VxWorks

The Advent of Multi-core MILS

By Paul Parkinson

It has been a rather long time since my previous blog post. I intended to post a blog before the holidays regarding our partner Curtiss-Wright's announcement about VxWorks MILS support on the VPX6-187, but I simply ran out of time! So here it is as my first blog post of 2013.

The Curtiss-Wright new release was actually quite a game changer. To the casual reader, it may just appear to be about the release of another board support package (BSP) on a leading-edge COTS processor card, but the fact that this BSP supports multi-core for a MILS architecture is what makes this announcement so significant.

When the MILS software architecture was proposed in 1984 by the computer scientist Dr. John Rushby, microprocessors at the time were inherently single-core, and computing performance advances were being driven by clock speed increases and die size, at a rate following Moore's Law.

Over the last decade, single-core processors with robust MMU partitioning have become sufficiently performant to enable viable MILS separation kernels (SK). In recent years, Wind River has implemented VxWorks MILS on single-core processor architectures (PowerPC MPC8548), and on multi-core processors, but only running on a single core (dual-core PowerPC MPC8641D, quad-core Intel Core i7).

However, with the VxWorks MILS Platform, Multicore Edition, the VxWorks MILS separation kernel now runs on all eight cores of the Freescale QoriQ P4080 processor concurrently. Yes that's right, I am talking about (MILS & multi-core) rather than (MILS XOR multi-core). This enables the integration of many MILS solutions on a single processor, creating reduced size, weight and power (SWaP) benefits - even high assurance security-critical systems have tough performance requirements.

The advent of multi-core processor architectures over the last few years has had a dramatic and disruptive effect on the embedded market. This has provided significant benefits in terms of reducing size, weight and power (SWaP), but has also presented some interesting challenges for safe and secure application domains.

For example, the global aerospace market has very mature processes for DO-178B safety-certification on single core processors. Similarly, the security community is approaching maturity for Common Criteria security evaluation on single core processors. But both segments are challenged when driving multicore systems through their respective processes.

There has also been an emerging trend in recent years of individual systems needing to meet both safety-certification and security evaluation, and now with the emergence of multi-core, this presents some new regulatory challenges, but the benefits will be worth the effort.

This convergence is discussed in more detail in the white paper 'Safety, Security and Multicore' which is available for download from the Wind River website.

For additional information from Wind River, visit us on Facebook.

Avionics Conference 2012

By Paul Parkinson

It's been a long time since my previous blog, as unfortunately I've been engrossed in a number of projects!

However, I have just got time to mention that I'm really looking forward to the Avionics Europe conference in Munich on 21-22 March. The conference programme is pretty packed, covering cockpit avionics and technologies for civil and military aircraft; and aircraft, spacecraft and UAV sensor payloads, diagnostics and certification.

I will be presenting a paper on "A Secure Virtualisation Approach to Support Multi-Level Secure Systems, Software Reuse and Incremental Certification" in the Embedded Software session on Wednesday afternoon.

The paper addresses how secure virtualisation approaches can be used to implement a system architecture to securely partition applications and data of different security domains on the same system (such as national Secret and NATO Secret data), whilst enabling the reuse of previously developed software applications and existing intellectual property in an open standards-based communications environment. The paper also includes a discussion on the requirements for supporting incremental safety-certification under RTCA DO-178C / EUROCAE ED-12C and Common Criteria security evaluation at high evaluation assurance levels, and the implementation architecture to support a role-based development process.

Wind River will also be exhibiting at the conference, so why not drop by our stand for a chat and to see a cool avionics display demo?

VxWorks Cert Now Supports ARM!

By Alex Wilson

Aerospace and defense has relied on rugged embedded vehicle mounted computers for many years, but as devices become more mobile, and with increased demand to reduce SWaP (Size, Weight, and Power), ARM-based computers become an interesting alternative.  Added to that is the wealth of functionality available in ARM devices that make it a good choice, not only to reduce SWaP in the core CPU, but to reduce overall chipset sizes to a single SoC.

