Article Dans Une Revue International Journal of Embedded Systems and Applications Année : 2023

Pip-MPU: Formal verification of an MPU-based separation kernel for constrained devices

Résumé

Pip-MPU is a minimalist separation kernel for constrained devices (scarce memory and power resources). In this work, we demonstrate high-assurance of Pip-MPU’s isolation property through formal verification. Pip-MPU offers user-defined on-demand multiple isolation levels guarded by the Memory Protection Unit (MPU). Pip-MPU derives from the Pip protokernel, with a full code refactoring to adapt to the constrained environment and targets equivalent security properties. The proofs verify that the memory blocks loaded in the MPU adhere to the global partition tree model. We provide the basis of the MPU formalisation and the demonstration of the formal verification strategy on two representative kernel services. The publicly released proofs have been implemented and checked using the Coq Proof Assistant for three kernel services, representing around 10000 lines of proof. To our knowledge, this is the first formal verification of an MPU based separation kernel. The verification process helped discover a critical isolation-related bug.
Fichier principal
Vignette du fichier
Pip-MPUFormalVerificationOfAnMPU-BasedSeparationKernelForConstrainedDevices.pdf (1.85 Mo) Télécharger le fichier
Origine Publication financée par une institution

Dates et versions

hal-04185923 , version 1 (23-08-2023)

Identifiants

Citer

Nicolas Dejon, Chrystel Gaber, Gilles Grimaud. Pip-MPU: Formal verification of an MPU-based separation kernel for constrained devices. International Journal of Embedded Systems and Applications, 2023, 13 (02), pp.1-21. ⟨10.5121/ijesa.2023.13201⟩. ⟨hal-04185923⟩
143 Consultations
154 Téléchargements

Altmetric

Partager

More