The Flask Security Architecture: System Support for Diverse Security policies

Operating systems must be flexible in their support for security policies, providing sufficient mechanisms for supporting the wide variety of real-world security poli-cies. Such flexibility requires controlling the propaga-tion of access rights, enforcing fine-grained access rights and supporting the revocation of previously granted ac-cess rights. Previous systems are lacking in at least one of these areas. In this paper we present an operating system security architecture that solves these problems. Control over propagation is provided by ensuring that the security policy is consulted for every security deci-sion. This control is achieved without significant perfor-mance degradation through the use of a security decision caching mechanism that ensures a consistent view of pol-icy decisions. Both fine-grained access rights and revo-cation support are provided by mechanisms that are di-rectly integrated into the service-providing components of the system. The architecture is described through its prototype implementation in the Flask microkernel-based operating system, and the policy flexibility of the prototype is evaluated. We present initial evidence that the architecture’s impact on both performance and code complexity is modest. Moreover, our architecture is ap-plicable to many other types of operating systems and environments.