Abstract:Formal verification of an OS kernel is widely considered a major challenge; however, traditional interactive theorem provers used in OS kernel verification require manually written proofs and come with a non-trivial cost. In this paper, we propose a formal verification framework to build a verifiably correct OS kernel, named iv6, with a high degree of proof automation and a low burden of proof. Using this framework, programmers only need to write the specification as required, and it can be translated into the corresponding implementation of C code automatically. The verification framework can guarantee that the behaviour of the implementation code adheres to its specifications. Iv6 introduces four key ideas to achieve proof automation: its interfaces and corresponding specifications are designed to be finite to avoid unbounded loops or recursion; it separates kernel and user address spaces using a kernel page table isolation approach to simplify reasoning about virtual memory; it partitions the modules of a kernel state machine according to a state transition function to improve verification performance; and to avoid modelling complicated C semantics, it performs verification at the LLVM intermediate representation level. A total of 48 system calls and some high-level system properties in iv6 have been verified using this method. Experience shows that this framework can reduce the impact of human error on kernel development and make the verification of iv6 more efficient and straightforward.

Formal Specification and Verification of Separation Kernels: an Overview.

A survey on formal specification and verification of separation kernels

High-Assurance Separation Kernels: A Survey on Formal Methods

Refinement-based Specification and Security Analysis of Separation Kernels

Applying Rely-Guarantee Reasoning on Concurrent Memory Management and Mailbox in C/OS-II: A Case Study

Reasoning about Information Flow Security of Separation Kernels with Channel-Based Communication.

Secure System Virtualization: End-to-End Verification of Memory Isolation

Survey of Formal Design and Verification for Operating System

Ensuring secure and robust grid applications – from a formal method point of view

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Automatic Kernel Code Synthesis and Verification

No Crash, No Exploit: Automated Verification of Embedded Kernels

Research on Isolation Semantics Description Based on Noninterference Theory and Automated Isolation Strategy Verification Scheme

Runtime Verification of Linux Kernel Security Module

Rely-guarantee Reasoning about Concurrent Memory Management: Correctness, Safety and Security

Formal Modeling and Security Analysis for Intra-level Privilege Separation.

Practical and Scalable Security Verification of Secure Architectures

Formalizing and Verifying Decentralized Systems with Extended Concurrent Separation Logic

Securing Monolithic Kernels using Compartmentalization

Formal Verification for C Program

Research on Microkernel Integrity Semantics Model and Formal Verification