High-Assurance Separation Kernels: A Survey on Formal Methods

Abstract

Separation kernels provide temporal/spatial separation and controlled information flow to their hosted applications. They are introduced to decouple the analysis of applications in partitions from the analysis of the kernel itself. More than 20 implementations of separation kernels have been developed and widely applied in critical domains, e.g., avionics/aerospace, military/defense, and medical devices. Formal methods are mandated by the security/safety certification of separation kernels and have been carried out since this concept emerged. However, this field lacks a survey to systematically study, compare, and analyze related work. On the other hand, high-assurance separation kernels by formal methods still face big challenges. In this paper, an analytical framework is first proposed to clarify the functionalities, implementations, properties and standards, and formal methods application of separation kernels. Based on the proposed analytical framework, a taxonomy is designed according to formal methods application, functionalities, and properties of separation kernels. Research works in the literature are then categorized and overviewed by the taxonomy. In accordance with the analytical framework, a comprehensive analysis and discussion of related work are presented. Finally, four challenges and their possible technical directions for future research are identified, e.g. specification bottleneck, multicore and concurrency, and automation of full formal verification.CCS Concepts: •Software and its engineering → Operating systems; Formal methods; •Computer systems organization → Real-time operating systems; •Security and privacy → Formal methods and theory of security;

Resource Partitioning in Phoenix-RTOS for Critical and Noncritical Software for UAV systems

“…Due to this fact, these kinds of operating systems are often called partitions kernels. Partitioning mechanisms should provide spatial and temporal separation [2]. Moreover, the partition kernel is in charge of resources management such as I/O devices to permit access to only assigned parts of the system.…”

“…The foundation of MILS is a Separation Kernel (SK), which is responsible for adherence of data isolation, damage limitation and resource partitioning. SK extends partitioning kernels of sets of specific functionalities to enforce security separation, and information flow [2]. The security requirements are known as Common Criteria (CC) [3] establishing seven Evaluation Assurance Levels (EAL) from 1 to 7, which is the most rigorous.…”

“…The typical approach to realizing separation kernel is based on embedded hypervisor and software virtualization mechanisms. The hypervisor layer manages the system resources and virtual partitions, which are capable of running guest operating systems with different levels of critically [2].…”

“…The flag product of SYSGO company is a PikeOS compliant with DO-178C DAL B and ARINC 653 [2]. Although the system provides safety and security-critical mechanism, it is not compliant with SKPP.…”

“…According to a survey presented by researchers in [2], the majority of open-source projects are academic implementations. Special consideration should be given to POK and XtratuM operating systems due to compliance with ARINC 653.…”