The seL4 Foundation has awarded Interim Endorsement to Proofcraft as a Trusted Service Provider for commercial support, verification projects, training and consulting on formal verification of seL4 and seL4-based systems. More on our services and products page.
Following CSIRO’s abandoning of Trustworthy Systems (TS) and the seL4 technology TS developed, the seL4 community and the seL4 Foundation have grown a lot. This has led to concerns that the broader participation might have the potential to undermine the integrity of seL4. In his latest blog, Gernot explains why there is no reason for such concern. seL4's open governance and technical leadership is based on technical merit and established trust, not money.
Founded by the seL4 verification leaders, Proofcraft offers commercial support, verification projects, training and consulting on formal verification in general, and involving seL4 specifically. By applying mathematical machine-checked software verification, Proofcraft increases critical software systems' reliability, safety and security, for a verified future!
Xcalibyte, a member of the seL4 Foundation, is hosting a webinar on Sep 16, 2021, given by Gernot Heiser, seL4 Foundation Chairman & Scientia Professor, UNSW Sydney, and Yuning Liang, CEO & co-founder, Xcalibyte. The topic will be ‘The seL4 Microkernel: Proved Security for Cyberphysical Systems’.
To register: http://xcalscan.mikecrm.com/Uw4y9HU.
The seL4 Foundation thanks Ghost for its generous contribution. Ghost's commitment strengthens the seL4 Foundation's mission to continue advancing the ecosystem, the code base, and the verification efforts of seL4, the world's most advanced and highly assured operating-system kernel.
As a founding member of the Foundation, Ghost is developing self-driving cars using seL4, aiming to make the first formally proven safety-critical system on the road into a reality for millions of drivers.
We warmly thank Ghost for its continued support!
The seL4 Foundation has awarded interim endorsement to the seL4-based TRENTOS secure operating system from Foundation member HENSOLDT Cyber. This is the first time a product is endorsed, and marks a new milestone for the Foundation and the growth of the seL4 ecosystem.
HENSOLDT Cyber's training module for TRENTOS has also received interim endorsement, which constitutes another milestone as the first endorsed training provided from outside the Trustworthy Systems group.
Details on interim-endorsed services and products are on our services and products page.
The seL4 Foundation welcomes Lotus Cars.
Lotus is a leader in the Global Premium Sport Car market. We stand out as a brand dedicated to pure driving experience. Committed to advancing technology with precision and passion, Lotus continues to spearhead research into areas such as autonomous driving, connectivity, intelligence, electrification. Emira, Evija, Evora are representative models that in recent years drive Lotus’ world-wide reputation. Going forward, Lotus’ approach will be based on the principle of “EAS-IP” (Electrify, Amplify, Simplify, Intensify and Personify), a globally R&D strategy, and excellent autonomous driving solutions to create a novel, technology-based driving experience for future global users.
In joining the seL4 Foundation, Lotus is committed to the development and deployment of the seL4 microkernel in the field of autonomous driving, advance Lotus' automotive operating system to meet the overall functional safety goals of the system, and realize the launch of safe and reliable autonomous driving products.
On 6 August DARPA brought the “SMACCMcopter” to DEF CON and invited the assembled hacker elite to attack it. The SMACCMcopter was the research vehicle of the Air Team at DARPA's HACMS program. The Trustworthy Systems team worked with project partners to deploy seL4 and leverage formal methods to protect the drone from cyber attacks.
The seL4 Foundation is pleased to welcome Kansas State University as Associate Member. KSU has for years been collaborating for years on seL4-based projects with a number of Foundation members under multiple DARPA projects and we are looking forward to their continued involvement.
On 29th July 2009, the original functional correctness proof of seL4 was completed, a widely-recognised research breakthrough and the first big milestone in seL4's history. We obviously had a party then, and have since celebrated its anniversary, calling it, tongue-in-cheek, “International Proof Day”.
On the fifth anniversary we open-sourced seL4, which was another major milestone, which we referred to as “seL4 Freedom Day”.
Today marks the 12th anniversary of the proof, and the 7th anniversary of open-sourcing, and from now on we’ll refer to the date simply as "seL4 Day”.
The seL4 community is now definitely global. Still we would normally have a physical party in Sydney, but won’t be able to due to the renewed Covid-19 restrictions — so we’ll all be remote ;-)
Happy seL4 Day everyone!
A virtual toast to you all, and a big thank-you to all for your continued support!
