Abstract: Considering the limitations of current space isolation technique, a new security mechanism adopting function isolation is proposed in this paper. With the mechanism more delicate granularity of function can be used and different execution domains corresponding to different function requests may be isolated each other, so the safety of operating system can be improved. In the paper the principle and algorithm for function division are introduced in detail, and two kinds of isolating mechanisms PFI and ASFI are presented. Experiment results show that the overhead of function isolation wouldn’t reduce the system efficiency notably.

Key words: safety critical operating system, spatial isolation, function isolation, function dividing