If we look at an example of an ARM-based device, such as the TI OMAP3530, this is a perfect device with which to build a software defined radio for example. It has a high performance, low powered Cortex A8 Core, with numerous IO devices to help connectivity and display.  Designed as a mobile device, for example, it supports Android -- and the OMAP3530 is also well suited to other areas of A&D such as soldier mounted systems, or remote sensors.

When it comes to avionics systems, aircraft also have a range of devices, from the high end central control computers running multiple applications (such as the common core computer of the Boeing 787) down to remote sensors and actuators that run on 8- or 16-bit processors, and maybe do not need to use an operating system.  TI also produces devices targeted at this market, which not only reduce SWaP, but are tested to the required standards for avionics applications, including extended temperature ranges, and using avionics friendly packaging.  For example, the OMAP-3530, is available as a OMAP3530-HIREL (PDF Datasheet) with extended temperature ranges from -45C to +105C.

So with this in mind, it is great to see our leading real-time operating system's latest release with support for ARM processors.  VxWorks Cert already supports both Freescale and Intel, with certification evidence for RTCA DO-178B (EUROCAE ED-12B) Level A, and has been certified on platforms such as the Eurocopter EC-225 Helicopter, or Cobham900E series Air Refuelling Pods on the A330MRTT.  This latest release adds support for ARM Cortex A8 and A9, as well as some updates to the Freescale coverage.

Support for ARM Processors gives our safety-critical customers the choice and flexibility they needed in order to meet the tough SWaP, functionality, and certification requirements for the demanding avionics applications, and I am looking forwards to seeing some great innovations in the next few years!

 

For additional information from Wind River, visit http://www.facebook.com/WindRiverSystems.  

VxWorks Cert: Supporting Low Power Devices in Safety Critical Systems

By Bill Graham

Embedded microprocessors are steadily progressing towards more performance while maintaining or decreasing power requirements (more succinctly, the performance per watt is getting better and better). High performance processors that decrease system power requirements are desired in safety critical systems just as they are in the general embedded marketplace. Our recent release of VxWorks Cert Platform adds support for ARM processors to our safety critical VxWorks platform which compliments our current support for Intel Atom processors, both of which are important platforms for high capable but low power consumption devices.  Adding ARM to the supported list of architectures expands the application of the safety critical real-time operating system (RTOS) platform to new possibilities such as mobile, handheld and graphics-oriented devices.

The latest generations of ARM and Intel Atom processors are also central to highly integrated System on Chip (Soc) solutions that are commonplace in consumer devices but are seeing popularity in industrial, medical and aerospace and defense. These highly integrated platforms provide graphics, audio, video, and connectivity features in single package that is appealing for use in industrial control (e.g. HMI for process control), medical devices (e.g. infusion pump) and defense (e.g. avionics displays.) Having a safety critical runtime platform for these next generation devices allows our customers to leverage a commercial off the shelf (COTS) solution and have the choice of processor architecture that best suites their needs. As ARM and other low power platforms grow in the safety critical markets we look forward to seeing VxWorks Cert Platform grow with it.

 

For additional information from Wind River, visit http://www.facebook.com/WindRiverSystems.  

Military Aerospace & Electronics Show UK

By Paul Parkinson

I am looking forward to attending the UK's Military, Aerospace & Electronics Show, which will take place on 30th November.

This year's conference programme has a strong emphasis on open systems architectures, but there is also an increasing focus on Information Security. To complement these themes, there will be a live demonstration of the VxWorks MILS separation kernel on the Wind River exhibition stand, so if you are planning to attend the event, please drop by.

During the afternoon session, my colleague Stuart Gray & I will be running a workshop 'A Practical Foundation for Safety Innovation'.  As an introduction, I will be giving a brief overview on the capabilities of the VxWorks 6 Cert Platform and explaining how it can be used to develop mission-critical and safety-critical systems requiring certification up to DO-178B Level A, but most of the session will be spent providing delegates with hands-on access to the VxWorks 6 Cert Platform. We recommend that you sign up in advance to avoid disappointment as workshop places are limited.

