Why do we need to trust the operating system?
And I'm going to talk about exactly what does it mean to trust a system, but
that sort of differentiates an operating system from
other applications that may not be trusted.
So, why do we need to trust it?
In fact, not only we need to trust it but
we actually also call it a trusted computing base.
So let's see why do we call it a TCB or a trusted computing base.
It is the base in some sense.
If you don't directly want to deal with the hardware,
we set applications on top of the operating system.
So the operating system really is the computing base that is seen
by the applications or the user processes.
The need to trust to the operating system comes from the fact
that we giving it the keys to the kingdom.
Keys to the kingdom here are direct control of all the physical resources.
So the operating system in some sense is able to access anything that we have and
then it's the job of the operating system to make sure that
these resources, or whatever,
high level resources we implement using the low level physical resources
get accessed by the correct users in the system or the correct applications.
And if you're going to make someone sort of the in charge or the controller,
you better be able to trusted that it's going to do what it's supposed to do.
Otherwise, the results that you going to have, you will not like them.
So that's why there's need to trust an operating system.
So what the exactly does it mean for
us to be able to trust the operating system.
So what are the requirements that should be met by this trusted computing base
that we say sets an important role in protecting our resources?
First of all, the operating system absolutely has to be between
the untrusted applications and
the physical hardware resources that we have.
This is called complete mediation.
Think about the request coming from an untrusted application and
this request is for a resource that is being requested by the application.
It has to go through the operating system.
The operating system has to mediate this request and
you can think about why that's necessary.
It's necessary because we had the operating system has to check
that the resource of the request actually has access
is allowed to gain access to this resource.
And for that check to happen,
the operating system has to become between the request and the resource.
So that's called complete mediation.
Okay, you can't get to any resource that
need to be protected without actually going through the operating system.
So trusted system is always going to take a look
at any request before it actually reaches the resource, and
the source of that request is able to access that resource.
So the complete mediation requirement is the first one.
The second requirement a trusted computing base has to meet is,
what we call, it has to be tamper-proof.
In fact, we going to spend bunch of time how to achieve that,
or how to meet that requirement.
The reason it has to be tamper proof is that we're talking about untrusted code
and in the trusted computing base of the trusted operating system.
Well, if the untrusted code can tamper with the trusted operating system,
you can't trust anymore.
The untrusted code tampers with it, changes it to do whatever it wants done.
In particular again, access to resources that perhaps were not meant for
this untrusted application, which may be compromised, could be malicious.
Third requirement is the so called correctness requirement.
If you going to call a system trusted, you going to completely rely
on it to make sure that you're protected resources get used in a proper way.
Then however it does that, whatever functionalities implemented by
the trusted computing base, it should be done correctly.
Because if there is a vulnerability or a bug or
some error in the trusted computing base or the operating system.
I said it has the keys to the kingdom.
So, we said operating system has to be trusted.
Now we know what it means for it to be trusted.
You shouldn't be able to bypass it.
Okay? That's complete mediation.
You have to go through it.
You can't alter or change it, if you are an untrusted application.
And whatever functionality it implements, that's done correctly.