Paul Parkinson

EGNOS Satellite Navigation System Safety Certification

In case you missed it, yesterday Wind River announced that VxWorks has been selected for the European Geostationary Navigation Overlay Service (EGNOS), and has been chosen to run the Integrity Processing Facility (IPF) check set.

The IPF, developed and delivered by Logica, is the crucial element that validates the information broadcast by the satellites to safety-critical users such as aircraft in flight or ships navigating through narrow channels. This is essential, because satellite navigation systems alone do not provide sufficient positional accuracy to be used in safety-critical applications.

The IPF is really good example of a critical system which needs to consistently provide hard real-time performance and total reliability, and this posed some interesting challenges for development and safety certification to the joint avionics software safety standards RTCA DO-178B and EUROCAE ED-12B at Level B.

Logica and the European Space Agency (ESA) have kindly allowed us to produce a case study which discusses the development and certification challenges and how they were successfully overcome, and this has just been published on the Electronics Weekly website. (Update: the case study can now also be downloaded in PDF from the Wind River website)

I hope you'll find this interesting, and the next time you are on a European flight on a landing approach in very poor visibility conditions, you'll know how VxWorks is helping to guide the aircraft to a safe landing.

Multicore called up for active service

There's an interesting editorial column 'Multicore Processing Becomes the New Mainstream' in the latest edition of COTS Journal. Jeff Child discusses how multicore processors, after becoming all pervasive in the desktop and server market, are now becoming the norm for embedded aerospace and defence systems. He also shares some insights into why the transition to multicore is necessary, and provides an example of the deployment of multicore in the Aegis Modernization Program (Congressional Research Service report on FAS website: PDF).

Rather tantalizingly, Jeff only mentions software architectures in his final paragraph (maybe that's a subject for a future editorial), where he contrasts the use of Symmetric Multiprocessing (SMP) on multicore devices with tiled processors (which can be massively parallel architectures). 

As a software engineer, I think this is where things start to get really interesting, and there are actually quite a number of different possible permutations on homogeneous multicore architectures when you include visualization using a hypervisor into the overall software architecture. This can support a system with separate instances of an operating system or runtime per core, known as asymmetric multiprocessing (AMP); or a single instance of an operating system running across multiple cores, known as symmetric multiprocessing (SMP), or even a combination of both.

Customers often ask me 'Which is better, AMP or SMP?', and my answer is 'It depends'. It depends on the nature of their application, the degree of parallelism within it which determines the scalability across cores; it depends on the I/O architecture and throughput requirements and more besides. But by analyzing the system requirements in detail, these can be mapped to a suitable implementation which may comprise AMP, SMP or both. Bill Graham discusses how this complexity can be simplified into a number of key uses cases in this recent blog.

Back to the COTS Journal editorial, Jeff also mentions that tiled processors (and massively parallel architectures in general) present a programming challenge due to the complexity involved. This subject was also recently discussed in some technical depth by Mark Hermeling in a recent blog 'A sea of cores, now what?'.

The Open Group: Real-Time Embedded Systems Forum, Rome

Last week, I attended the The Open Group, Rome 2010 conference, specifically the Real-Time Embedded Systems Forum track (agenda), in order to participate in the MILS API standardization working group sessions.

The goal of the working group is to produce a standardized API for a Minimal Runtime (MRT) environment which is suitable for High Assurance systems, which will enable portability of middleware between MILS platforms and aid interoperability. The working group wrestled with some fundamental aspects of the MRT, including goals/objectives, characteristics and implementation architecture, but these were productive sessions. There's still a long way to go, but these were important steps in the right direction. Watch this space for further developments!

It was also useful to have the opportunity to attend the RTES Forum presentations. Some of the highlights for me were Ed Roberts of Elparazim's presentations on AADL, Olaf Tetteo of Brightsight's presentation on 'Certification & Mutual Recognition above EAL-4 in Europe', and my colleague Alex Wilson's presentation on 'Challenges of Multicore, potential impact on Safety Critical and High Assurance Security Environments'. Open Group members can download the proceedings from here (login required).

