Hardware Virtualization puts a new spin on Secure SystemsVirtualization for secure systems

ORIGINALLY PUBLISHED IN COTS JOURNAL, OCTOBER 2010
Author: Robert Day, LynuxWorks, Inc.

Real-time determinism and military security don't have to be separate realities. A combination of a secure separation kernel and an embedded hypervisor enables whole new levels of system security.

As more military embedded systems get connected to the outside world, particularly to the open Internet, the more vulnerable they become to the seemingly unstoppable waves of cyber attacks. Gone are the days of dedicated and discrete embedded systems, and in their place the embedded systems look more and more like the PCs and workstations that sit in our offices and homes, which in turn means that the software that runs on these devices will need similar characteristics to desktop systems.

There are two serious issues with this trend. The traditional desktop operating systems, software stacks and applications are not built with either real-time performance or security in mind, and are now being used in systems that require the determinism of a Real-Time Operating System (RTOS). And when they are connected to outside world, they need protection from cyber attack that has plainly been lacking in our desktop world.

A possible solution to these issues is to use an embedded version of a desktop OS, like embedded Linux® or Windows® CE. However, although both are more real-time and possibly more secure than their desktop counterparts, neither have been built with either real-time determinism or military security in mind, and only go so far to solving these issues. An interesting, elegant and ultimately more suitable solution is to use the combination of a secure separation kernel and an embedded hypervisor combined with today's modern multicore processors.

Separation-Kernel Technology

The separation kernel is a technology developed for use in secure military systems that provides an underlying real-time platform with multiple secure domains housing software applications that cannot interfere with each other. When combined with an embedded hypervisor, each of the domains can securely host different "guest" operating systems and the applications that they support. This secure virtualization system provides security and trust by containing the operating systems and applications from one another and enforcing strict security policies with any desired communication between the domains.

Because the underlying separation kernel has real-time scheduling policies, real-time applications and operating systems can run in a domain providing the performance normally offered by an RTOS. The desktop functionality and connection to the outside world can be hosted in another domain, using a more traditional desktop OS like Windows or Linux. Any cyber attacks will be contained to this domain and cannot spread to the critical functions or hamper the performance of the real-time domain. Also, because the desktop operating system is being run in a virtual environment, any contamination is not just contained, but it can also be cleaned up by either rebooting or re-provisioning the desktop system without stopping or resetting the real-time part of the system.

Figure 1: Multicore processors, which often also have hardware virtualization support, are the best way to maintain near-native performance of all of the secure domains.

Leveraging Multicore Processors

Figure 2: The Common Display System (CDS) aboard the DDG 1000 Zumwalt class of next-generation destroyers will make use of virtualization using separation kernel and hypervisor technology.

Software virtualization can be used across single-core processors, but when running larger desktop operating systems that are used to having full control of a processor, multicore parts that often also have hardware virtualization support are the best way to maintain near-native performance of all of the secure domains (Figure 1). The LynxSecure separation kernel and hypervisor from LynuxWorks™ offers support for both real-time and desktop guest operating systems and supports multicore Intel® processors with hardware virtualization, and gives a secure foundation for building trusted embedded systems.

An example program using this separation kernel and hypervisor technology is the U.S. Navy's Common Display System (CDS). CDS is a survivable and configurable high-assurance workstation providing an operator access to multiple shipboard applications simultaneously. This family of console displays is to be integrated into the ships that comprise the DDG 1000 Zumwalt class of next-generation destroyers (Figure 2) as well as the modernization of the Aegis class of guided missile destroyers. The CDS project is part of the U.S. Navy Open Architecture Computing Environment initiative.

In the CDS, LynxSecure provides an environment in which multiple guest operating systems running at different security levels (Secret, Top Secret and Unclassified) execute at the same time without compromising security, reliability or data integrity. This is critical because military systems such as the CDS display console system require adherence to rigid high-assurance security requirements. Program plans include evaluation of LynxSecure to EAL-7 per the Common Criteria and the Separation Kernel Protection Profile (SKPP).

Robert Day is Vice President, Marketing at LynuxWorks, Inc. and has more than 20 years of experience in the embedded industry. Based in San José, California, Robert is a graduate of the University of Brighton, England, where he earned a Bachelor of Science degree in computer science.

A LynuxWorks embedded OS is featured in this embedded system application:

Protocom PR818 Single-chip MPEG-4 CODEC

Who else uses a LynuxWorks embedded operating system?

