Architecture
This page describes the architecture of the security-oriented technical platform.
The architecture of Safecor is made in respect of the design rules.
A product is composed of one ore more Domains (virtual machines) with their own application module. The modules should be designed according to their level of trust. All modules using external data (communicating with USB drives or the network for example) should be considered as not trustable and should be separated from modules that only manipulate commands and user interfaces.
The user interface graphical application (GUI) is hosted in the sys-gui Domain that has a high level of trust.
A Domain is a volatile virtual machine created on startup. The virtual machine is created, an Alpine Linux is installed and the application package and its dependencies are installed (see topology.json).
In accordance with the design rule "stateless system", a Domain only exists in memory as long as the system is running. It is re-created each time the system is started.
In the sys-gui Domain, the graphical user interface application has access to an X server whose display is rendered on a virtual graphics card provided by QEMU in the Dom0. The display of QEMU is then made in a GTK borderless window in an X server running on the real graphics card.
The integration of the product GUI is made with the section gui.app-package of the topology.json file.
The platform includes the following virtual machines:
| Name | Description | Trust Level |
|---|---|---|
| Dom0 | Domain 0 is a special virtual machine used to manage user Domains and interface with the XenBus. | High |
| sys-gui | This Domain displays the product graphical interface. | High |
| sys-usb | This Domain is responsible for managing USB devices (keyboard, mouse, storage devices) and isolating them from the rest of the system. | Low |
This section provides technical details about Domain 0.
Installed packages:
safecor-coresafecor-lib
This Domain is in charge of booting the whole system and orchestrating the creation and destruction of the Domains. It contains all the logic of the system that is deployed by the package safecor-core.
This section provides technical details about the core domain sys-usb.
Installed packages:
safecor-lib
The sys-usb Domain provides the following functions via a special data channel:
- keyboard input
- mouse position
- mouse button states
- touch position
- reading the file catalog from a USB device
- reading a file from a USB device
- writing a file to a USB device
- mounting a virtual storage file (ISO, vmdk, etc)
This section provides technical details about the core domain sys-gui.
Installed packages:
safecor-lib
The sys-gui Domain provides the tools to show a frontend to the user. The frontend is automatically deployed in the Domain according to the settings in the topology file.
By default, only a framebuffer is available in the Domain. If needed, an X server can be instaled and automatically configured by adding the package safecor-gui-base to the product GUI package's dependencies.
This section provides technical details about the core domain sys-net.
This Domain is currently not available.