With such a packed agenda, I was worried that we might not have an opportunity to see the delights of Rome, but fortunately for the Tuesday evening, The Open Group had arranged a tour of the stunning Capitoline Museum followed by the conference dinner on the rooftop terrace which had a spectacular view of the city skyline.

A Decade at Wind River

On Wednesday, it will be exactly ten years since I joined Wind River.

I was thinking about this on my flight to San Francisco on Saturday, and as well as wondering how I long I've spent watching the VxWorks boot loader counting down to zero on the serial console over the years, I was also reminiscing about my early days with the company.

In many ways, it doesn't feel like a decade (as they say: time flies when you're having fun). This is the longest that I've worked for a company, and I was thinking about what it is that keeps me so interested and motivated in my job.

It's hard to put into words, but I have to admit that I really enjoy being at the cutting edge, observing the continual technological advances, not just for technologies' sake (although I admit to being a technophile), but in order to work out these can be applied to real world applications to meet customer requirements and solve their problems.

I started at Wind River in 2000, just before the dot com boom turned into the dot com crash, which many people would rather forget, but this was still a significant point when Internet connectivity was starting to spread from the Enterprise arena into the outside world. In my own area of specialization, Aerospace & Defense, IP-based networking was only just starting to replace stove pipe systems, but the adoption of commercial-off-the-shelf (COTS) technologies was fragmented and interoperability hindered by a lack of standardization. This made presented an unwanted challenge of developing a solutions stack for programmes.

Ten years on, I'm not so naive as to claim that things are now perfect, but the widespread adoption of open standards and open architectures in recent years is providing programmes with a range of interoperable implementation options, increasing choice and flexibility, and also resulting in lower risk for long term support and managed obsolescence.

I've also noticed that embedded devices have become a lot smarter in the last decade, passive remotely controlled devices are now being superseded by intelligent semi-autonomous and even fully-autonomous systems which are capable of flying UAVs and even aircraft without a pilot (see previous blog: Airborne Control of UAV Swarms). A lot of this has only become possible due to the massive increase in processor performance in relation to power dissipation (especially in airborne systems, and with the advent of multicore processors this provides even greater potential for exploitation). I wonder whether in ten years time we will have seen the introduction of autonomous commercial aircraft, maybe for cargo initially?

The Internet has become all-pervasive, and we now rely on IP-based networking for everything from communication between desktop computers, multimedia broadcast, through to critical national infrastructure. This presents new challenges in terms of increased cybersecurity threat due to the inter-connectivity of networks and some of the IPv4 protocols were not designed with security in mind. However, the deployment of IPv6 and the on-going developments of processor hardware virtualisation support and provably secure implementations of the Multiple Independent Levels of Security (MILS) will provide the foundations for secure robust systems which can mitigate this threat and more besides.

A decade on, the future still looks exciting.

A&D Regional Conferences

I've recently finished updating presentations on The Essentials of Multicore Software and Challenges of Security Software Development for our forthcoming Aerospace & Defence Conferences which we are holding across Europe in November.

It's been interesting to think about how multicore can be used in technology refreshes and applied to new programmes. I'm looking forward to discussing these issues with customers, as well as understanding their security requirements, particularly as the need for interoperability continues to grow. We also recently demonstrated some of the capabilities to meet these security requirements in a cross-domain system and Gigabit Ethernet demo running on VxWorks MILS at MILCOM in the US, and the videos are available on YouTube.

If you've not received an invitation to one of the European conferences yet or had a chance to register, why not visit our conference portal? I hope to see you there.

Ada & C mixed language development

Last week, I downloaded AdaCore's GNAT Pro 6.2.2 and the latest GNATbench 2.3.1 release (which was announced yesterday), as I wanted to port an Ada & C mixed-language application to VxWorks 6.7.

I wanted to do this to show a customer how they can develop new Ada applications (as well as reusing existing intellectual property) and integrate them with network protocol stacks, graphics libraries and other middleware which are often implemented in C or C++.

Whilst the Ada 95 and Ada 2005 language standards provide inter-language compatibility with C and C++ respectively, close integration between the development tools is needed in order to really exploit these capabilities fully, for example being able to debug communication modules and/or tasks implemented in different languages.

