A hardware architecture for implementing protection rings

Abstract

Protection of computations and information is an important aspect of a computer utility. In a system which uses segmentation as a memory addressing scheme, protection can be achieved in part by associating concentric rings of decreasing access privilege with a computation. This paper describes hardware processor mechanisms for implementing these rings of protection. The mechanisms allow cross-ring calls and subsequent returns to occur without trapping to the supervisor. Automatic hardware validation of references across ring boundaries is also performed. Thus, a call by a user procedure to a protected subsystem (including the the supervisor) is identical to a call to a companion user procedure. The mechanisms of passing and referencing arguments are the same in both cases as well.

MYSEA: The Monterey Security Architecture

“…We are also exploring multilevel aware collaboration services, and the addition of QoSS to services other than network security. Additional future work includes a Network File System (NFS) port enhanced with ring-like privileges [68] in the user domain, to help constrain the behavior of applications, and a multilevel aware or multilevel DNS service [20].…”

Making information flow explicit in HiStar

“…HiStar uses gates for protected control transfer, an idea dating back to Multics [21]. However, HiStar's protection domains are not hierarchical like Multics rings.…”

Analysis of three multilevel security architectures

“…[2] The label space may support confidentiality and integrity policies as well as non-hierarchical categories, [26] A security kernel usually provides a hardware-supported ring abstraction [43][44] and can host trusted subjects. [39] The rings can separate applications within a process.…”

“…The "second-order" policy of PK-based architectures is not as concrete as the EP architecture's MLS model. Also, the MILS architecture lacks an overarching abstraction like rings for organizing program integrity and privilege [43]: those considerations must be handled in an ad hoc fashion via restrictions defined in AC-subject configuration data. As a result, it is more likely that the intended MLS policy can be undermined in a MILS-or LP-based system through programmer and verifier confusion (e.g., in constructing either the AC-subject or the configuration tool).…”