A Formal Approach to Constructing Secure Air Vehicle Software

Cofer, Darren; Gacek, Andrew; Backes, John; Whalen, Michael W.; Pike, Lee; Foltzer, Adam; Podhradský, Michal; Klein, Gerwin; Kuz, Ihor; Andronick, June; Heiser, Gernot; Stuart, Douglas A.

doi:10.1109/mc.2018.2876051

Cited by 23 publications

(10 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As discussed in Section 4.2, we are porting the sel4 microkernel [35] to the BMC. This would allow for the critical control stack to be implemented in a verifiable manner on a verified base, and non-critical components to be placed in a virtualized instance of OpenBMC [16]. Creating a correct SMBus/PMBus/I 2 C stack is another area of research, building up a modular, model-checked I 2 C implementation [27].…”

Section: Further Use-casesmentioning

confidence: 99%

Enzian: an open, general, CPU/FPGA platform for systems software research

Cock

Ramdas

Schwyn

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

Section: Further Use-casesmentioning

confidence: 99%

Enzian: an open, general, CPU/FPGA platform for systems software research

Cock

Ramdas

Schwyn

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

“…The second paradigm focuses on building an argument attached to AADL models. The assurance cases are automatically updated as the architecture model evolves, and they never fall out of sync with the model [22,23]. An important difference in the described work is that the VERDICT tool automatically builds a GSN assurance case for safety and security using the evidence that is generates.…”

Section: Related Workmentioning

confidence: 99%

VERDICT: A Language and Framework for Engineering Cyber Resilient and Safe System

Meng

Larraz

Siu

et al. 2021

Systems

View full text Add to dashboard Cite

The ever-increasing complexity of cyber-physical systems is driving the need for assurance of critical infrastructure and embedded systems. However, traditional methods to secure cyber-physical systems—e.g., using cyber best practices, adapting mechanisms from information technology systems, and penetration testing followed by patching—are becoming ineffective. This paper describes, in detail, Verification Evidence and Resilient Design In anticipation of Cybersecurity Threats (VERDICT), a language and framework to address cyber resiliency. When we use the term resiliency, we mean hardening a system such that it anticipates and withstands attacks. VERDICT analyzes a system in the face of cyber threats and recommends design improvements that can be applied early in the system engineering process. This is done in two steps: (1) Analyzing at the system architectural level, with respect to cyber and safety requirements and (2) by analyzing at the component behavioral level, with respect to a set of cyber-resiliency properties. The framework consists of three parts: (1) Model-Based Architectural Analysis and Synthesis (MBAAS); (2) Assurance Case Fragments Generation (ACFG); and (3) Cyber Resiliency Verifier (CRV). The VERDICT language is an Architecture Analysis and Design Language (AADL) annex for modeling the safety and security aspects of a system’s architecture. MBAAS performs probabilistic analyses, suggests defenses to mitigate attacks, and generates attack-defense trees and fault trees as evidence of resiliency and safety. It can also synthesize optimal defense solutions—with respect to implementation costs. In addition, ACFG assembles MBAAS evidence into goal structuring notation for certification purposes. CRV analyzes behavioral aspects of the system (i.e., the design model)—modeled using the Assume-Guarantee Reasoning Environment (AGREE) annex and checked against cyber resiliency properties using the Kind 2 model checker. When a property is proved or disproved, a minimal set of vital system components responsible for the proof/disproof are identified. CRV also provides rich and localized diagnostics so the user can quickly identify problems and fix the design model. This paper describes the VERDICT language and each part of the framework in detail and includes a case study to demonstrate the effectiveness of VERDICT—in this case, a delivery drone.

show abstract

“…Feiler et al [20] proposed the Architecture Analysis & Design Language(AADL) support early and repeated analyses of the embedded system. As an international standard (AS5506A [4]), AADL is wildly used in the aviation domain, like [12,17]. In many projects, AADL is more suitable for system architecture modeling and validation than for requirement modeling and analysis.…”

Section: Related Workmentioning

confidence: 99%