My mixed language application consists of two VxWorks tasks (written in C), and two Ada tasks. One of the VxWorks tasks sends messages to an Ada task via a VxWorks message queue, and I wanted to step through the sending and receiving of the messages in a debugger to confirm that individual messages were sent and received correctly. This would not be a very user-friendly activity if I had to use two different debuggers to debug the Ada and C code separately. In addition, I also wanted to check that the inter-language calls that I had made (C function calling an Ada procedure and vice versa) had passed parameters using the correct language types and the data values were interpreted correctly.

Workbench provides an open and extensible framework based on Eclipse, so this has enabled AdaCore to integrate capabilities of GNAT Pro seamlessly through the GNATbench plugin. This enabled me to develop and run my mixed language application in Workbench. I was able concurrently debug multiple tasks in mixed languages (see below), and set task specific breakpoints on the Ada and C tasks individually and step over the calls to msgQSend() and msgQReceive() respectively, and confirm that the messages were passed correctly; and I was able to walk up and down the stackframes in the Workbench Debug View and confirm that parameters had been passed correctly between C function and Ada procedure and vice versa.

I also used Workbench's analysis tools System Viewer, Memory Analyser and Performance Profiler to verify the behaviour of Ada & C tasks at system level, and monitor memory & CPU utilisation of each of the Ada procedures and C functions in the mixed language application.

Even after many years working with these technologies, I am still excited by advances in capabilities which make the complex tasks of embedded software development easier. I just wish I was able to spend more time in Workbench and less time in PowerPoint!

Tornado GR4 goes extreme

In case you missed the news, our partner McObject has just announced that BAE SYSTEMS has selected the eXtremeDB running on VxWorks for the Tornado Advanced Radar Display Information System (TARDIS)  on the Tornado GR4 military jet.

This avionics upgrade further extends the capabilities of TARDIS (which I discussed in a previous blog, and also in a customer case study (PDF)), by using the McObject eXtremeDB embedded database to manage tactical information such as aircraft, ship, and vehicle positions provided from real-time sources and overlay it onto a digital map and radar display.

It's interesting to see how using in-memory database instead of a traditional file system provides greater flexibility for data access and interrogation which can be exploited by the end application.

VxWorks MILS 2.0 at DSEi 2009

I am looking forward to Defence Systems and Equipment International (DSEi), the world's largest fully integrated international defence exhibition, which is being held in London from 8-11th September 2009. In preparation for the event, I've been setting up some Wind River VxWorks MILS 2.0 demos on a Curtiss-Wright VPX6-185 board.

VxWorks MILS is Wind River's implementation of the Multiple Independent Levels of Security (MILS) security architecture, which can host applications running at different security classifications, including multilevel secure (MLS), on the same platform. VxWorks MILS is able to do this by implementing information flow control, data isolation, periods processing and damage limitation, whilst ensuring that data does not leak from one partition to another through either overt or covert channels. The demos also show how Wind River Workbench can perform concurrent debugging of multiple partitions, which is invaluable when developing multi-partition systems.

I've also been working on some modifications to a Wind River VxWorks MILS demo which is representative of a real-world application, a Cross Domain Solution (CDS). This filters packets of data between different networks based on the security classification of the data, and uses multiple partitions to implement sender and receiver on different interfaces.

The demo currently uses a simple encryption algorithm for data passed over the black network (which wouldn't present much of a challenge to GCHQ/CESG or NSA). So I am intending to replace this with a stronger encryption algorithm which is more appropriate to the application.

However, I've been presented with a challenge as most of the encryption algorithms in the public domain are available as C language source code, but my colleague has implemented the black host application in Java. Ironically, after some thought, I decided (as a C programmer) it would be easier for me to port the host Java application to C rather than to port the encryption algorithm to Java.

Now, as I've done that, I just need to decide which encryption algorithm to use. I have the C source code for the encrypt algorithm for the German Enigma cipher machine (which I have seen working), but unfortunately not the decrypt algorithm. However, I have also found a nice crypto algorithm with encrypt and decrypt routines in C, but when I looked through the source code I noticed that it assumed that it was running on a little-endian processor, and I want to run the encrypt on little-endian and decrypt on big-endian, so it looks like I have some more work to do!

