Abstract: In this paper we combine these features and trusted computing technique to design a security operating system with function signature check and address space check. By setting up head and tail signatures in kernel functions and address check in clock interrupt, we are able to monitor operating system's runtime status. Meanwhile, trusted computing chip could not only provide booting verification, data verification, but also encryption storage. These functions could promote operating system's performance and trustworthy. Experiments show that this security check mechanism is able to monitor operating system in real time and find out abnormal behaviors.