Separation kernel

Key takeaways

Separation kernel belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Separation kernel to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Separation kernel from memory before moving on to harder problems.

Reference excerpt

A separation kernel is a type of security kernel used to simulate a distributed environment. The concept was introduced by John Rushby in a 1981 paper. Rushby proposed the separation kernel as a solution to the difficulties and problems that had arisen in the development and verification of large, complex security kernels that were intended to "provide multilevel secure operation on general-purpose multi-user systems." According to Rushby, "the task of a separation kernel is to create an environment which is indistinguishable from that provided by a physically distributed system: it must appear as if each regime is a separate, isolated machine and that information can only flow from one machine to another along known external communication lines. One of the properties we must prove of a separation kernel, therefore, is that there are no channels for information flow between regimes other than those explicitly provided." A variant of the separation kernel, the partitioning kernel, has gained acceptance in the commercial aviation community as a way of consolidating multiple functions onto a single processor, perhaps of mixed criticality. Commercial real-time operating system products in this genre have been used by aircraft manufacturers for safety-critical avionics applications. In 2007 the Information Assurance Directorate of the U.S. National Security Agency (NSA) published the Separation Kernel Protection Profile (SKPP), a security requirements specification for separation kernels suitable to be used in the most hostile threat environments. The SKPP describes, in Common Criteria parlance, a class of modern products that provide the foundational properties of Rushby's conceptual separation kernel. It defines the security functional and assurance requirements for the construction and evaluation of separation kernels while yet providing some latitude in the choices available to developers. The SKPP defines separation kernel as "hardware and/or firmware and/or software mechanisms whose primary function is to establish, isolate and separate multiple partitions and control information flow between the subjects and exported resources allocated to those partitions." Further, the separation kernel's core functional requirements include:

Protection of all resources (including CPU, memory and devices) from unauthorized access. Separation of internal resources used by the Target of Evaluation Security Functions (TSF) from exported resources made available to subjects. Partitioning and isolation of exported resources. Mediation of information flows between partitions and between exported resources. Audit services. The separation kernel allocates all exported resources under its control into partitions. The partitions are isolated except for explicitly allowed information flows. The actions of a subject in one partition are isolated from (viz., cannot be detected by or communicated to) subjects in another partition, unless that flow has been allowed. The partitions and flows are defined in configuration data. Note that 'partition' and 'subject' are orthogonal abstractions. 'Partition,' as indicated by its mathematical genesis, provides for a set-theoretic grouping of system entities, whereas 'subject' allows us to reason about the individual active entities of a system. Thus, a partition (a collection, containing zero or more elements) is not a subject (an active element), but may contain zero or more subjects. The separation kernel provides to its hosted software programs high-assurance partitioning and information flow control properties that are both tamperproof and non-bypassable. These capabilities provide a configurable trusted foundation for a variety of system architectures.

Solutions PikeOS combines separation kernel hypervisor technology with hard real-time capabilities. INTEGRITY-178B from Green Hills Software In September 2008 it became the first separation kernel certified against the SKPP. Wind River Systems has separation kernel technology that was in active certification process in 2009. Lynx Software Technologies has a separation kernel, LynxSecure. In 2011, the Information Assurance Directorate sunset the SKPP. NSA will no longer certify specific operating systems, including separation kernels against the SKPP, noting "conformance to this protection profile, by itself, does not offer sufficient confidence that national security information is appropriately protected in the context of a larger system in which the conformant product is integrated". The seL4 microkernel has a formal proof of concept that it can be configured as a separation kernel. The enforced continuance of information along with this implies it is an elevated level example of assurance. The Muen separation kernel is also a formally verified open source separation kernel for x86 machines.

See also For a computer security architecture based on a separation kernel see Multiple Independent Levels of Security. Chroot FreeBSD jail OS-level virtualization

References

Worked examples

Example 1 — a first encounter with Separation kernel

Start with the simplest possible case. Write down what Separation kernel claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Separation kernel before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Separation kernel ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Separation kernel

In research: Separation kernel appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Separation kernel in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Separation kernel is common in secondary-school and first-year university syllabi. It links to neighbouring topics Distributed computing, Operating system kernels, so understanding it makes those chapters shorter.
In everyday life: Look for Separation kernel outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Separation kernel in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Separation kernel means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Separation kernel out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Separation kernel in simple terms?

A separation kernel is a type of security kernel used to simulate a distributed environment. The concept was introduced by John Rushby in a 1981 paper.

Why does Separation kernel matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Separation kernel?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Separation kernel.