Security Requirements For Mobile Operating Systems

Virtual Machine Security - Full Virtualization and Para Virtualization are two kinds of virtualization in a cloud computing paradigm. In full virtualization, entire hardware architecture is replicated virtually. However, in para virtualization, an operating system is modified so that it can be run concurrently with other operating systems. VMM Instance Isolation ensures that different instances running on the same physical machine are isolated from each other. However, current VMMs do not offer perfect isolation. Many bugs have been found in all popular VMMs that allow escaping from VM (Virtual machine). Vulnerabilities have been found in all virtualization software, which can be exploited by malicious users to bypass certain security restrictions or/and gain escalated privileges. ation software running on or being developed for cloud computing platforms presents different security challenges. It is depending on the delivery model of that particular platform. Flexibility, openness and public availability of cloud infrastructure are threats for application security. The existing vulnerabilities like Presence of trap doors, overflow problems, poor quality code etc. are threats for various attacks. Multi-tenant environment of cloud platforms, the lack of direct control over the environment, and access to data by the cloud platform vendor; are the key issues for using a cloud application. Preserving integrity of applications being executed in remote machines is an open

Containers hold the components necessary to run the desired software, such as files, environment variables, and libraries. The host OS also constrains the container's access to physical resources – such as CPU and memory – so a single container cannot misbehave and consume all of a host's physical

Security software limits access to programs and data files, and keeps a log of programs and files that have been accessed, which is then reviewed by the security manager daily.

One form of hardware support that guarantees that a buffer overflow attack does not take place is to prevent the execution of code that is located in the stack segment of a process’s address space.

type of access control by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target. In practice, a subject is usually a process or thread; objects are constructs such as files, directories, TCP/UDP ports, shared memory segments, IO devices etc. Subjects and objects each have a set of security attributes. Whenever a subject attempts to access an object, an authorization rule enforced by the operating system kernel examines these security attributes and decides whether the access can take place. Any operation by any subject on any object will be tested against the set of

This would mean programmers would have to edit their code every time they changed machines or added more memory (Lemley, 1999). Early computers had small amounts of RAM because storage technology was very expensive. Programmers had to store master copies of programs on a secondary storage system and pull pieces into RAM as needed. The process of deciding which pieces to pull and which parts of RAM to replace was called “overlaying” (Denning, 2012). “It was estimated that most programmers spent half to two-thirds of their time planning overlay sequences. A reliable method of automating it had potential to increase programmer productivity and reduce debugging by several fold” (Denning, 2012). Thus, the concept of virtual memory was born. This concept makes use of the computer’s hard drive when main memory runs out. However, the hard drive is significantly slower than RAM so we want to keep most of the program functioning in RAM thus specialized hardware and software is needed to give the illusion of unlimited available fast memory (Lemley, 1999). This hardware converts a “virtual” address to a physical address in memory. Aside from virtually increasing memory size, virtual memory also provided three additional benefits, “it isolated users from each other, it allowed dynamic relocation of program pieces within RAM, and it provided read – write access control to individual pieces” (Denning, 2012). It is for these

"W⊕X" protection is a memory protection policy. It states that a memory location can be mark as writable or executable, but never both. This protection prevents attackers from injecting malicious code to take control over a process. The injected code is considered as data in memory. Diverting the control flow to execute memory location marked as writable will result in a processor exception. Stack-smashing attacks are prevented as there is no location in memory available for attacker to inject and execute shell code.

The virtual file system states all the possible operations that can be performed on a file system.

This article takes account of the security concerns in the early 2000s and states that it’s a reality. Provides a “long-range outlook” to mobile technology makers in designing future mobile devices. Concepts can be used in future security frameworks.

These virtual machines have a separate operating system, memory, processor and other resources which is the shared by the resources of the

SELinux (Security-Enhanced Linux) was developed by the U.S National Security Agency and essentially enforces security policies that limits what a user or program can do by implementing MAC (Mandatory Access Control) in the Linux kernel. It defines a security policy that controls many different things such as files, devices, sockets, ports and even some processes. The Security-enhanced Linux's features are designed to enforce the separation of information based on confidentiality and integrity requirements. They are designed for preventing processes from reading data and programs, tampering with data and programs, bypassing application security mechanisms, executing untrustworthy programs, or interfering with other processes in violation

There is a separate definition for each segment of the environment but they all have the same principles. Modify regularly and in a controlled fashion and, change with an unpredictable manner, all variables in a manner that will not affect operations. Segments explored in sources include RAM pointers and usage priorities among other things. Moving-Target Defense is a term used to describe all defensive action that reduces the predictability of actions on a system or network. Moving-target technology is a way of protection that mimics polymorphic virus actions which are intended to evade malware detectors. One such idea is entitled symbiotic defense, this is where a separate process runs a process that complements the processes that need protected in a

Sandboxing refers to the restrictions that UNIX (the multilayered platform that MAC OSX is built on) has on actions that programs can

What is Operating System Security, Operating system security is the process of ensuring OS integrity, confidentiality and availability also OS security refers to specified steps used to protect the OS from threats, viruses, worms, malware or remote hacker. OS security include all avoiding-control techniques, which safeguard any computer information from being stolen, edited or deleted if OS security is included. OS security allows different applications and programs to perform required tasks and stop unauthorized interference. OS security may be applied in many ways. We 're going to discuss following topics in this article. A brief description about security and what are the types of encryption and what is Authentication, One Time passwords, Program Threats, System Threats and Computer Security Classifications.

And all of this runs "on top of" an os, such as Windows or Linux system.