The assurance story for seL4 on RISC-V keeps building. We first formally proved functional correctness: that the seL4 C code on RISC-V platforms behaves exactly as its specification says. We then established binary correctness: that the machine code running on the processor behaves exactly as the C code, and by extension, as the specification says. We now have established the crucial integrity property for seL4 on RISC-V: that the specification, and by extension the kernel binary, prevents an application running on top from modifying data without authorisation. In seL4 speak: seL4 provably enforces capability-based access control.
“The integrity property is crucial for security: it is key to enforce the isolation of components running on top of the kernel”, says Gerwin Klein, seL4 verification expert and chair of the seL4 Foundation technical steering committee. “This is what allows critical components, like the network controller that has access to software-controlled brakes in a modern car, to securely run alongside untrusted software, like the entertainment system. With integrity proved, you know that an attack on or from a vulnerable untrusted part of the system cannot compromise the critical parts.”
Integrity had been proved in the original seL4 verification on the Arm32 architecture. It is now also established for RISC-V architecture, making it the only 64-bit architecture that has an OS with such a comprehensive verification and security story. We thank Ryan Barry of Trustworthy Systems, main author of these proofs! We also gratefully acknowledge funding from the Australian Reseach Council through grant DP190103743 which has enabled this work.
The seL4 Foundation is pleased to welcome Technical University of Munich as Associate Member. The TUM, home of the Isabelle theorem prover used in the verification of seL4, has been a collaborator of the Trustworthy Systems team for many years.
The seL4 Foundation welcomes Second State as a member.
Second State is the creator and maintainer of WasmEdge, a CNCF / Linux Foundation project, which provides a high-performance, lightweight, cross-platform, polyglot, and secure software runtime/sandbox for edge computing. Based on the WebAssembly standard, WasmEdge could be 100 times faster than Docker and hypervisor-based solutions. It supports multiple programming languages, including DSLs, and can be embedded into multiple hosting environments.
Second State is currently porting WasmEdge to seL4. It will be one of the first software runtimes in the seL4 ecosystem. By working with members in the seL4 Foundation, Second State aims to create a real-time software sandbox for automotive and industrial (ie smart factories) applications.
With four new Premium Members joining the seL4 Foundation during the past few weeks, we now welcome their representatives on the seL4 Board. The new Board Members are:
|Dr. Feng Zhou represents Horizon Robotics, where he is a Fellow. He has 15 years of academic as well as 15 years of industry experience in video/image compression & processing, computer vision, artificial intelligence, and ASIC processor architecture.|
|Ian Xu represents Li Auto, where he serves as Vice President, leading Computing Platform design and development including hardware, OS and run-time environment. His experience is in the design and development of networking and wireless communication products.|
|Dr Matthew P. Grosvenor represents Jump Trading, where he specializes on measurement and optimization of high-performance and low-latency network systems. Matthew is a former member of the Trustworthy Systems research group that developed seL4.|
|Qiyan Wang represents NIO, where he leads a global R&D team responsible for Vehicle Operating System, Connected Vehicle Cloud, Vehicle Digital Architecture, Cyber Security, and Vehicle Software Integration and Validation.|
The four new members join five continuing members on the seL4 Board, taking the size of the Board to nine.
The seL4 Foundation welcomes Jump Trading as a Premium Member.
Jump is a research-based organization that is committed to applying cutting edge technology to trading global financial markets. Jump has the full spectrum of technology challenges from machine learning models and HPC at massive scale to cybersecurity and trusted compute requirements that come from being a major market participant in many asset classes. Jump was founded in 1999 and has over 20 global offices including Sydney, Shanghai and Singapore in Asia.
The seL4 Foundation welcomes Horizon Robotics as a Premium Member.
Horizon Robotics is a global leader in the development of artificial intelligence computing platforms. Its mission is to make driving safer and more convenient as drivers transition to intelligent and self-driving vehicles. Founded in Beijing in 2015, Horizon Robotics develops next-generation autonomous driving technology integrating edge-AI processors, algorithms, and toolkits. Horizon has reinvented the automotive-grade AI processor with Horizon Journey SOC and its Brain Processing Unit AI engine (Horizon BPU), to offer the ultimate balance of high-performance, low power, and cost effectiveness for inference at the edge. Horizon's state-of-the-art AI toolkit and model zoo enable developers to optimize and deploy their own neural network models to Journey BPU with ease. Horizon also offers vision perception algorithms to accelerate time-to-production in the dynamic and highly competitive ADAS/AD market.
