Paul Parkinson

Linux, Common Criteria, and OS Protection Profiles

In 2011, computer and network security news stories, which were previously the preserve of specialist journals and blogs, have become commonplace in the mainstream media. There are now many different types of threat, which are sometimes categorised into hacktivist, e-crime and most recently,advanced persistent threats (APT). Whilst some of these attacks have exploited zero day vulnerabilities, many of these attacks have simply taken advantage of the fact that systems have not been configured securely for their deployment environment.

To use an easy–to-understand analogy, consider a wireless router. This device will generally be shipped from the factory in the most flexible, open communication configuration, which will have many or all of the security options disabled. This will be fine if the wireless router is intended to be used as a free public Wi-Fi access point (e.g., cyber cafe), but not for a private business or home office if you want to prevent drive-by wireless hacks).  In these cases, wireless encryption such as WPA2 will need to be enabled for the router and clients, and access may even need to be restricted to specific clients via MAC addresses, etc.

For the developer wanting to create a secure product using embedded Linux, the wealth of configurable functionality and security packages can seem overwhelming. In the critical device space, the key question is, "How can one create a Linux configuration for their product which can be secure and meet the security requirements of the product's targeted international markets?"  The answer is straightforward and well defined - use standards-based approaches to both configure and prove security robustness.

For IT security, there is one globally-recognised standard, Common Criteria, that a product can be evaluated against, and this evaluation ensures that connected IT products are performed to high and consistent standards. Because Common Criteria is now recognized by 26 countries, product security evaluation using this standard eliminates the burden of duplicating security evaluations in multiple countries by providing international mutual recognition of evaluated products.

To accelerate the Common Criteria evaluation, the product can be developed according to the approved Protection Profile (PP) to ensure that it meets the accepted security requirements for that class of product. A Protection Profile is a document that defines the combination of threats, security objectives, assumptions, security functional requirements (SFRs), security assurance requirements (SARs) and rationales for a specific security target (ST). The PP is used to substantiate vendors' claims of a given family of information system products. The PP for a particular device typically specifies the Evaluation Assurance Level (EAL), a number 1 through 7, indicating the depth and rigour of the security evaluation, usually in the form of supporting documentation and testing, that a product meets the security requirements specified in the PP. In the United Kingdom, CESG supports Common Criteria evaluation and the use of PPs; in the United States, the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have agreed to cooperate on the development of validated US government PPs.

Common Criteria testing and evaluation can be quite expensive, and adds significant risk to any programme. To help eliminate much of this risk, Wind River has taken this approach for the development of Wind River Linux Secure, a commercial-off-the-shelf (COTS) product which has been certified by NIAP under the US Common Criteria Evaluation Scheme to Evaluation Assurance Level (EAL) 4+ (EAL4 being the highest level which is mutually recognised internationally under the Common Criteria Recognition Arrangement, and "+" referring to the evaluation being augmented with the Security Assurance Requirement ALC_FLR.3, the highest level of systematic flaw remediation).

Wind River Linux Secure was evaluated against the US Government Protection Profile for General Purpose Operating Systems in a Networked Environment (US GP-OSPP). This is a new protection profile which was published by the US National Security Agency's Information Assurance Directorate in August 2010, and supersedes the earlier Role-Based Access Control Protection Profile (RBAC) which was 'sunsetted' from 1st September 2011.

With this COTS GP-OSPP foundation, we expect that evaluating Linux products under similar PPs, like the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) General Purpose Operating System Protection Profile (BSI GP-OSPP) can also be undertaken. The BSI OSPP is also published on the Common Criteria portal, and defines the specific requirements for the German security market. Although there are two separate general-purpose operating system protection profiles, with some specific differences in Security Functional Requirements, there is a lot of commonality, and Wind River’s experience in evaluating a full-featured Linux distribution from kernel.org removes considerable risk from other programmes requiring Common Criteria certification using the US GP-OSPP, BSI GP-OSPP, or other evaluation scheme.

Safety-Critical Systems Symposium 2011

I'm looking forward to the 19th annual Safety-Critical Systems Symposium which is being held in held in the UK next week.