Updates to our VxWorks MILS platform, including a new High Assurance Network Stack

By Bill Graham

This week we announced the latest update to our VxWorks MILS Platform, (for Multiple Independent Levels of Security) which includes a new High Assurance Network Stack (HANS) and guest OS support for Wind River Linux. In a previous post I discussed the growing importance of security in embedded systems. However, in so-called high assurance environments used by military and government organizations, security is an absolute requirement.

Our VxWorks MILS product provides highly secure partitioning of a system into high, medium and low assurance virtual systems (or boards) that can be high, medium, or low assurance, as needed by the customer's application (hence the "multiple" and "independent levels" in Multiple Independent Levels of Security). VxWorks MILS has been developed in accordance with the U.S. Government Protection Profile for Separation Kernels in Environments Requiring High Robustness, version 1.03 (SKPP) and is officially listed by NIAP (National Information Assurance Partnership) as being in evaluation to EAL 6+/NSA High Robustness under the CCEVS. Until the advent of a software MILS architecture technology, supporting multiple levels of security was done with duplicated hardware - separate physical systems that provided the "partitioning" required. With the MILS software architecture, it is now possible to consolidate various systems with different security requirements onto one common hardware platform. The reductions in SWAP - size, weight and power advantages - are huge, as are the reductions in security evaluation costs. The following diagram shows a possible VxWorks MILS architecture:

 

Previous versions of VxWorks MILS already provided VxWorks Guest OS support, so the addition of adding Wind River Linux expands the available operating system choices.

The High Assurance Network Stack that is part of our latest VxWorks MILS update which provides secure network connectivity for the high assurance partitions via the existing network connection on the device. The High Assurance Network Stack lets applications of different security domains share a common physical network connection. This is done by handling the physical and low-level interface to the network within a high assurance partition and relaying data to medium and lower assurance target partitions, which contain the protocol network stacks. Secure and insecure Data from different domains can be discriminated and kept separate in the network data by using a discriminator, such as a IEEE 802.1Q VLAN tags as described in IEEE 802.1Q. The following diagram illustrates the HANS High Assurance Network Stack architecture in VxWorks MILS:

Clearly, more guest OS choices for VxWorks MILS provides a mechanism to reuse existing applications and leverage existing in-house development resources. Adding Wind River Linux allows a huge variety of custom and off-the-shelf applications to be run, at a medium and low assurance level environment. The addition of the High Assurance Networks Stack is critical not only for providing secure connectivity, but for enabling Cross Domain Solutions (CDS). CDS is a large topic on its own, but in a nutshell provides the ability to access or transfer information between two or more security domains (CNSSI 4009). A key to making CDS a reality is secure partitioning and network separation provided in by VxWorks MILS.

VxWorks = Secure

By Nikhil Chauhan

A recent report describes potential security vulnerabilities in devices running VxWorks. Researcher HD Moore claimed during a recent talk (slides) that a quarter million devices accessible directly from the Internet were found to be vulnerable.

VxWorks has a very strong track record of offering secure products. However, we also realize that vulnerabilities can affect VxWorks, even if very infrequently. In those cases, Wind River will act quickly to address any issues. Regarding recent vulnerabilities, Wind River responded rapidly with patches and remediation steps in conjunction with a public announcement by the CERT Coordination Center on August 2, 2010. Once CERT notified Wind River, Wind River immediately assessed the alert and was instructed by CERT to release a synchronous public response. We're confident that our customers know that Wind River is committed to supporting its products with the highest quality and security standards.

VxWorks continues to be the most widely deployed real-time operating system in mission-critical embedded systems. I am sure you will agree that security is not just about the underlying technology and features, how the technology is configured and deployed is equally important. VxWorks is a highly configurable RTOS. Device builders can fine-tune which features to add or remove from the RTOS. This includes debug services such as WDB. To efficiently debug embedded devices, developers must have full access to the entire device. They must be able to read, write to any memory location, as well as interact with the I/O controllers. Without this powerful tool, developers would not be able to build highly reliable devices in a short period of time. However, this powerful and valuable tool can be manipulated for more malicious intents. By changing the RTOS configuration, these debug services could be removed. Wind River's response for the debug agent vulnerability references the VxWorks Kernel Programmer's Guide regarding removal of the WDB agent for deployed systems. As explained in Wind River's response, the hooks/agents included in the kernel are to enable connectivity for the developer and should either be removed prior to deployment in line with the security policy for the customer's product/system or appropriate firewall rules be used to restrict access to the debug service. Wind River's response for the default hashing algorithm recommends customers use a trusted encryption API instead along with patches for various VxWorks versions. 