The evolution of automotive E/E architecture continues rapidly. With complicated hardware consolidation, software consolidation and separation happen simultaneously. “To address the challenges of safety, security and realtime in autonomous software, a fundamental high quality state-of-the-art microkernel is needed. We are looking forward to working with members of seL4 Foundation to build mixed-critical platform and solution for next-generation autonomous driving vehicles.”
The seL4 Foundation welcomes Li Auto Inc. as a Premium Member.
Li Auto is an innovator in China's new energy vehicle market. The Company designs, develops, manufactures, and sells premium smart electric vehicles. Through innovations in product, technology, and business model, the Company provides families with safe, convenient, and refined products and services. Li Auto is a pioneer to successfully commercialize extended-range electric vehicles in China. Its first model, Li ONE, is a six-seat, large premium electric SUV equipped with a range extension system and advanced smart vehicle solutions. The Company started volume production of Li ONE in November 2019 and released the 2021 Li ONE in May 2021. The Company leverages technology to create value for its users. It concentrates its in-house development efforts on its proprietary range extension system, next-generation electric vehicle technology, and smart vehicle solutions. Beyond Li ONE, the Company aims to expand its product line by developing new vehicles, including BEVs and EREVs, to target a broader consumer base.
Li Auto's team will develop a secure highly extensible real-time open platform for next generation self-driving vehicles based on the micro-kernel OS seL4. The platform will enable an ecosystem for third party application developers.
The seL4 Foundation welcomes Xcalibyte as a member.
Xcalibyte's mission is to improve the quality of software by creating easy-to-use tools that help developers build and deploy reliable and secure code. Founded by world-class software experts with decades of experience in compiler optimization and software development, Xcalibyte was established in 2018 and has offices in Shenzhen, Shanghai, Beijing and Hong Kong. Xcalibyte enhances the speed and accuracy of code auditing, code evaluation, and code defect detection. We use advanced static code analysis to help reduce costs, improve productivity, and ensure software developers in China and all over the world have the proper capabilities to develop better, more reliable software.
“As we are actively working with members of the seL4 Foundation, it makes perfect sense for us to be part of the organisation. Our code analysis tools are being used by community members and we are aiming to ensure they develop high quality and secure code.”
The seL4 Foundation welcomes NIO Inc as a Premium member.
NIO is a pioneer in China's premium electric vehicle market. We design, jointly manufacture, and sell smart and connected premium electric vehicles, driving innovations in next generation technologies in connectivity, autonomous driving, and artificial intelligence. Redefining user experience, we provide users with comprehensive, convenient, and innovative charging solutions and other user-centric service offerings. NIO went public in the U.S. in 2018. So far, NIO has launched 3 mass-production vehicle models: ES8, ES6, and EC6, and accumulated deliveries to users are over 120,000. Starting September, NIO will start delivering to users in Norway. NIO invests heavily in in-house R&D to build full-stack cutting-edge technologies around intelligent and autonomous driving EV. Its engineering teams are distributed across the globe, including US, UK, Germany and China.
The Digital Systems department at NIO is missioned to develop the most advanced software platform for the next-generation autonomous driving vehicles in the industry from the ground up. This platform is internally named NIO Vehicle Operating System (NVOS) and based off seL4. It involves solving a wide range of technical challenges, such as seamless app development on heterogeneous hardware chipsets, low-latency & high throughput data processing, powerful AI framework, automobile-grade safety and security guarantee, and complete toolchains to provide Android alike development experience.
Various repositories with support libraries and tools have also been updated. Please refer to the following release manifests:
The seL4 Foundation has appointed Dr June Andronick as (part time) CEO. June, already a permanent board member as one of the founders of the seL4 technology, continues to fullfil the role of Treasurer.
The seL4 Foundation welcomes New-Zealand based Kry10 as our latest member.
“We believe that formal methods and proven code is the only viable option for software, whether it is AI, Industrial controls, or really anything else. seL4 is the first, and only real practical kernel to show the world how it should be done,” says Boyd Multerer, CEO and Founder of Kry10.
“At Kry10, we are building a full-featured operating system on top of the seL4 Kernel, along with tooling, services, key management and more. We are aiming at industrial use, but it is suitable for consumer devices and more. Combined with the Erlang BEAM VM for applications, we intend to deliver systems with great security and minimal downtime, even across upgrades.”