The conference programme covers a range of subjects including safety cases, testing of safety-critical systems, updates to safety standards, and technologies. On the Thursday afternoon, I will be presenting a paper 'Safety, Security and Multicore'.

Wind River will be participating in the exhibition which is being held on the Wednesday, and we will have a live demo of VxWorks MILS 2.0 running on the stand. So why not pop by to discuss your safety & security requirements?

Cybersecurity Testing & Trusted Platforms

In 2009, security concerns were raised about the use of Chinese telecoms equipment in the UK's critical national infrastructure ('Spy chiefs fear Chinese cyber attack', The Times), and the potential for the equipment to be inadvertently or deliberately subverted in a cyber attack.

So, I was interested to read a ZDNet UK news article last week about the Chinese telecoms company Huawei opening a cybersecurity testing centre in the UK to certify its products for use in the UK's critical national infrastructure. The centre will be staffed entirely by security-cleared UK nationals who will work in collaboration with CESG (part of the UK government intelligence agency GCHQ) as part of the certification process to ensure that the evaluations meet the government's highest security standards. The ZDNet article also mentions that "the results of evaluations may be made available to operators and governments outside the UK", and although the Common Criteria security evaluation process is mentioned, it has been previously suggested that this more open approach to security would help Huawei to overcome security concerns in some countries.

Of course, the potential for equipment to contain vulnerabilities, either unintentionally or deliberately is not something new (as illustrated by the counterfeit CISCO routers episode in the US, which were believed to contain backdoors).

This got me thinking about the general subject of trusted platforms and the following questions:

• How do you know that the software you are running is the software that you are supposed to be running?
• How do you know that the hardware you are running on is the hardware that you are supposed to be running on?
• How do you know that the system and has not been counterfeited, or intercepted and modified during the supply chain?

These are fundamental security questions which are often overlooked and could have disastrous consequences for a system deployed within critical national infrastructure.

However, these fundamental issues are addressed by the MILS architecture and the Separation Kernel Protection Profile (SKPP) through the use of trusted hardware, attestation and trusted delivery using cryptographic signatures. These techniques can be used with VxWorks MILS to develop high assurance systems for critical national infrastructure, as well as multilevel secure and Cross-Domain Systems.

So what are you running, and do you trust it?

Military Aerospace & Electronics Show UK

I am looking forward to attending the UK's Military, Aerospace & Electronics Show, which will take place on 30th November.

This year's conference programme has a strong emphasis on open systems architectures, but there is also an increasing focus on Information Security. To complement these themes, there will be a live demonstration of the VxWorks MILS separation kernel on the Wind River exhibition stand, so if you are planning to attend the event, please drop by.

During the afternoon session, my colleague Stuart Gray & I will be running a workshop 'A Practical Foundation for Safety Innovation'.  As an introduction, I will be giving a brief overview on the capabilities of the VxWorks 6 Cert Platform and explaining how it can be used to develop mission-critical and safety-critical systems requiring certification up to DO-178B Level A, but most of the session will be spent providing delegates with hands-on access to the VxWorks 6 Cert Platform. We recommend that you sign up in advance to avoid disappointment as workshop places are limited.

EGNOS Satellite Navigation System Safety Certification

In case you missed it, yesterday Wind River announced that VxWorks has been selected for the European Geostationary Navigation Overlay Service (EGNOS), and has been chosen to run the Integrity Processing Facility (IPF) check set.

The IPF, developed and delivered by Logica, is the crucial element that validates the information broadcast by the satellites to safety-critical users such as aircraft in flight or ships navigating through narrow channels. This is essential, because satellite navigation systems alone do not provide sufficient positional accuracy to be used in safety-critical applications.

The IPF is really good example of a critical system which needs to consistently provide hard real-time performance and total reliability, and this posed some interesting challenges for development and safety certification to the joint avionics software safety standards RTCA DO-178B and EUROCAE ED-12B at Level B.

Logica and the European Space Agency (ESA) have kindly allowed us to produce a case study which discusses the development and certification challenges and how they were successfully overcome, and this has just been published on the Electronics Weekly website. (Update: the case study can now also be downloaded in PDF from the Wind River website)

I hope you'll find this interesting, and the next time you are on a European flight on a landing approach in very poor visibility conditions, you'll know how VxWorks is helping to guide the aircraft to a safe landing.