Let me also take a moment to shed additional light around the various security components provided by VxWorks. Below, I will cover security monitoring and response policies, network security, operating system security and testing/certifications.

Security monitoring and response policy

Wind River is committed to delivering secure reliable products and offerings. To combat vulnerabilities, Wind River is committed to active threat monitoring, rapid assessment, threat prioritization, expedited remediation, response and proactive customer contact in each of the detected cases.

Wind River has a Security Response team to monitor, assess and address security vulnerabilities. The team follows a proven policy for tracking, categorizing, and responding quickly to security vulnerabilities. The overall process is broken into four stages:

• Monitoring: Active monitoring of security alerts from reliable external sources, customers and any other external submitters.
• Assessment / Prioritization: Assess and prioritize vulnerabilities based on severity, difficulty and avoid' ability of alert.
• Notification: Notify customers and submitter of the level of susceptibility within short time target.
• Remediation: Posting of remediation action based on classification of susceptibility and within short time target.

Network Security

As shown in the graphic below, let's now review the various components within VxWorks network security that deliver security to developers and device manufacturers who use the VxWorks networking stack.

• Device Drivers: Enhanced Network Drivers (END) use their own isolated transmit and receive buffer pools. These descriptors are loaned to the network stack. Each END driver pool is private and isolated from another END driver pool.
• Multiplex (MUX) Layer: The MUX is a useful isolation layer between the network stack and the END drivers. This layer also provides a framework for developers to write their own custom packet filter or network sniffer that can be used to prevent packet storms or filter packets based on incoming IP address, MAC address, port number, etc.
• Firewall: VxWorks platforms include a full-featured firewall that may be used out of the box without any additional code development. For instance, it may be used to filter traffic based on many different rule-sets, and it also includes logging features and Stateful Packet Inspection (SPI) for either TCP or UDP traffic. There are optional reference packet filters available as an alternative to customers who opt not to use the firewall.
• IPsec/IKE: VxWorks platforms also provide IP Security (IPsec) and Internet Key Exchange (IKEv1/v2) support. These protocols may be easily configured and used without any additional code development. IPsec/IKE allows users to setup security associations between various end-points. Some or all traffic may be encrypted, while other traffic types may be bypassed which gives developers flexibility. 
• Secure Sockets Layer (SSL): VxWorks platforms include a cryptographic library utilizing OpenSSL. This provides developers with the ability to secure individual TLS (over TCP), or DTLS (over UDP) applications.
• FIPS 140-2:< VxWorks platforms support FIPS 140-2 mode. When compiled in FIPS 140-2 mode, a number of algorithms including the MD5 hash algorithm are compiled out because they are not FIPS approved.
• Secure Shell (SSH) & Secure FTP (SFTP) : SSH server and SFTP are also supplied with the networking stack. These protocols are secure replacements for Telnet, FTP or TFTP. Again, these protocols may be used out-of-the box without any additional code development.
• Network Applications: Traditional network applications may be used in either kernel tasks or run in memory protected user-space within Real-Time processes. They may run as secure applications (e.g. SSL), or they may be run as traditional socket applications. The security may be provided via either IPSec/IKE or Firewall.
• Cryptography: VxWorks platforms include a variety of cryptographic algorithms and supporting utilities that can be used in developing secure applications. These include algorithms such as AES, SHA, MD5, DES, etc.

Operating System Security

The slides from HD Moore includes remarks such as "little memory protection" and "everything runs with the highest privileges." On the contrary, VxWorks enables manufacturers to increase their device reliability through MMU-based state-of-the-art memory protection. VxWorks introduced process-based, user-mode application execution in addition to its traditional kernel-mode execution. There are customers who prefer to run applications in kernel space for the sheer advantage of better performance, responsiveness and other real-time characteristics. The kernel is protected from user-mode applications running in VxWorks real-time processes (RTPs). User-mode applications are also protected from each other.

