US Patent 7185210 Policy abstraction mechanism

A secure operating system is disclosed in which all code implementing security functionality resides in a security module separate from the operating system code. Calls involving security functions are made using a format or interface which is standardized for all systems. Such a call identifies, inter alia the response and the access mode which are used to identify a call in a two dimensional table which contains a pointer to the needed security functions. In the way security functions are separately compilable and security solving changes can be made by linking in a new security module. Maintenance of security code is separated from maintenance of the underlying operating system.