Theory of Multi Core Hypervisor Verification

Cohen, Ernie; Paul, Wolfgang J.; Schmaltz, Sabine

doi:10.1007/978-3-642-35843-2_1

Cited by 23 publications

(11 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Related work [5,41] uses shadow page tables to provide full virtualization, including virtual memory, for "baby VAMP", a simplified MIPS, using VCC. This work, along with later work [4] on TLB virtualization for an abstract mode of x64, has been verified using Wolfgang Paul's VCC-based simulation framework [13]. Also, the OKL4-microvisor uses shadow paging to virtualize the memory subsystem [26].…”

Section: Related Workmentioning

confidence: 99%

Provably secure memory isolation for Linux on ARM

Guanciale

Nemati

Dam

et al. 2016

JCS

View full text Add to dashboard Cite

The isolation of security critical components from an untrusted OS allows to both protect applications and to harden the OS itself. Virtualization of the memory subsystem is a key component to provide such isolation. We present the design, implementation and verification of a memory virtualization platform for ARMv7-A processors. The design is based on direct paging, an MMU virtualization mechanism previously introduced by Xen. It is shown that this mechanism can be implemented using a compact design, suitable for formal verification down to a low level of abstraction, without penalizing system performance. The verification is performed using the HOL4 theorem prover and uses a detailed model of the processor. We prove memory isolation along with information flow security for an abstract top-level model of the virtualization mechanism. The abstract model is refined down to a transition system closely resembling a C implementation. Additionally, it is demonstrated how the gap between the low-level abstraction and the binary level-can be filled, using tools that check Hoare contracts. The virtualization mechanism is demonstrated on real hardware via a hypervisor hosting Linux and supporting a tamper-proof run-time monitor that provably prevents code injection in the Linux guest.

QC 20161212

PROSPER, CERCE

show abstract

Section: Related Workmentioning

confidence: 99%

Provably secure memory isolation for Linux on ARM

Guanciale

Nemati

Dam

et al. 2016

JCS

View full text Add to dashboard Cite

QC 20161212

PROSPER, CERCE

show abstract

“…More recently, the VERISOFT project combined proofs of processor and compiler correctness to a verified stack linking a sequential subset of C to a gate-level description of the VAMP processor. The textbook [39] describes material related to this project, and an article [40] outlines subsequent work on memory invariants at the interface between a multicore hypervisor and C compilers.…”

Section: (Iv) Prior Work On Pervasive System Verificationmentioning

confidence: 99%

Position paper: the science of deep specification

Appel

Beringer

Chlipala

et al. 2017

Phil. Trans. R. Soc. A.

View full text Add to dashboard Cite

We introduce our efforts within the project 'The science of deep specification' to work out the key formal underpinnings of industrial-scale formal specifications of software and hardware components, anticipating a world where large verified systems are routinely built out of smaller verified components that are also used by many other projects. We identify an important class of specification that has already been used in a few experiments that connect strong component-correctness theorems across the work of different teams. To help popularize the unique advantages of that style, we dub it , and we say that it encompasses specifications that are, , and (terms that we define in the article). Our core team is developing a proof-of-concept system (based on the Coq proof assistant) whose specification and verification work is divided across largely decoupled subteams at our four institutions, encompassing hardware microarchitecture, compilers, operating systems and applications, along with cross-cutting principles and tools for effective specification. We also aim to catalyse interest in the approach, not just by basic researchers but also by users in industry.This article is part of the themed issue 'Verified trustworthy software systems'.

show abstract

“…Indeed, several projects have set out to formally verify the correctness of hypervisor implementations. One of the most prominent initiatives is the Microsoft Hyper-V verification project [15,16,31], which has made a number of impressive achievements towards the functional verification of the legacy implementation of the Hyper-V hypervisor, a large software component that combines C and assembly code (about 100 kLOC of C and 5kLOC of assembly). The overarching objective of the formal verification is to establish that a guest operating system cannot observe any difference between executing through the hypervisor or directly on the hardware.…”

Section: Virtualization Platformsmentioning

confidence: 99%

Formal Analysis of Security Models for Mobile Devices, Virtualization Platforms, and Domain Name Systems

Betarte

Luna

2015

CLEIej

View full text Add to dashboard Cite

In this work we investigate the security of security-critical applications, i.e. applications in which a failure may produce consequences that are unacceptable. We consider three areas: mobile devices, virtualization platforms, and domain name systems.The Java Micro Edition platform defines the Mobile Information Device Profile (MIDP) to facilitate the development of applications for mobile devices, like cell phones and PDAs. We first study and compare formally several variants of the security model specified by MIDP to access sensitive resources of a mobile device.Hypervisors allow multiple guest operating systems to run on shared hardware, and offer a compelling means of improving the security and the flexibility of software systems. In this work we present a formalization of an idealized model of a hypervisor. We establish (formally) that the hypervisor ensures strong isolation properties between the different operating systems, and guarantees that requests from guest operating systems are eventually attended. We show also that virtualized platforms are transparent, i.e. a guest operating system cannot distinguish whether it executes alone or together with other guest operating systems on the platform.The Domain Name System Security Extensions (DNSSEC) is a suite of specifications that provides origin authentication and integrity assurance services for DNS data. We finally introduce a minimalistic specification of a DNSSEC model which provides the grounds needed to formally state and verify security properties concerning the chain of trust of the DNSSEC tree.We develop all our formalizations in the Calculus of Inductive Constructions —formal language that combines a higher-order logic and a richly-typed functional programming language— using the Coq proof assistant.

show abstract

Theory of Multi Core Hypervisor Verification

Cited by 23 publications

References 29 publications

Provably secure memory isolation for Linux on ARM

Provably secure memory isolation for Linux on ARM

Position paper: the science of deep specification

Formal Analysis of Security Models for Mobile Devices, Virtualization Platforms, and Domain Name Systems

Contact Info

Product

Resources

About