Features of memory protection include the following:

• MMU-based memory protection provides isolation of the kernel from user-mode applications and of applications from each other, increasing device reliability.
• The standard, process-based programming model simplifies application development.
• VxWorks' preemptive, priority-based global task scheduler ensures real-time deterministic behavior.
• The ability to create private or public objects in the kernel and in RTPs offers flexibility to use objects that are protected from manipulation or that can easily be shared among kernel and process tasks.
• The extensible system call interface enables application developers to employ custom-developed kernel services from user-mode execution.
• Support for shared libraries among RTPs improves code efficiency and re-usability as well as speeding code development and debugging.

Testing and Certifications

Wind River realizes that no matter how robust security features may be, there is tremendous value in also testing and certifying capabilities. This gives our customers peace of mind that the networking stack is con-formant to standards and interoperable with other network devices. For this reason, the VxWorks networking stack is regularly tested against some of the industry's top security test suites and has consistently achieved certifications that assure customers of its interoperability.

Let's explore additional details through the above graphic and following text:

• Nessus Scans/Reports readily available for our customers.
• Independent Achilles Certification, along with Application Note 400 readily available for customers to configure/certify their systems. My colleague Bill Graham described the details in his informative post available here.
• Independent certification by the VPNC (Virtual Private Network Consortium) on basic, AES ad IKEv2 interoperability assuring customers that the stack is interoperable with other leading vendors and solutions.
• Network Stack is one of the first few TCP/IP stacks in the industry to receive the IPv6 Ready Phase II logo certifications.

I hope this helps to clarify some questions, although it's always good to hear your comments. Please feel free to chime in.

 

Updates to our VxWorks 653 platform

By Bill Graham

In my previous post, I mentioned the update to our VxWork 653 platform but didn't go into too many details. I'll share a few more things in this post. Our VxWorks 653 Platform has been doing really well and we're quite proud of its success. In particular, our recent announcements about the Boeing 787 Dreamliner and NASA Ares X-1 programs really put a spotlight on the product. As I mentioned in my last post, it's doing well because it enables aerospace and defense companies the chance to integrate a lot of systems onto one processor.

ARINC 653 is a time partitioning scheduling specification that allows designers to create safety critical systems that share the same processor yet guarantees time and space separation for each partition. My colleague Paul Parkinson goes into some detail in this post.

New faster processors and time partitioning are creating a whole new level of integration in avionics. So called, Integrated Modular Avionics (IMA), allows significant cost savings over the traditional federated approach - a network of independent and individual devices. Just providing ARINC scheduling by itself is not enough. As with any platform and solution it needs the support of middleware (e.g. file systems and network stack), tools and services. Moreover, BSPs for leading boards in the market helps as well, these BSPs mean COTS solutions are all that much easier and quicker to adopt.

Now back to what's new in VxWorks 653 for version 2.3 release. Some of the highlights of the new release are as follows:

• Extended processor support for Power Architecture e600 cores and Intel Architecture Core 2 Duo and Celeron processors
• Addition of a power-safe, DO-178B certifiable file system
• Updates to the DO-178B certifiable network stack which added TCP/IP v4, multicast and IGMP v4. This aligns the VxWorks 653 network stack with our MILS and VxWorks DO-178B/IEC 61508 product
• Updated tools support to the latest Workbench 3.2 release. Workbench includes 653-specific project creation wizards, terminal server with AMIO support and a schema-aware XML editor
• BSPs for GE Intelligent Platform's V7768 (Intel Architecture Core 2 Duo) and Curtiss Wright Controls VPX185 (Power Architecture, e600 core, 8641D based)

One of the highlights for me in this release has been the support we see from our partners such as GE Intelligent Platforms and Curtiss-Wright Controls in working with us on this solution. The strength of our aerospace and defense ecosystem is impressive and its what our customers are looking for - a team they can depend on.