Protection in General-Purpose Operating Systems: Protected Objects
1. What is Protection in Operating Systems?
Protection in a general-purpose operating system ensures that resources (such as memory, files, and processes) are accessed only by authorized users or programs. It prevents unauthorized access, modification, or misuse of system resources.
An operating system (OS) achieves protection by enforcing access control policies, authentication mechanisms, and security models.
2. Protected Objects in an Operating System
In a general-purpose OS, various system resources need protection:
2.1 Memory
🔹 Objective: Prevent processes from accessing each other’s memory.
🔹 Protection Mechanisms:
- Virtual Memory – Each process runs in its own address space.
- Memory Segmentation – Divides memory into segments with different access rights.
- Paging & Access Control Bits – Read, Write, Execute (RWX) permissions control access.
2.2 CPU & Process Execution
🔹 Objective: Prevent one process from disrupting another.
🔹 Protection Mechanisms:
- User & Kernel Mode – Limits privileged operations to the OS kernel.
- Process Isolation – Each process runs in a separate memory space.
- Time Slicing & Scheduling Policies – Prevents a single process from monopolizing the CPU.
2.3 Files & Directories
🔹 Objective: Restrict file access to authorized users.
🔹 Protection Mechanisms:
- Access Control Lists (ACLs) – Defines user permissions for files.
- File Ownership & Permissions – Read (r), Write (w), Execute (x) permissions in Unix/Linux.
- Encryption & File Integrity Checks – Protects data from unauthorized modification.
2.4 I/O Devices
🔹 Objective: Prevent unauthorized programs from accessing printers, disks, and other peripherals.
🔹 Protection Mechanisms:
- Device Drivers with Access Controls – Only authorized processes can communicate with hardware.
- I/O Port Protection – Prevents direct hardware manipulation by unauthorized software.
2.5 User Authentication & Access Control
🔹 Objective: Ensure only legitimate users access system resources.
🔹 Protection Mechanisms:
- User Authentication – Uses passwords, biometrics, and multi-factor authentication (MFA).
- Role-Based Access Control (RBAC) – Restricts system functions based on user roles.
- Mandatory Access Control (MAC) – Used in security-focused OS (e.g., SELinux).
2.6 Network Resources & Communication
🔹 Objective: Secure network connections and prevent unauthorized data transmission.
🔹 Protection Mechanisms:
- Firewalls & Network Access Controls – Restrict traffic based on rules.
- Encryption (SSL/TLS, VPNs) – Ensures secure data transmission.
- Intrusion Detection Systems (IDS) – Detects and responds to network threats.
3. Access Control Mechanisms in General-Purpose OS
3.1 Access Control Models
✅ Discretionary Access Control (DAC) – Users control access to their own files (e.g., Unix chmod).
✅ Mandatory Access Control (MAC) – System-wide policies restrict access (e.g., SELinux, AppArmor).
✅ Role-Based Access Control (RBAC) – Access permissions are assigned based on user roles.
3.2 Security Policies & Enforcement
✅ Authentication – Passwords, smart cards, biometrics.
✅ Authorization – ACLs, capabilities, and privilege escalation controls.
✅ Auditing & Logging – Tracks user activity for security monitoring.
4. Conclusion
Protection in general-purpose operating systems ensures that system resources are secure and accessible only to authorized users. The OS achieves this through memory protection, process isolation, access controls, encryption, and network security measures.