We present an in-depth coverage of the comprehensive machine-checked formal verification
of seL4, a general-purpose operating system microkernel. We discuss the kernel design we …

While intransitive noninterference is a natural property for any secure OS kernel to enforce,
proving that the implementation of any particular general-purpose kernel enforces this …

Timing channels are a significant and growing security threat in computer systems, with no
established solution. We have recently argued that the OS must provide time protection, in …

Given recent high-profile successes in formal verification of security-related properties (eg,
for seL4), and the rising popularity of applying formal methods to cryptographic libraries and …

We describe our ongoing research that aims to eliminate microarchitectural timing channels
through time protection, which eliminates the root cause of these channels, competition for …

A web browser works with data and scripts from different sources, and these sources are not
all trusted equally by the user of the browser. This fact requires web browser designers to …

Microarchitectural timing channels are a major threat to computer security. A set of OS
mechanisms called time protection was recently proposed as a principled way of preventing …

With the rise of formally verified micro kernels, we finally have a trusted platform for secure
IPC and rigorous enforcement of our mandatory access control policy. But, not every …

When we use code repositories, each commit should include code changes for only a single
task and code changes for a single task should not be scattered over multiple commits …

The key software component of a computer system is the operating-system kernel. It always
needs to be trusted because it runs in the CPU's privileged mode and therefore has access …