Case study: Ultra Datel safety-critical avionics upgrade using COTS

I recently had the privilege of working with one of our partners, LDRA, and one of our customers, Ultra Datel, on writing a case study of their experiences of a mid-life upgrade of an existing avionics system.

What caught my attention was the fact that the existing system was uncertified, and the upgrade involved migrating the existing system to a commercial-off-the-shelf (COTS) and undertaking DO-178B Level B safety certification.

As a result, the project faced a number of development challenges because the pre-existing software and device drivers were not developed with safety certification in mind, and the code needed to be re-engineered and modified to meet safety certification requirements.

In the case study, we discuss the following development challenges and how they were overcome using the LDRA Tool Suite during the development of the safety-critical VxWorks application running on a GE Intelligent Platforms ruggedised PowerPC platform:

1. Porting to the VxWorks DO-178B safety-critical subset
2. Reduction of high cyclomatic complexity
3. Programming language subset compliance
4. Code coverage to meet DO-178B Level B objectives

The case study has now been published on the Wind River website on the Aerospace & Defence customers page (and the PDF file can be accessed directly here).

First flight of the Boeing 787

Today, the Boeing 787 Dreamliner made its first flight from Everett, Washington. One of our Wind River colleagues, Chip Downing, was able to attend this historic event in person, and shot the following video:

This is the culmination of years of development of a completely new aircraft which uses many state-of-the-art technologies to significantly improve efficiency, operating range and passenger comfort.

For instance, the 787 employs an Integrated Modular Avionics (IMA) architecture using VxWorks 653, Wind River's world-class ARINC 653 compliant RTOS. This approach which drastically reduces the amount of space, weight and power (SWaP) required for the aircraft's on-board avionics systems. The reduction in weight of avionics systems and cabling results in a reduced fuel load requirement, or increased range for the same fuel load, and of course reduced CO₂ emissions. Similarly, the reduction in the space required for the avionics systems can increase the space available for passengers, luggage and cargo.

(If you want to know more about the 787 development and DO-178B safety certification approach, read Alex Wilson's recent blog, and for details of VxWorks 653, there's a white paper available for download here).

In addition, the composite fuselage not only helps to make the aircraft lighter (improving fuel consumption further), but also enables higher cabin pressures to be used, which will result in passengers feeling more relaxed and less fatigued. When coupled with the advanced air-conditioning systems and state-of-the-art Rolls-Royce Trent 1000 jet engines and noise-reductions technologies, this provides the promise of greater passenger comfort on long haul flights.

This is of course, just the start, as the 787 will continue to evolve through its operational lifetime, just as the 747 has done over the last forty years. So, I wonder what other technologies will appear in the future?

In the meantime, I'm looking forward to seeing the 787 grace the skies above the Farnborough Air Show and taking a flight on one with British Airways in the near future. Congratulations, Boeing!

Airbus A330 MRTT refuelling progress

I was pleased to read in today's news (Aerospace Testing International) that the Airbus A330 Multi-Role Tanker Transport (MRTT) has completed more flight testing milestones, including extended testing of its refuelling systems.

The A330 MRTT is an interesting design, as it has a centreline refuelling boom and two underwing refuelling pods, and although these perform similar functions, the electronic systems have quite different operating environments, which is reflected in their system architecture. The refuelling boom runs VxWorks 653 on an Integrated Modular Avionics (IMA) platform, whereas the underwing refuelling pods run VxWorks Cert on a federated avionics architecture in the harsh under wing environment, which can experience extremes of temperature. This is an excellent case of how a hybrid architecture can be used to achieve diverse mission requirements.

There's a photo of the view of the underwing refueling pods in the news story, and there's also a great photo of an A330 MRTT being refueled by a French Air Force tanker on the EADS website (click on the image to view a larger version).

The A330 MRT will enter service Royal Australian Air Force (RAAF) in the near future, and I am looking forward to see them enter service with the UK Royal Air Force (RAF).