Enforcing Memory Isolation in a Security-Oriented Operating System

Problem statement

Investigate how Black Wall can restrict unauthorized memory access and reduce the consequences of kernel defects through stronger memory boundaries and component isolation.

Why it matters

A single kernel memory defect can reach any process, device or credential on the machine. Stronger boundaries reduce the distance a flaw can travel, making component compromise survivable rather than system-wide.

Research questions

1. 01 Where should the kernel/user boundary sit, and which components genuinely need privileges beyond it?
2. 02 Which page-table permissions and write-protection mechanisms can be enforced consistently on supported hardware?
3. 03 How effective are guard pages, non-executable memory and capability-based access at containing memory errors?
4. 04 What overhead do stronger isolation boundaries impose on representative workloads?

Research objectives

• Define kernel and user-space memory boundaries.
• Evaluate page-table permissions and write protection.
• Investigate guard pages and non-executable memory.
• Explore capability-based memory access.
• Measure isolation effectiveness and performance overhead.

Technical challenges

• Memory-management features vary across physical platforms and virtual machines.
• Legitimate shared memory and device mappings complicate strict permission models.
• The page tables themselves must remain protected from the components they isolate.
• Capability checks add cost to hot kernel paths and fault handling.

Expected outcome

A memory-isolation design with documented security invariants and benchmarks.

Tags

memory isolationkernelpage tablescapabilitiesw^xprivilege separation

Related research

• Containing Untrusted Workloads Through OS-Level Isolation

  Isolate applications and services with different trust levels, restrict access to sensitive resources and limit the consequences of a compromised workload.

  Open Research Problem · Systems
• Designing a Self-Defending Operating System Architecture

  Design an operating-system architecture that continuously evaluates security conditions, detects suspicious system changes and applies controlled defensive responses.

  Open Research Problem · Cybersecurity