Pip-MPU: Formal Verification of an MPU-Based Separationkernel for Constrained Devices

Abstract

Pip-MPU is a minimalist separation kernel for constrained devices (scarce memory and power resources).In this work, we demonstrate high-assurance of Pip-MPU’s isolation property through formal verification.Pip-MPU offers user-defined on-demand multiple isolation levels guarded by the Memory Protection Unit (MPU).Pip-MPU derives from the Pip protokernel, with a full code refactoring to adapt to the constrained environment and targets equivalent security properties.The proofs verify that the memory blocks loaded in the MPU adhere to the global partition tree model.We provide the basis of the MPU formalisation and the demonstration of the formal verification strategy on two representative kernel services.The publicly released proofs have been implemented and checked using the Coq Proof Assistant for three kernel services, representing around 10000 lines of proof.To our knowledge, this is the first formal verification of an MPU-based separation kernel.The verification process helped discover a critical isolation-related bug.