Abstract

implementation and management, but also on various flavors of security policies they must support. Clearly, the hardware on which applications run must be secure, as must the operating system and runtime environment in between, while offering a reasonable API for applications developers. To fix problems in the field and enable fast and inexpensive reaction to changing customer needs, we implemented part of the code as firmware, rather than read-only memory. Figure 1 shows the 4758's three major components and their interrelationships. Subdividing the software into different layers raises issues of trust because upper components rely on the security that lower layers offer. Applications cannot be more secure than the kernel functions they call, and the operating system cannot be more secure than the hardware that executes its commands. Thus, if the lower layers are robust, higher layers can choose whether to relinquish some security. We designed the lower layers to b

Citations