Paul Parkinson

The Advent of Multicore MILS

It's been a rather long time since my previous blog post. I intended to post a blog before Christmas about our partner Curtiss-Wright's news release about VxWorks MILS support on the VPX6-187, but I simply ran out of time! So here it is as my first blog post of 2013.

The Curtiss-Wright press release was actually quite a game changer. To the casual reader, it may just appear to be about the release of another board support package (BSP) on a leading-edge COTS processor card, but the fact that this BSP supports multicore for a MILS architecture is what separates this press release from other announcements.

When the MILS software architecture was proposed in 1984 by the computer scientist Dr. John Rushby, microprocessors at the time were inherently single-core, and computing performance advances were being driven by clock speed increases and die size, at a rate following Moore's Law.

Over the last decade, single-core processors with robust MMU partitioning have become sufficiently performant to enable viable MILS separation kernels (SK). In recent years Wind River has implemented VxWorks MILS on single-core processor architectures (PowerPC MPC8548), and on multi-core processors, but only running on a single core (dual-core PowerPC MPC8641D, quad-core Intel Core i7).

However, with the VxWorks MILS Platform, Multicore Edition, the VxWorks MILS separation kernel now runs on all eight cores of the Freescale QoriQ P4080 processor concurrently. Yes that's right, I am talking about (MILS && multicore) rather than (MILS XOR multicore). This enables the integration of many MILS solutions on a single processor, creating reduced size, weight and power (SWaP) benefits - even high assurance security-critical systems have tough performance requirements.

The advent of multi-core processor architectures over the last few years has had a dramatic and disruptive effect on the embedded market. This has provided significant benefits in terms of reducing size, weight and power (SWaP), but has also presented some interesting challenges for safe and secure application domains.

For example, the global aerospace market has very mature processes for DO-178B safety-certification on single core processors. Similarly, the security community is approaching maturity for Common Criteria security evaluation on single core processors. But both segments are challenged when driving multicore systems through their respective processes.

There has also been an emerging trend in recent years of individual systems needing to meet both safety-certification and security evaluation, and now with the emergence of multicore, this presents some new regulatory challenges, but the benefits will be worth the effort.

This convergence is discussed in more detail in the white paper 'Safety, Security and Multicore' which is available for download from the Wind River website.

Avionics 2012 report

I've just got back from the Avionics Europe 2012 conference and exhibition which was held in Munich.

The theme of this year's conference was 'Common Sky: Operating in One Air Space' focussing on the growth in air traffic across Europe, the challenges arising for air traffic management and navigation, and the development of SESAR air traffic management technologies.

I was keen to hear to how changes to the high-level policies would drive regulatory changes and drive technology requirements.

I didn't have to wait very long, as in his keynote speech, Brigadier General Hans-Georg Schmidt (Vice Commander of 1st German Air Division, and Chairman of the Military Air Traffic Management Board of EUROCONTROL) discussed the implications of the integration of unmanned systems (UAVs, UCAVs) into non-segregated airspace. He discussed the need for unmanned systems to be "sufficiently safe as not to reduce the overal safety of airspace", and said that unmanned systems "must be proven to be safe before their introduction into this environment".  (The keynote speech is discussed in more detail by John Keller, conference chairman, in this blog post).

This subject of UAV safety certification was covered in more technical detail by Richard Seitz of Cassidian in his presentation on 'UAV Computing'. He discussed the differences between flight software on piloted aircraft (which leaves the ultimate decision to the pilot) and flight software in unmanned systems which becomes safety-critical in the case of datalink loss,  and the need for RTCA DO-178B / EUROCAE ED-12B safety certification of UAV flight software. 

It was encouraging to see the subject of UAV safety and the need for software certification being acknowledged, as this was a topic which I had also raised in my conference paper  in the context of combined safety and security requirements for unmanned systems (for details see my previous blog).

The other recurring theme at the conference which caught my attention both in the conference and in the exhibition, was the technology disruption of multicore processor architectures, which provides some exciting opportunities for reducing the size, weight and power (SWaP) of avionics systems, but also presents new challenges for hardware and software safety certification. However, there's now significant momentum in the research into these areas, and the experience gained should lead to regulatory guidance and adoption in the near future.

So overall it was an interesting and enjoyable conference, not least for the fine Bavarian hospitality!

