[Paper Review] High-Assurance Separation Kernels: A Survey on Formal Methods

Yongwang Zhao, David Sanán+2 more|arXiv (Cornell University)|Jan 6, 2017

Security and Verification in Computing77 references3 citations

TL;DR

This paper presents a comprehensive survey of formal methods applied to high-assurance separation kernels, proposing an analytical framework and taxonomy to systematize research in this domain. It identifies key challenges such as the specification bottleneck, multicore concurrency, and automation of full formal verification, while highlighting progress in full verification of kernels like seL4 and mCertiKOS.

ABSTRACT

Separation kernels provide temporal/spatial separation and controlled information flow to their hosted applications. They are introduced to decouple the analysis of applications in partitions from the analysis of the kernel itself. More than 20 implementations of separation kernels have been developed and widely applied in critical domains, e.g., avionics/aerospace, military/defense, and medical devices. Formal methods are mandated by the security/safety certification of separation kernels and have been carried out since this concept emerged. However, this field lacks a survey to systematically study, compare, and analyze related work. On the other hand, high-assurance separation kernels by formal methods still face big challenges. In this paper, an analytical framework is first proposed to clarify the functionalities, implementations, properties and standards, and formal methods application of separation kernels. Based on the proposed analytical framework, a taxonomy is designed according to formal methods application, functionalities, and properties of separation kernels. Research works in the literature are then categorized and overviewed by the taxonomy. In accordance with the analytical framework, a comprehensive analysis and discussion of related work are presented. Finally, four challenges and their possible technical directions for future research are identified, e.g. specification bottleneck, multicore and concurrency, and automation of full formal verification.

Motivation & Objective

• To address the lack of a systematic survey on formal methods in separation kernel research.
• To clarify the functionalities, implementations, properties, and standards of separation kernels through a structured analytical framework.
• To categorize and compare existing research works based on formal methods application, functionalities, and properties.
• To identify persistent challenges in formal verification of separation kernels and propose technical directions for future work.
• To support the development of more secure and certifiable high-assurance systems through improved formal engineering practices.

Proposed method

• Proposes an analytical framework to characterize separation kernels by their functionalities, implementations, properties, and formal method applications.
• Designs a taxonomy based on formal methods application, functional capabilities, and system properties to classify existing research.
• Conducts a comparative analysis of 20+ separation kernel implementations using the taxonomy, focusing on formal specification, verification, and certification.
• Reviews case studies of formally verified kernels such as seL4, mCertiKOS, and PROSPER to evaluate full formal verification approaches.
• Analyzes the limitations of post-hoc verification and advocates for stepwise refinement and verified code generation in formal development pipelines.
• Identifies gaps in multicore support, concurrency modeling, and automation of formal verification in current research.

Experimental results

Research questions

• RQ1 How can formal methods be systematically applied to separation kernels to ensure high assurance in safety and security?
• RQ2 What are the key challenges in achieving full formal verification of separation kernel implementations?
• RQ3 How do existing formal verification approaches differ in terms of specification granularity, verification scope, and automation?
• RQ4 What are the limitations of current post-hoc verification techniques, and how can formal development with stepwise refinement improve the process?
• RQ5 What technical directions are most promising for addressing multicore and concurrency issues in formally verified separation kernels?

Key findings

• The specification bottleneck remains a major challenge, with limited reusability and generality in formal specifications across different kernels.
• Full formal verification has been successfully applied to several kernels, including seL4 and mCertiKOS, achieving machine-checked proofs of correctness.
• Formal verification of multicore and concurrent separation kernels has not yet been achieved, despite growing demand in modern systems.
• Post-hoc verification is still the dominant approach, with limited use of refinement-based development and verified code generation.
• Verified code generation is hindered by the need for low-level optimizations and assembly-level hardware manipulation, requiring integration of machine models in formal synthesis.
• The survey identifies a clear need for automated, end-to-end formal development pipelines that support concurrency, multicore support, and traceability from specification to verified code.