Utilizing Hardware Features for Secure Thread Management

摘要

Transaction processing (TP) applications are of use when solving a wide variety of data processing problems. Department of Defense and Department of Navy Command, Control, Communication, Computers and Intelligence (C4I) applications handle information over a wide variety of classifications and compartments. A trusted computing base (TCB) and security kernel architecture for supporting multi-threaded, queue-driven transaction processing applications in a multilevel secure environment has been designed. Intel's Pentium CPU architecture provides hardware with two distinct descriptor tables. One is used in the usual way for process isolation while the other is used for thread isolation. This allocation, together with an appropriately designed scheduling policy, permits us to avoid the full cost of process creation when only switching between threads of different security classes in the same process. Where large numbers of transactions are encountered on transaction queues, this approach has benefits over traditional multilevel systems.