Will we ever have truly secure operating systems?
Authors
School of Computer Science and Engineering
UNSW,
Sydney 2052, Australia
Published:
Joint Keynote at ASPLOS and EuroSysAbstract
Half a century after PSOS, the first attempts to prove an operating system (OS) secure, OS faults remain a major threat to computer systems security. A major step forward was the verification of the seL4 microkernel, the first proof of implementation correctness of an OS kernel. Over the next 4 years this proof was extended to the binary code, proofs of security enforcement, and sound and complete worst-case execution-time analysis. The proofs now cover 4 ISAs.
Yet, 15 years later, there is still no provably secure OS. While seL4 has been successfully deployed in defence and civilian security- and safety-critical systems, it is a microkernel that mostly guarantees process isolation without providing the application-oriented services expected from an OS. This not only makes seL4 difficult to deploy, but means that there is limited assurance that a system built on top is secure in any real sense.
Why has seL4 not been leveraged into a secure OS? In this talk I will explore some of the reasons behind this disappointing state of affairs, and what can be done about it. Specifically I will discuss our current work on LionsOS, a new seL4-based OS targeting the embedded/cyberphysical domain, and designed to be verifiable. I will also discuss more speculative, early-stage work towards a provably secure, general-purpose OS.
BibTeX Entry
@misc{Heiser_25:a-es,
author = {Gernot Heiser},
howpublished = {Joint Keynote at ASPLOS and EuroSys},
month = apr,
title = {Will We Ever Have Truly Secure Operating Systems?},
url = {https://trustworthy.systems/publications/papers/Heiser_25:a-es.abstract.pml},
year = {2025}
}
BibTeX