Rapid-prototyping of high-assurance systems

The RS-232 Character Repeater Refinement and Assurance Argument,

“…This process generates a set of critical requirements that must be satisfied by any further refinement. Although this is the extent of the repeater refinement in this document, this specification is consistent with the repeater specified in [1], from which a VHDL design and gate-level hardware description were derived.…”

“…The application that we choose to demonstrate this approach, an RS-232 character repeater, was originally posed as a non-trivial, security-relevant example on which to determine the feasibility of formal methods [15]. Our use of literate programming techniques (1) demonstrates how a formal assurance argument can be presented in a clear and intuitive manner and (2) ensures that the documentation of the argument is consistent with the actual specification, implementation, and proof. This document was written using literate programming techniques and tools and is itself a literate program.…”

“…The increase in width of the argument from top to bottom illustrates additional detail that is specified at the lower levels. Other work describes the synthesis of a gate-level hardware description from the repeater CSP physical design using VHDL synthesis tools [1].…”

Increasing Assurance with Literate Programming Techniques

“…1 The assurance argument supports the accreditation decision to allow a computer to process classi ed information in an operational environment. The argument is composed from technical evidence that is produced during the system development process, e.g., the security model, design speci cations, proofs, vulnerability analysis and test results.…”

“…Rigorously produced evidence that is di cult to understand conWork performed while author was employed by the Naval Research Laboratory. 1 A computer system is trusted if we rely on it for security enforcement. I t i s trustworthy if that reliance is justi ed technically.…”