Security white papers

Building in RTOS Support for Safety- & Security-Critical Systems: LynuxWorks explains the differences between safety-critical and security-critical applications and how to meet their demanding requirements with the LynxOS-178 RTOS and the LynxSecure hypervisor. (EE Times Design, August 2011)
Enhancing Application Performance on Multicore Systems: Tips on optimizing a multicore real-time system, including virtualization, avoiding synchronization and concurrency while maximizing application parallelism. (Military Embedded Systems, February 2011)
Hardware Virtualization puts a new spin on Secure Systems: Real-time determinism and military security don't have to be separate realities. A combination of a secure separation kernel and an embedded hypervisor enables whole new levels of system security. (COTS Journal, October 2010)
Using a Separation Kernel to add Military-Grade Security to Legacy Systems: A challenge for the software designer is how to integrate modern military-grade software programs into legacy software designed long before security standards were predominant in system requirements. (VME Critical Systems, Summer 2010)
Virtualization: Keeping Embedded Software safe and Secure in an Unsafe World: A new, secure methodology is needed to separate systems of different security levels which run on shared resources—without compromising the performance of legacy systems. (EE Times, June 2010)
Secure Virtualization Combines Traditional Desktop OSs and Embedded RTOSes in Military Embedded Systems: Advances in software and hardware technologies now make it feasible to use both embedded and desktop operating systems in a secure military system. (Military Embedded Systems, May 2010)
DO-178B Provides Certification Safety net: Developers of commercial avionics software must demonstrate compliance with DO-178 guidelines. The FAA has issued additional guidance for so-called DO-178B Reusable Software Components (RSCs as defined in AC20-148), which allow for reuse of certifications. (COTS Journal, November 2009)
Designing Safety-critical Avionics Software Using open Standards: Safety-critical avionics systems have continually grown more complex and software-intensive. Regulatory authorities and avionics manufacturers have responded with guidance such as DO-178B and RSC to ensure that software performs safely, with controlled development cost. (Boards and Solutions, September 2009)
Two Different Realms: RTOS Support for Safety-critical vs. Security-critical Systems: Safety- and security-critical system functions are evolving simultaneously, with different yet similar requirements. Modern RTOSes are stepping up to meet these needs. (VME and Critical Systems, June 2009)
Virtualization Makes Better use of Open-source OSes and apps: With the introduction of the embedded hypervisor, embedded systems can avoid certain performance or licensing issues inherent to open-source OSes and applications. (EE Times, March 23, 2009)
Secure Virtualization Technology can Extend the life of Legacy Systems: By combining the concept of virtualization and security, one can consolidate multiple legacy systems running on heterogeneous operating systems onto a single host system with high-assurance security. (Military Embedded Systems, January/February 2009)
Virtual Machines: Intel's CPU Extensions Transform Virtualization: Virtualization has traditionally presented its share of design challenges in information-assurance-based systems. But now, Intel's VT-x and VT-d CPU extensions are changing the game and showing potential to become the de facto path to virtualization. (Military Embedded Systems, January 2009)
Separation Kernel for a Secure Real-time Operating System: The technical foundation adopted for the so-called MILS architecture is a separation kernel like LynxSecure, which permits multiple functions to be realised on a common set of physical resources without unwanted mutual interference. (Boards and Solutions Magazine, February 2008)
Advances in Virtualization aid Information Assurance: Advances in the newest Intel® processors are making virtualization much easier to implement in security applications than ever before. (Embedded Computing Design, January 2008)
Protecting our most Vital Systems: Some significant defence programmes are already committed to a new approach to high-threat, high-asset-value systems. Rance DeLong explains MILS. (Components in Electronics, April 2007)
Perspectives: Security and the Separation Kernel: Today's avionics systems are designed to support more than one application, using a partitioned operating system and memory management units to ensure applications have adequate separation. (Avionics Magazine, April 2007)
MILS: An Architecture for Security, Safety, and Real Time: The unrelenting growth and integration of embedded controls, information processing, and communications has created a need for systems that provide robust protection for resources and services in the face of serious threats. (Embedded Technology Magazine, November 2006)
Partitioning Operating Systems Versus Process-based Operating Systems: Partitioning operating systems are the latest buzz, while processes, by contrast, have been around for over 30 years. Both provide memory protection, however, the intent behind them is very different.
DO-178B and the Common Criteria: Future Security Levels: Although there are similarities between the airborne safety-critical requirements in RTCA/DO-178B and the Common Criteria, ISO 14508, compliance with the higher levels of security in the Common Criteria demands meeting additional security requirements. (COTS Journal, April 2006)
Reusing Safety-Critical Software Components: Safety-critical systems often operate together as a single "system-of-systems," making it important that they meet the most stringent and rigorous requirements for safety-criticality. The failure of one module in a system could create other failures or vulnerabilities, or worse yet, failure of the system as a whole. (COTS Journal, August 2005)
Using the Microprocessor MMU for Software Protection in Real-Time Systems: With minimal impact to overall system performance, user tasks and the kernel can be protected from accidental corruption by using multiple protected address spaces.
Improving code Migration and Reuse: The unrelenting growth and integration of embedded controls, information processing, and communications has created a need for systems that provide robust protection for resources and services in the face of serious threats. (Embedded Computing Design, August 2006)
FCS Program Rolls Forward in Formation: A wireless data network, with advanced communications and technologies, links soldiers with 18 new, lightweight manned and unmanned ground vehicles, unmanned aircraft, sensors and weapons—and it's all in one program. (COTS Journal, June 2005)
Secure Operating Systems for Deeply Embedded Devices: As we add more intelligence to our embedded devices, we find that they are becoming increasingly integrated into our information technology infrastructure. Though system security is not a new concept, security-in-depth is a new paradigm developers are now starting to address. (RTC Magazine, September 2004)