关键词: 安全关键操作系统, 空间隔离, 功能隔离, 功能划分

Abstract: Considering the limitations of current space isolation technique, a new security mechanism adopting function isolation is proposed in this paper. With the mechanism more delicate granularity of function can be used and different execution domains corresponding to different function requests may be isolated each other, so the safety of operating system can be improved. In the paper the principle and algorithm for function division are introduced in detail, and two kinds of isolating mechanisms PFI and ASFI are presented. Experiment results show that the overhead of function isolation wouldn’t reduce the system efficiency notably.

Key words: safety critical operating system, spatial isolation, function isolation, function dividing