High-Assurance Separation Kernels: A Survey on Formal Methods · HackerPapers discussions

High-Assurance Separation Kernels: A Survey on Formal Methods — mentioned by nickpsecurity

Wed, 23 Jan 2019 05:46:58 GMT

Depends on if you mean design or code. In old days, there was STOP, GEMSOS, and LOCK. I have a description of two of them: http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf Later on, the separation kernels: https://arxiv.org/pdf/1701.01535 VerveOS was verified at least for safety down to assembly: https://www.microsoft.com/en-us/research/wp-content/uploads/... The Muen separation kernel and hypervisor is verified to be free of common problems: https://muen.sk/

Paper and discussion history. A mention is not an endorsement.

High-Assurance Separation Kernels: A Survey on Formal Methods — HN submission

Tue, 22 Jan 2019 09:24:58 GMT

High-Assurance Separation Kernels: A Survey on Formal Methods (2017)

23 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

High-Assurance Separation Kernels: A Survey on Formal Methods — mentioned by nickpsecurity

Tue, 22 Jan 2019 01:44:12 GMT

They implement a Nizza-like architecture to let you choose how much risk you want for each part of your stack: https://os.inf.tu-dresden.de/papers_ps/nizza.pdf It's also designed to allow separation kernels to be used in foundation. There's been quite a few of them: https://arxiv.org/pdf/1701.01535

Paper and discussion history. A mention is not an endorsement.

High-Assurance Separation Kernels: A Survey on Formal Methods — mentioned by nickpsecurity

Fri, 02 Jun 2017 22:13:47 GMT

How these are uses to split applications to reduce risk: http://os.inf.tu-dresden.de/papers_ps/nizza.pdf Survey in 2017 of most separation kernels with verification methods: https://arxiv.org/pdf/1701.01535.pdf This one is a medium-assurance kernel that tries to knock out most errors or injections using SPARK Ada. https://en.m.wikipedia.org/wiki/SPARK_(programming_language) In practice, a medium or high assurance evaluation would also require testing of about everything, covert-channel analysis to spot leaks, verification the object code matches the source, and independent team re-running…

Paper and discussion history. A mention is not an endorsement.