Avionics 2012 conference

It's been a long time since my previous blog, as unfortunately I've been engrossed in a number of projects!

However, I have just got time to mention that I'm really looking forward to the Avionics Europe conference in Munich on 21-22 March. The conference programme is pretty packed, covering cockpit avionics and technologies for civil and military aircraft; and aircraft, spacecraft and UAV sensor payloads, diagnostics and certification.

I will be presenting a paper on "A Secure Virtualisation Approach to Support Multi-Level Secure Systems, Software Reuse and Incremental Certification" in the Embedded Software session on Wednesday afternoon.

The paper addresses how secure virtualisation approaches can be used to implement a system architecture to securely partition applications and data of different security domains on the same system (such as national Secret and NATO Secret data), whilst enabling the reuse of previously developed software applications and existing intellectual property in an open standards-based communications environment. The paper also includes a discussion on the requirements for supporting incremental safety-certification under RTCA DO-178C / EUROCAE ED-12C and Common Criteria security evaluation at high evaluation assurance levels, and the implementation architecture to support a role-based development process.

Wind River will also be exhibiting at the conference, so why not drop by our stand for a chat and to see a cool avionics display demo?

Fun with VxWorks MILS 2.1

It’s been a while since my previous blog, as I have been rather preoccupied with responding to a number of RFPs. However, I’ve managed to find some time to work on some demos for VxWorks MILS 2.1, which has been fun.

VxWorks MILS 2.1 introduced support for Wind River Linux as a Guest OS (VxWorks Guest OS and High Assurance Environment (HAE) having been supported in the earlier VxWorks MILS 2.0 release). I wanted to get some more hands-on experience of using Wind River Linux as a Guest OS (GOS) running on the VxWorks MILS 2.1 Separation Kernel (SK). So, I started with a version of the Blaster Blastee demo which had been modified by one of my colleagues in Engineering to use a Linux GOS partition for the Blaster. (Blaster Blastee is a well-known Wind River demo which provides a nice flexible framework for blasting TCP or UDP packets between nodes, testing network connectivity and performance).

 I thought it would be an interesting exercise to extend the demo to also use Linux in a second partition as the Blastee (receiver), to demonstrate the scalability and determinism of the MILS SK with multiple Linux virtual boards (VB).

This proved to be quite easy to configure, as I was able to use the same Linux kernel image as the Blaster virtual board, but with different boot parameters (as this virtual board was using a separate dedicated Gigabit Ethernet device on my target board, with its own IP address), and I just invoked the Blastee executable which had been built into the Linux GOS filesystem. Once I had added a timeslot allocation for the Blastee VB into the MILS system schedule, I was able to build and run the system and send packets between the two partitions via external Gigabit Ethernet interfaces.

(Side note: Alternatively, I could have sent packets directly between the two partitions either by using Secure IPC ports via the MILS SK according to pre-defined security policy, or even via an IP tunnel over SIPC, but I used the external Ethernet interfaces, as I wanted to extend the demo further).

The next step was to configure this Linux GOS-based system to send and receive packets via the two Ethernet ports to corresponding VxWorks GOS-based Blaster and Blastee virtual boards on a second board. This configuration can be used to simulate a Public Network and a Secure Network connection between two nodes (see diagram above). The original MILS Blaster Blastee demo also includes a trusted Security Audit partition, running in a High Assurance Environment, which monitors the audit log for each partition, and also a Rogue partition which attempts to illegally access the Secure Network interface to intercept traffic (which is of course prevented by the MILS SK). When this demo is running freely, the link lights on my Gigabit switch flicker away furiously, and the VxWorks MILS partitions report output via the multiplexed serial I/O output to a host console.

To really see inside the system, and to step through the interactions of the sender and receiver (Linux Blaster to VxWorks Blastee over the Secure Network, and VxWorks Blaster to Linux Blastee on the Public Network), I used Wind River Workbench to debug all four connections concurrently, using Linux user-mode agents in each of the Linux VBs, and On-Chip Debugging (OCD) via JTAG to debug the VxWorks Blaster and Blastee. In this way, I could step through the sending and receiving of packets in both directions over the two networks (rather than having to rely on printf(), which would have been difficult to correlate across multiple partitions). The screen shot shows the point at which I am stepping through send and receive (the size of the screen shot is constrained by my 19” monitor).

