Security kernel

The security kernel is the set of hardware, firmware and software elements within the trusted computing base that implement the reference monitor concept. A concept cannot enforce anything by itself, so the security kernel is what actually intercepts each request, evaluates it against the security policy and returns a verdict. The three reference monitor properties become its job description: nothing bypasses it, nothing alters it, and it stays small enough to verify.

The relationship is worth stating precisely, because the two terms are routinely swapped. The reference monitor is a design requirement and cannot be pointed at. The security kernel is identifiable code and circuitry that satisfies that requirement, and it is a subset of the trusted computing base rather than the whole of it. Its evaluation is a policy decision made in software, which is a different control from the hardware enforcement provided by protection rings: the hardware decides where a crossing is possible at all, and the security kernel decides whether a request that reaches it is allowed.

Exam relevance: where a question describes the component performing the check, the answer is the security kernel; where it describes the requirement that every access be checked, the answer is the reference monitor. Keeping the concept and its implementation apart is what tends to separate the close options.