ORIGINALLY PUBLISHED IN COTS JOURNAL, OCTOBER 2010 Author: Robert Day, LynuxWorks, Inc. Real-time determinism and military security don't have to be separate realities. A combination of a secure separation kernel and an embedded hypervisor enables whole new levels of system security. As more military embedded systems get connected to the outside world, particularly to the open Internet, the more vulnerable they become to the seemingly unstoppable waves of cyber attacks. Gone are the days of dedicated and discrete embedded systems, and in their place the embedded systems look more and more like the PCs and workstations that sit in our offices and homes, which in turn means that the software that runs on these devices will need similar characteristics to desktop systems. There are two serious issues with this trend. The traditional desktop operating systems, software stacks and applications are not built with either real-time performance or security in mind, and are now being used in systems that require the determinism of a Real-Time Operating System (RTOS). And when they are connected to outside world, they need protection from cyber attack that [...]

George Brooks and Robert Day explore how the complex requirements of the medical industry can be met using secure open platforms Changing requirements in the healthcare industry are creating interesting consequences for the developer's of tomorrow's medical devices. For instance, there is a growing need for proactive healthcare providing prevention rather than cure, particularly for our aging baby-boomer population. Persistent monitoring and analysis of patients at hospitals, doctors’ surgeries and even at home is the way of the future. The devices that service these needs will also be connected to the patient's medical records. Doctors and specialists will be able to combine and analyse new information from the devices with the patient's past history. This connected world opens up some interesting challenges with the US government regulated Health Insurance Portability & Accountability Act (HIPAA), which protects patient privacy. HIPPA appears to run counter to the openness and easy access to information that is needed to monitor and analyse a patient's progress effectively. To bridge these difficult issues, the government, the healthcare providers and the healthcare industry need to work with technology companies. [...]

ORIGINALLY PUBLISHED IN VME CRITICAL SYSTEMS, SUMMER 2010 Security is fast becoming a prerequisite in today's software systems and nowhere more so than when dealing with software reuse. A challenge for the software designer is how to integrate modern military-grade software programs into legacy software designed long before security standards were predominant in system requirements. The panacea: virtualization and particularly the secure separation kernel. Traditional, non-networked computers are secure from others in the system because of the physical separation that exists between them (Figure 1). Sometimes physical barriers are put in place to prevent unwanted user access in terms of a lock-and-key approach. Figure 1: Security enforced by physical separation Many modern software systems are designed with such tight project time restrictions that redesigning existing software from scratch is almost impossible. To limit engineering costs and to meet project schedules, it is common practice to see a significant amount of software reuse in many of today's software projects. This, however, poses a problem for architects trying to incorporate modern software security requirements into a code base with no concept of such standards. [...]

ORIGINALLY PUBLISHED IN EE TIMES, JUNE 2010 Author: Robert Day, LynuxWorks™, Inc. Robert Day provides some advice on techniques for software migration in embedded software platforms, the impact of security policies, and how to maintain real-time performance and determinism in your apps. Traditional military embedded systems have relied upon the physical separation of devices to ensure that information and communications at different levels of security is not compromised. However, as in commercial systems, with the increase in performance of microprocessors and the desire to reduce the size, weight and power (SWaP) in confined spaces, there is a drive within modern military programs to consolidate hardware platforms. This means that systems running at different levels of security will now be running on hardware platforms where resources (processor, memory, disks, devices and screens) are shared. A new methodology is therefore needed to separate these systems and the information that they contain in a secure way, without compromising performance, and offering a cost-effective way to migrate applications from the legacy systems. Another interesting shift is the desire to bring Commercial Off The Shelf (COTS) applications [...]

ORIGINALLY PUBLISHED IN MILITARY EMBEDDED SYSTEMS, MAY 2010 Author: Robert Day, LynuxWorks™, Inc. Advances in software and hardware technologies now make it feasible to use both embedded and desktop operating systems in a secure military system. Robert examines enablers such as a secure separation kernel and an embedded software hypervisor, then explains uses of desktop OSs in secure military systems. Figure 1: Notional architecture of a VMM environment As Intel® continues to bring its processor technologies into the embedded world, an interesting convergence of embedded applications with more traditional desktop applications is taking place. For military applications, desktop systems and embedded systems have traditionally been separate systems, connected over a secure network (see Figure 1). However, there is now a desire to consolidate multiple hardware platforms to reduce Size, Weight, and Power (SWaP) while maintaining the security that discrete systems traditionally offered. By combining new software and hardware technologies, this consolidation is now a reality, without having to sacrifice either performance or security. The software technology is a secure separation kernel and embedded hypervisor, utilizing the Intel multicore virtualized hardware technology. This [...]