So, this demo shows how the High Assurance Environment, VxWorks GOS and Linux GOS can all run on top of the MILS Separation Kernel and still provide good network performance despite being in a time-partitioned environment.

Farewell to Del.icio.us

I was disappointed to read in TechCrunch this morning that Yahoo has decided to shut down the Del.icio.us social bookmarking website (or should I say service?).

I started using Delicious a few years ago after I had become fed up trying to organise my website bookmarks. I often want to bookmark A&D news stories, blog articles, technical papers and standards, etc., so that I can easily find them again when I want to read through them at a more convenient time or when I need to do research for a Wind River article or presentation.

The problem with web browser-based bookmarks is that this approach doesn't scale well for a large number of bookmarks.  Web browser bookmarks can be sorted into hierarchical folders, but this can be counter-intuitive if you have inter-related subjects (e.g. safety and security). Also, if you also use more than one web browser as I do, then keeping bookmarks up to date in mulitple places becomes tedious.  (I alternate between Firefox and IE depending on which I think is the least insecure at any particular time, Firefox is my current choice due to the NoScript plugin).

Social bookmarking overcomes these issues by allowing you to associate multiple tags with individual bookmarks, e.g. cyber, infosec,  safety-critical. This make it much easier to order subjects and inter-related subjects without having to store them hierarchically (e.g. cyber+security+UK). The cloud computing approach also means that instead of tying my bookmarks to one web browser on one computer, I can access them from any computer. (This short video clip from Common Craft explains it much better I than I can). I've found the Delicious bookmarks to be so useful that I even embed them on my personal website so that other people can access them easily.

Sadly, one job I'll need to do over Christmas is to migrate my Delicious bookmarks to another social bookmarking service.

 

High Assurance Systems Development Using the MILS Architecture

When I'm discussing VxWorks MILS with Wind River customers, I often find that in addition to wanting hear about the capabilities and features of the platform, they are also interested in the rationale for the MILS architecture and the implementation approach for the VxWorks MILS separation kernel.

So, I've recently written a technical white paper "High Assurance Systems Development using the MILS architecture" with my colleague Arlen Baker. This provides a technical deep-dive on the implementation approach taken for the VxWorks MILS separation kernel, and discusses how MILS technologies can be used to develop sophisticated Cross Domain Solutions (CDS) and Multi-Level Secure (MLS) systems, such as MILS-based gateways.

This MILS technical white paper is now available in PDF for download from the Wind River website (registration required). I hope you find it interesting and informative, and I look forward to receiving feedback.

National Cybersecurity Strategy

On Monday, the UK government published its new national security strategy (PDF). This outlines the current and emerging security threats to the UK national interests, ranked by priority based on likelihood and impact. What caught my attention was the fact that the Tier 1 (highest priority) threats include:  

'Hostile attacks on UK cyber space by other states and large scale cyber crime'

Until fairly recently, the threat of cyberwarfare has mainly been discussed in defence and security journals (see 'Evaluating Cyber Security', Digital Battlespace, Aug 2009), but there has been a growing focus on this in the mainstream media (although whether this is due to an increasing threat or an increasing media appetite is subjective).

However, recent events have shown that it is now possible for cyberwarfare attacks to be directed at specific targets, rather than being undirected and indiscriminate. This has been illustrated by the Stuxnet worm incident, which has been alleged to be a a state directed cyber attack ('The Stuxnet worm heralds new era of global cyberwar', The Guardian).

Cyberwarfare provides the the potential to bypass a nation's conventional forces and strike at specific targets including critical national infrastructure whilst remaining invisible and providing the prospect of plausible deniability. The types of cyberwarfare threats were discussed by Iain Lobban, Director of the UK's GCHQ security agency in an unusual public speech.

The UK government's response will be to invest £500m in cyber defences to bolster the UK's critical national infrastructure. At present, few details have emerged on how this will be implemented or how the security of systems will be evaluated. However, if you're using a system which has undergone a security evaluation under conditions which assume that it's connected to a benign network, then you might as well shutdown and pull out your network card now. Instead, we should be basing our critical national infrastructure systems on platforms which are designed to achieve the highest levels of assurance with real-world protection profiles and be resilient against network-based attacks.

http://www.direct.gov.uk/prod_consum_dg/groups/dg_digitalassets/@dg/@en/documents/digitalasset/dg_191639.pdf?CID=PDF&PLA=furl&CRE=nationalsecuritystrategy

VxWorks MILS 2.1 Platform hands-on

Last week, I visited Wind River headquarters in Alameda, California, to learn about VxWorks MILS Platform 2.1 and to get hands-on experience with the release.

