3 ms·

High-assurance security has been pushing separation kernels to solve that kind of problem for a long time. Vendors even list automotive in their Solutions menus

High-assurance security has been pushing separation kernels to solve that kind of problem for a long time. Vendors even list automotive in their Solutions menus. Two got evaluated by NSA for security. I think NSA cancelled that protection profile because the hardware and firmware were having too many leaks to find a software solution believable. The boards aimed at that market are also increasingly complex. However, the separation kernels and virtualization platforms were the strongest thing produced for this goal with some still available. Here's a good explanation of default, architectural style used in high-assurance security from a team that FOSS's a lot of their prototypes: https://os.inf.tu-dresden.de/papers_ps/nizza.pdf https://os.inf.tu-dresden.de/papers_ps/nizza.pdf Here's a commercial one used in an automotive platform that got certified to high assurance at EAL6+: https://www.ghs.com/products/safety_critical/integrity-do-178b.html https://www.ghs.com/products/safety_critical/integrity-do-17... I'm not endorsing the [closed-source] product so much as the methods it claimed to use to get the job done. Look at the architecture, minimalist runtimes (esp for Ada), determinism, partitioning, and certification data on bottom-right. That last part hints at the kinds of things they have to do and get reviewed for the certification. If a developer claims to do security, ask to see the Covert, Channel Analysis of their product. That certification requirement/activity is how cache-based, timing channels were discovered in 1992 by VAX Security Kernel team among other leaks. Covert and side channels are getting popular again but most still don't apply storage/timing analysis. You'll find that most developers and "security professionals" don't build secure stuff using methods proven to work in the past. Companies building tech like this sell it for high price since there's so few buyers. The networking-oriented ones started at $50,000 when I priced them. You can bet the big companies whose products are getting hit could've afforded them, though. Especially the royalty-free options.

Nokinside 8y ago
Partitioning kernels have been used decades in aviation and other safety critical systems. I have developed software for integrity for example. It's commercial software and not proper open source, but the code is available for their their customers. These system address the issue of separating different functions as well as possible. What they don't address the problems that widely used homogeneous systems face when a way to compromise the system is found.
- nickpsecurity 8y ago
  I first encountered them made for aerospace for DO-178B. What's the oldest one you know like a separation kernel whose design details are publicly described? I like giving proper credit and knowing the history. For me, we went from security kernels to Rushby's concept to separation kernels. Then, they did aerospace versioms first since safety requirements were already a subset of security requirements. Plus, aerospace companies would actually buy it. Hard to sell that stuff in non-regulated markets.
  - Nokinside 8y ago
    I'm not good at history of operating systems. Separation kernel is efficiency thing. The oldest and most secure way to solve the same problem is separate computers and put data diodes between them if necessary. Need for integrated modular avionics was the driving force for the development. Aircraft have space and weight limits.
irundebian 8y ago
> If a developer claims to do security, ask to see the Covert, Channel Analysis of their product. > You'll find that most developers and "security professionals" don't build secure stuff using methods proven to work in the past. Could you tell which security professionals actually offering such in depth analysis? I have the feeling that most penetration tests or security assessments offered aren't that deep, rather mostly of low-quality. Could you also tell how the NSA is doing their security evaluations exactly? I know there is Common Criteria, but these documents are so high-level that you can't derive the techniques on how to conduct thorough evaluations.
- nickpsecurity 8y ago
  Almost none. Most people in the security industry don't use techniques like that which proved out in older evaluations. My own framework for looking at things was heavily based on those methods. Common Criteria got too political where people might try to dodge requirements with hand-waiving. So, I'll give you that plus the VAX Retrospective since the design, layering, and assurance sections show you what methods were in use in 1990's high-assurance security. Also, the covert channel analysis was how they found cache-based, timing channels in it in 1992. Mainstream security ignored that for a long time, too. Most still don't give them credit. It's a social or clique thing that I can tell. http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A-retrospective-on-the-VAX-VMM-security-kernel.pdf http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A... https://pastebin.com/y3PufJ0V https://pastebin.com/y3PufJ0V For covert channels, you want to look up Kemmerer's Shared Resource Matrix for storage channels and Wray's method for timing channels. Those got early results. There's a lot of newer ones under banner of "information flow security." Google variations of those terms with "PDF" since they're PDF's to find lots of answers. Throw the word "survey" in with information flow since I think there was a survey paper. Finally, I'll throw in below my summary of assurance techniques I found over time: https://pastebin.com/uyNfvqcp https://pastebin.com/uyNfvqcp
  - irundebian 8y ago
    Thank you very much! You're pastebin were really interesting to read.

Nokinside 8y ago

Partitioning kernels have been used decades in aviation and other safety critical systems. I have developed software for integrity for example. It's commercial software and not proper open source, but the code is available for their their customers. These system address the issue of separating different functions as well as possible. What they don't address the problems that widely used homogeneous systems face when a way to compromise the system is found.

nickpsecurity 8y ago
I first encountered them made for aerospace for DO-178B. What's the oldest one you know like a separation kernel whose design details are publicly described? I like giving proper credit and knowing the history. For me, we went from security kernels to Rushby's concept to separation kernels. Then, they did aerospace versioms first since safety requirements were already a subset of security requirements. Plus, aerospace companies would actually buy it. Hard to sell that stuff in non-regulated markets.
- Nokinside 8y ago
  I'm not good at history of operating systems. Separation kernel is efficiency thing. The oldest and most secure way to solve the same problem is separate computers and put data diodes between them if necessary. Need for integrated modular avionics was the driving force for the development. Aircraft have space and weight limits.

irundebian 8y ago

> If a developer claims to do security, ask to see the Covert, Channel Analysis of their product. > You'll find that most developers and "security professionals" don't build secure stuff using methods proven to work in the past. Could you tell which security professionals actually offering such in depth analysis? I have the feeling that most penetration tests or security assessments offered aren't that deep, rather mostly of low-quality. Could you also tell how the NSA is doing their security evaluations exactly? I know there is Common Criteria, but these documents are so high-level that you can't derive the techniques on how to conduct thorough evaluations.

nickpsecurity 8y ago
Almost none. Most people in the security industry don't use techniques like that which proved out in older evaluations. My own framework for looking at things was heavily based on those methods. Common Criteria got too political where people might try to dodge requirements with hand-waiving. So, I'll give you that plus the VAX Retrospective since the design, layering, and assurance sections show you what methods were in use in 1990's high-assurance security. Also, the covert channel analysis was how they found cache-based, timing channels in it in 1992. Mainstream security ignored that for a long time, too. Most still don't give them credit. It's a social or clique thing that I can tell. http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A-retrospective-on-the-VAX-VMM-security-kernel.pdf http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A... https://pastebin.com/y3PufJ0V https://pastebin.com/y3PufJ0V For covert channels, you want to look up Kemmerer's Shared Resource Matrix for storage channels and Wray's method for timing channels. Those got early results. There's a lot of newer ones under banner of "information flow security." Google variations of those terms with "PDF" since they're PDF's to find lots of answers. Throw the word "survey" in with information flow since I think there was a survey paper. Finally, I'll throw in below my summary of assurance techniques I found over time: https://pastebin.com/uyNfvqcp https://pastebin.com/uyNfvqcp
- irundebian 8y ago
  Thank you very much! You're pastebin were really interesting to read.