The seL4 Foundation, as well as its members and ecosystem, want to reinforce their commitment to the success and support of seL4. The TS team will be rebuilding at UNSW and a number of Foundation-endorsed seL4 services providers as well as the newly created Proofcraft verification company are dedicated to support seL4 in the future.
With this recent news, it’s never been more important to work together as a community to support seL4 and the transition of the support and development to the Foundation and its members. People have been asking how to help. Offers of support keep coming. We are looking at various options for sustainable support, with a priority of keeping the team together. There are options on the table that we are exploring that may allow us to do that. Please help us with that, the existing TS team is the best base for stable seL4 support.
In the meantime, here are 4 concrete things that can be done now. Spread the word to people who care about seL4’s future, and contact us if you want to discuss.
The community has expressed a need to more easily find seL4 experts to hire. The Foundations has created a "Jobs in seL4 ecosystem" page where members can post offers for positions with seL4 expertise.
Today, the seL4 Foundation and RISC-V International announced that the verified seL4 microkernel on the RV64 architecture has been proved down to the executable code by CSIRO’s Data61, thanks to funding provided by HENSOLDT Cyber GmbH. This guarantees that the seL4 microkernel on RV64 will operate to specification even when built with an untrusted C compiler, GCC.
Within and across open collaboration communities it is essential to work together on areas of mutual interest. RISC-V and seL4 are pleased to announce their progress and their alliances as they join forces to enable stronger overall security, combining security-oriented architecture and operating system design.
“We are excited to be one of the first architectures with secure operating system kernels with such a strong formal verification story,” said Mark Himelstein, CTO of RISC-V International. “RISC-V is continuing to increase the security features that encompass the ISA and the secure seL4 kernel is a natural complement.”
“This is another milestone for seL4, which continues to define the state of the art in OS security,” added Prof Gernot Heiser, Chairman of the seL4 Foundation. “Stronger aligning the two open ecosystems makes a lot of sense.”
“The verified seL4 microkernel forms the core of TRENTOS, our secure operating system for our MiG-V chip, a RISC-V processor with supply chain security”, said Sascha Kegreiß”, CTO of HENSOLDT Cyber GmbH. “This unique combination of hardware and software security can protect critical assets from advanced persistent cyber threats.”
”Translation validation ties all of our verification efforts together,” said Dr Zoltan Kocsis, CSIRO Verification Engineer. “Bringing translation validation to a modern, 64-bit processor presented significant scalability challenges but, in the end, we were able to overcome them.”
For more details on binary verification of seL4 on RISC-V see Gernot's blog: seL4 on RISC-V Verified to Binary Code (and seL4 and RISC-V Foundations form an alliance).
The seL4 Foundation is pleased to welcome ETH Zurich as associate member, and is looking forward to further strengthening of ETH's engagement with seL4.
The seL4 Foundation now has an easy way for the general public to support financially the development of seL4 and its open-source ecosystem, using the Linux Foundation's LFX portal.
The seL4 Foundation welcomes Raytheon Technologies as our latest member.
Members of the Raytheon Technologies team have been long-time core participants in the seL4 ecosystem, predating the company’s formation in 2020, which brought together Raytheon Company and United Technologies’ aerospace businesses, Collins Aerospace and Pratt & Whitney. Collins Aerospace was a prime contractor in the DARPA HACMS program, which demonstrated the seL4-based incremental cyber retrofit of autonomous military vehicles. This was a major milestone in the growth of seL4, demonstrating that it protects against cyber attacks on real systems in operation. The same Raytheon Technologies team now leads the follow-on DARPA CASE program, aiming at designed-in cyber-resiliency, including the seL4-based framework for verified initialisation and configuration of systems architectures.
The seL4 Foundation has commenced providing interim endorsement for trusted service providers for seL4. These may apply to consulting and development services as well as for training. In a first step, the Foundation has given interim endorsement to the following trusted service providers (in the order of approval):
Interim endorsement is intended to lead to full certification; the Foundation will work with interim endorsees and the general membership on developing certification schemes. More detail.
The seL4 Foundation welcomes Penten Pty Ltd as our newest member. Penten is based in Canberra, Australia, and specialises in secure communications technology and artificial intelligence. Penten has been developing seL4-based products for a number of years, some of which are in daily use in multiple defence forces.