I had been looking forward to the trip, as the 2.1 release adds some significant new capabilities: Wind River Linux as a guest operating system and the new High Assurance Network Stack (see Bill Graham's recent blog for a more detailed overview).

So, the VxWorks MILS separation kernel (SK) can now host Wind River Linux, VxWorks and a High Assurance Environment as guest operating systems in a virtualised environment (as shown below).

To me this is a very significant development, as it extends the depth and breadth of applications which can be run in on top of VxWorks MILS. This enables existing applications to he hosted securely in a high robustness system, but also enables new systems to be developed using the most appropriate technologies for a given component.

Of course, learning the theory is great, but it is not as much fun as hands-on experience, so I was glad to have the opportunity to run some Wind River Linux demo applications on top of VxWorks MILS and run and debug them using Wind River Workbench while I was in Alameda.

The screenshot below shows Workbench debugging a multi-threaded Linux application running on top of VxWorks MILS 2.1 on my PowerPC 8548-based demo board. There's a thread-specific breakpoint on a line of shared code, which can be used to halt one thread while the other thread(s) run free. 

The next step will be to incorporate these new capabilities into some MILS demos. Stay tuned.

EGNOS Satellite Navigation System Safety Certification

In case you missed it, yesterday Wind River announced that VxWorks has been selected for the European Geostationary Navigation Overlay Service (EGNOS), and has been chosen to run the Integrity Processing Facility (IPF) check set.

The IPF, developed and delivered by Logica, is the crucial element that validates the information broadcast by the satellites to safety-critical users such as aircraft in flight or ships navigating through narrow channels. This is essential, because satellite navigation systems alone do not provide sufficient positional accuracy to be used in safety-critical applications.

The IPF is really good example of a critical system which needs to consistently provide hard real-time performance and total reliability, and this posed some interesting challenges for development and safety certification to the joint avionics software safety standards RTCA DO-178B and EUROCAE ED-12B at Level B.

Logica and the European Space Agency (ESA) have kindly allowed us to produce a case study which discusses the development and certification challenges and how they were successfully overcome, and this has just been published on the Electronics Weekly website. (Update: the case study can now also be downloaded in PDF from the Wind River website)

I hope you'll find this interesting, and the next time you are on a European flight on a landing approach in very poor visibility conditions, you'll know how VxWorks is helping to guide the aircraft to a safe landing.

Multicore called up for active service

There's an interesting editorial column 'Multicore Processing Becomes the New Mainstream' in the latest edition of COTS Journal. Jeff Child discusses how multicore processors, after becoming all pervasive in the desktop and server market, are now becoming the norm for embedded aerospace and defence systems. He also shares some insights into why the transition to multicore is necessary, and provides an example of the deployment of multicore in the Aegis Modernization Program (Congressional Research Service report on FAS website: PDF).

Rather tantalizingly, Jeff only mentions software architectures in his final paragraph (maybe that's a subject for a future editorial), where he contrasts the use of Symmetric Multiprocessing (SMP) on multicore devices with tiled processors (which can be massively parallel architectures). 

As a software engineer, I think this is where things start to get really interesting, and there are actually quite a number of different possible permutations on homogeneous multicore architectures when you include visualization using a hypervisor into the overall software architecture. This can support a system with separate instances of an operating system or runtime per core, known as asymmetric multiprocessing (AMP); or a single instance of an operating system running across multiple cores, known as symmetric multiprocessing (SMP), or even a combination of both.

Customers often ask me 'Which is better, AMP or SMP?', and my answer is 'It depends'. It depends on the nature of their application, the degree of parallelism within it which determines the scalability across cores; it depends on the I/O architecture and throughput requirements and more besides. But by analyzing the system requirements in detail, these can be mapped to a suitable implementation which may comprise AMP, SMP or both. Bill Graham discusses how this complexity can be simplified into a number of key uses cases in this recent blog.

Back to the COTS Journal editorial, Jeff also mentions that tiled processors (and massively parallel architectures in general) present a programming challenge due to the complexity involved. This subject was also recently discussed in some technical depth by Mark Hermeling in a recent blog 'A sea of cores, now what?'.