function, but security was not fully considered. The PC hardware architecture is greatly simplified in terms of security. [0004] In the PC hardware structure, programs and data are assigned to different segments. When the process is running, a special processor register, sometimes called the base address register, is stored together with the starting address of ...

AI Technical Summary

Problems solved by technology

[0010] To sum up, the method of providing security services for applications proposed by TCG is a passive method, and does not give a specific implementation method at the operating system layer. At the same time, TCG only provides integrity services for applications and does not provide confidentiality. Serve

Images