Anyway, if you would like to see the VxWorks MILS demo running and discuss how it works, or would like to discuss your security requirements, you'll be able to find me on the Curtiss-Wright stand (724). See you there!

VxWorks MILS 2.0 EAL6+ Evaluation

In case you missed the news, VxWorks MILS 2.0 has officially entered formal security evaluation at Common Criteria EAL 6+ (NIAP website).

So what does this mean for Wind River's customers? Well, VxWorks MILS 2.0 will enable them to develop applications to what the US National Security Agency (NSA) defines as "High Robustness".

Many people are familiar with Communications Security (ComSec), which involves the secure transmission and reception of information across networks, using technologies such as encryption and firewalls. However, what is less well known is Information Security (InfoSec), which involves the secure transformation of information between applications, subsystems, or networks. This is becoming an increasingly important requirement in systems, where there is the need for applications to handle data of different security classifications and to ensure that only that the authorized data flows are allowed and no unauthorized information disclosure can occur.

In the defence sector, the application of VxWorks MILS 2.0's high robustness technology is obvious, providing the means to host Top Secret (TS), Secret (S) and even Unclassified (U) on the same platform. This could be used for example in a military UAV mission system which needs to communicate with a civilian Air Traffic Control (ATC) system as it flies through unsegregated airspace (my colleague Chris Constantinides & I discussed this scenario in detail in the case of a UAV system architecture in the paper "Security Challenges in UAV System Development", at the 27th Digital Avionics Systems Conference, IEEE Proceedings).

In the commercial sector, VxWorks MILS 2.0's high robustness could be used to protect critical national infrastructure, which is a growing concern given the increasing threat of cyber warfare - see my previous post 'Cyber warfare and déjà vu' and the recent news story 'Electricity Grid in U.S. Penetrated By Spies' (Wall Street Journal) for details. This technology could also provide a secure platform many other types of application that needs to enforce strict separation based on data classification and access controls, including banking and commerce, to name a few.

So, even if our customers are working projects which don't have an explicit InfoSec requirement today (perhaps because the systems aren't even networked), it is reassuring to know that they have a route to Common Criteria security certification with VxWorks MILS 2.0.

Now, I must get back to learning a crypto demo which one of my colleagues has created for VxWorks MILS 2.0...

Cyber warfare and déjà vu

Yesterday, I had strong sense of déjà vu as I read the news story 'Major cyber spy network uncovered' (BBC News), which reports on a 10-month investigation by the Information Warfare Monitor (IWM) into a cyber espionage network, which they called GhostNet. This has a number of similarities with the plot within the novel 'The Edge of Madness' which I discussed in a previous blog.

The IWM report ''Tracking Ghostnet: Investigating a Cyber Espionage Network' is comprehensive to say the least, and I expect that people will find it either fascinating or terrifying, depending on their disposition. The IWM report is available to view online at the IWM website, but I found it more convenient to download the PDF version from the F-Secure mirror site to read offline.

The report contains lots of fascinating detail about the IWM investigation, but what really struck me was that the infection methods (p 39) were all based on contamination of data with executable code (web pages, PDF documents and Word documents), and relied on the application processing the data to execute the code. Once these trojans had opened a back door into a system, this provided access to the attacker for control and further exploitation.

This security vulnerability is due to the principle of allowing applications to run commands and/or code from an external source.

Q. Do I trust my web browser not to run malicious code?
Well no, I don't. I could disable all Javascript and Flash in my web browser and restrict other behaviour as well, but that would mean that many websites would become unusable.

Q. Do I rely on the host operating system to limit their actions?
Again, no, as the host operating system that I have to use has a relatively weak file system and security architecture.

So, because I don't trust either the web browser or the host operating system on which it executes, I instead use an secure containment approach. I do this by running the web browser in a virtualized environment. This means that the web browser has only the resources it needs to operate, but runs in a restricted environment, isolated from the rest of the system and is unable to perform priviledged operations, and most importantly it cannot access or corrupt my documents.

I decided to use this approach a while ago, after learning about the secure separation kernel and virtualization approaches used in VxWorks MILS 2.0, and after reading the IWM report my actions no longer seem as paranoid to me as they did at the time...