Efficient Security-Aware Virtual Memory Management

摘要

Virtual memory was developed to automate the movement of program code and data between main memory and secondary storage to give the appearance of a single. This technique greatly simplified the programmer's job, particularly when program code and data exceeded the main memory's size. In modern operating system, secure file system can protect confidential data from unauthorized access. However, once an authorized process has accessed data from a cryptographic file system, the data can appear as plaintext in the unprotected virtual memory backing store, even after system shutdown. This paper proposes new approach for adding multilevel security capability to virtual memory management. It uses partial swap encryption based on process's security policy. Volatile encryption keys are chosen randomly, and remain valid only for short time periods. Performance comparison shows the total overhead of proposed method.