Escort: A Path-Based OS Security Architecture

Escort is the security architecture for Scout, a configurable operating system designed for network appli-ances. Scout is unique in that it is designed around paths—a communication-centric abstraction that en-capsulates information flows through the system—rather than the more traditional processes and servers. Scout uses paths to make end-to-end resource allocation decisions. Escort extends this idea to isolate these information flows, as well as to provide end-to-end accountability. This paper introduces the Escort security architecture, shows how it can be used to enforce common security policies, and evaluates its design according to several well-established criteria