Provably trustworthy systems

Abstract

We present recent work on building and scaling trustworthy systems with formal, machine-checkable proof from the ground up, including the operating system kernel, at the level of binary machine code. We first give a brief overview of the seL4 microkernel verification and how it can be used to build verified systems. We then show two complementary techniques for scaling these methods to larger systems: proof engineering, to estimate verification effort; and code/proof co-generation, for scalable development of provably trustworthy applications.This article is part of the themed issue 'Verified trustworthy software systems'.

Cogent: uniqueness types and certifying compilation

“…Functional verification of file systems belongs to systems verification in general. Klein et al (2017) gives a more thorough overview of the work in this area. Some major achievements are the comprehensive verification of the seL4 microkernel (Klein et al, 2009), the verification stack of the Verisoft project (Alkassar et al, 2009(Alkassar et al, , 2010, the increase of verification productivity in CertiKOS (Gu et al, 2011(Gu et al, , 2015 and the full end-to-end application verification in Ironclad (Hawblitzel et al, 2014), which builds on a modified verified Verve kernel (Yang & Hawblitzel, 2010) and the aforementioned Dafny language.…”

Position paper: the science of deep specification

“…Constructing specifications and proofs for complex software and hardware increases the directly incurred development time and requires a suitable workforce. Putting a precise cost on this effort is as difficult as is the case for traditional validation methodologies, but article [18] of this volume contains some current estimates from the seL4 project.…”

“…In language semantics, researchers have developed formal specifications of most of JavaScript [11] and ML [12]. In operating systems, the CertiKOS project [13][14][15][16] has built a new, fully verified and secure hypervisor kernel including formal specifications not just of the system-call APIs (application programming interfaces) but also of all of the kernel's internal abstraction layers, while the seL4 project has specified and verified both functional correctness and security properties of a microkernel in the popular L4 family [17,18]. In networking, there has been work to verify TCP/IP [19] and Software-Defined Networks [20].…”

Verified trustworthy software systems

“…developed the verified reference implementation, miTLS, for the TLS protocol; -Kathleen Fisher [2] from Tufts University, USA, who created the DARPA project HACMS; -Neil White [3], head of engineering at Altran UK; -Daniel Kroening [4] from Oxford, who built the CBMC model-checker, and is the CEO and founder of the start-up DiffBlue; -Gerwin Klein [5] from Data61 and the University of New South Wales in Australia, who developed the verified kernel seL4, which underpins the HACMS project, with his colleague Gernot Heisser; -Nickolai Zeldovich from MIT, who has developed a verified operating system with his colleague Adam Chlipala [6] from the DeepSpec project; -Mark Batty [7] from the University of Kent, who has developed weak memory models for x86, Power and ARM CPUs, and has significantly influenced the C11 language specification with Peter Sewell at Cambridge; -Peter O'Hearn from Facebook London and University College London, who leads the team working on the Facebook Infer static analysis tool; -Philippa Gardner from Imperial College London, who works on the fundamental theory and prototype tools for the specification and verification of concurrent and web programs; In this publication, some of the speakers and their co-authors describe their current and future research ideas, aiming to make their papers accessible to a general audience interested in software verification. There are some absolute gems.…”

“…-Sir Tony Hoare FRS from Microsoft Research (MSR), Cambridge, a founder of the field of program verification, who opened and closed the meeting; -J Strother Moore [1] from the University of Texas, who pioneered tractable verification in industry by developing ACL2 and used it to verify floating-point arithmetic in AMD processors; -Cédric Fournet from MSR Cambridge and the MSR-INRIA Joint Centre in Paris, who developed the verified reference implementation, miTLS, for the TLS protocol; -Kathleen Fisher [2] from Tufts University, USA, who created the DARPA project HACMS; -Neil White [3], head of engineering at Altran UK; -Daniel Kroening [4] from Oxford, who built the CBMC model-checker, and is the CEO and founder of the start-up DiffBlue; -Gerwin Klein [5] from Data61 and the University of New South Wales in Australia, who developed the verified kernel seL4, which underpins the HACMS project, with his colleague Gernot Heisser; -Nickolai Zeldovich from MIT, who has developed a verified operating system with his colleague Adam Chlipala [6] from the DeepSpec project; -Mark Batty [7] from the University of Kent, who has developed weak memory models for x86, Power and ARM CPUs, and has significantly influenced the C11 language specification with Peter Sewell at Cambridge; -Peter O'Hearn from Facebook London and University College London, who leads the team working on the Facebook Infer static analysis tool; -Philippa Gardner from Imperial College London, who works on the fundamental theory and prototype tools for the specification and verification of concurrent and web programs;…”