Security Technical Overview
The BlackBerry Tablet OS
The BlackBerry Tablet OS is the microkernel operating system of the BlackBerry PlayBook tablet. Microkernel
operating systems implement the minimum amount of software in the kernel and run other processes in the user
space that is outside of the kernel.
Microkernel operating systems are designed to contain less code in the kernel than other operating systems. The
reduced amount of code helps the kernel to avoid the vulnerabilities that are associated with complex code and to
make verification easier. Verification is the process of evaluating a system for programming errors. Many of the
processes that run in the kernel in a conventional operating system run in the user space of the BlackBerry Tablet
OS.
The BlackBerry Tablet OS is designed to be tamper resistant. The kernel performs an integrity test when the
BlackBerry Tablet OS starts and if the integrity test detects damage to the kernel, the tablet does not start.
The BlackBerry Tablet OS is designed to be resilient. The kernel is designed isolate a process in its user space if it
stops responding and to restart the process without negatively affecting other processes. In addition, the kernel
uses adaptive partitioning to allocate resources to specific processes during overload conditions.
The BlackBerry Tablet OS is designed to be highly secure. The kernel validates requests for resources and an
authorization manager controls how applications access the capabilities of the tablet.
The tablet file system
The BlackBerry PlayBook tablet file system runs outside of the kernel and is designed to keep work data highly
secure and separate from personal data. The BlackBerry Tablet OS divides the file system into three areas:
1.
Base file system
2.
Personal file system
3.
Work file system
The base file system is read-only and contains system files. Because the base file system read-only, the BlackBerry
Tablet OS can check the integrity of the base file system and mitigate the damage that a potentially malicious user
who changes the file system can cause.
The personal file system contains the applications that run in personal mode and personal application data.
Applications that a BlackBerry PlayBook tablet user installs on the tablet are located in the personal file system.
The work file system contains the applications that run in work mode and work application data. The tablet
encrypts the work file system. The key that the tablet uses to decrypt the work file system is stored on the
BlackBerry smartphone that is connected to the tablet to prevent access to work data when the tablet and the
smartphone are not connected.
The BlackBerry Tablet OS
6
25
Печатать страницу