Hierarchical Approach to Computer System Integrity

and possibly error-prone or malicious users are to coexist on the same computer system. In this paper, we show that a hierarchically structured operating system, such as produced by a virtual machine system, that combines a virtual machine monitor with several independent operating systems (V M M ~ O S) , provides substantially better software security than a conventional two-level multiprogramming operating system approach. This added protection is derived from redundant security using independent mechanisms that are inherent in the design of most V M M I O S systems. Such a system can be obtained by exploiting existing software resources. Computer systems have taken on essential roles in many organizations. As such, concern for system integrity has become increasingly important. At the same time, economies of scale and centralization of operation often make it desirable to merge many separate applications onto a single computer system. In this paper, we explore operating system software approaches to improving system integrity in a shared facility. Operating system integrity may be said to exist when an operating system functions correctly under all circumstances. It is helpful to further divide the concept of integrity into two related concepts: security and reliability. By security, we mean the ability of the operating system to maintain control over the system resources and thereby prevent users from accidentally or maliciously modifying or accessing unauthorized information. By reliability we mean the ability of the operating system to continue to supply useful service in spite of all abnormal software (and most abnormal hardware) conditions-whether accidental or malicious. That is, we expect the operating system to be able to prevent " crashes. " Unlike hardware, which can have manufacturing defects, physically age, wear out, and change properties over time, software is