| Linux-friendly microkernel OS tightens mobile security |
May 02, 2008
 [Updated May 6] -- Open Kernel Labs (OK Labs) has upgraded its microkernel operating system (OS) and Linux-friendly virtual machine environment for embedded devices. OKL4 2.0 adds technology aimed at protecting a phone's call-making capabilities despite attacks, malware, or faults within OSes, applications, and drivers.
OKLabs claims its OKL4 microkernel to be the top embedded virtualization environment in the mobile phone market, in terms of units deployed. Now shipping in "millions of units per month," according to company claims, the product has seen use in multiple Linux-based handset models from Toshiba, and in multiple Windows CE-based devices from Taiwanese manufacturing giant HTC. The microkernel's thin hardware abstraction layer also supports Symbian as a guest OS, CEO Steve Subar (pictured below) told LinuxDevices in a recent interview.
Version 2.0 of the OKL4 kernel aims to bolster a mobile device's protection against malware and destructive hackers, says OK Labs, while also insulating mobile phone software from the effects of poorly-behaved code like flaky drivers. According to the company, all these mobile software security threats will grow as carriers begin to open up to out-of-network handsets.
The main new security feature in OKL4 v2 is a "Secure HyperCell" technology aimed at encapsulating and protecting critical software components from the rest of the system. The unspoken goal here is probably to ensure that a phone can still make and take calls even if there is a fault in a complex OS such as Linux, in a device driver needed for some new peripheral, or in a new application rolled out around some data service. No call means no income for the operators.
OKLabs OKL4 v.2
(Click to enlarge)
Each "Secure HyperCell" can cloister away a guest OS, an application, or an individual device driver, OKLabs says. With each component segregated into its own HyperCell, engineers can use IPC keys (depicted in the diagram above) to control which components can communicate, and when. The net payoff for handset makers is the ability to add functionality incrementally, while keeping devices secure, says OKLabs. Subar observes that another intriguing benefit could be sharing device drivers between multiple OS instances.
Unlike Linux and other "monolithic" operating systems, OKL4 is a microkernel operating system (OS) that runs only the bare essentials in kernel mode. This results in the smallest possible "trusted security base," the company says. Non-essentials like device drivers run in user mode, affording some protection from misbehaving drivers, one of the most common causes of OS freezes, Subar notes.
Fluffy Spider FancyPants screen |
Despite its microkernel architecture, OKL4 does have a tiny, native, POSIX-compliant real-time execution environment, which is said to allow for the implementation of services that would be impossible or impractical to implement outside the kernel. OKL4's native application environment can also be used for the UI software on low-end phones, Subar suggested. In fact, at least one lightweight graphics framework has been ported to the environment -- Fluffy Spider FancyPants, a GUI stack claimed to require less that 3MB of disk space, while offering sophisticated special effects like overlain on-screen elements, images, and playing videos.
The OKL4 microkernel implements a lightweight hardware abstraction layer on top of which one or more virtual machines can be configured to run a guest OS. Subar describes this approach as "true virtualization," contrasting it with "OS co-location" capabilities offered by competing products.
Asked about performance penalties associated with hardware abstraction, Subar acknowledged a slowdown in the low single-digit percentage range, while suggesting that OKL4 offers faster interprocess communications (IPC) than competing products that use the hardware abstraction layer approach. "We have very high performance IPC. We claim to have the fastest embedded IPC on ARM, MIPS, and Itanium, and so far [that claim] has been unchallenged."
Asked about OKL4's support for MIPS64 and Itanium -- architectures popular on the other side of the wire, in telecom infrastructure -- Subar suggested it was a market the company hoped to move into. "We think that moving from a medium-paranoia segment to a high-paranoia segment is a good growth path," he said.
Meanwhile, competitor VirtualLogix has been trying to do the reverse, with the "Mobile Handset" version of its VLX stack. VirtualLogix evolved from Jaluna which in turn evolved from ChorusOS, a nano-kernel originally developed by Sun Microsystems for telecom applications. VirtualLogix recently received an equity investment by Motorola, which sells both infrastructure equipment and mobile handsets. VirtualLogix has also had considerable success on DSPs used in set-top boxes, and is also partly funded by TI.
A third horse in the embedded virtualization products is Trango, which offers a pure hypervisor product that eschews the native POSIX environments built into the products of its competitors. Trango's recent focus has been on adding support both for MIPS64 and ARM9 based processors, suggesting it also divides it attention between the infrastructure and mobile device markets.
Toshiba W47T
(Click for details) |
OK Labs launched a year ago in April as a Chicago-based spin-off of NICTA (National Information/Communication Technology, Australia), an Australian government-sponsored thinktank. NICTA previously supplied an "L4" microkernel to phone chip giant Qualcomm, and Qualcomm customer Toshiba is said to have used the stack in its W47T phone (pictured at right). Subar said OKLabs maintains a very close working relationship with NICTA, something he felt might be an advantage, in the long term. "Everyone claims to have a big R&D budget, but for most it's a big 'D' and little 'r'."
In a statement, Subar said, "OKL4's capability-based security can prevent data leakage by untrusted code. With increasing amounts of personal information on handsets, preventing identity theft through mobile viruses is paramount."
Availability
OKL4 2.0 is shipping now, says OK Labs, available under an open source or a commercial license. In addition, OK Labs offers customization services, processor architecture porting, and training.
Related Stories:
(Click here for further information)
|
|
|
FUEL Database on MontaVista Linux
Whether building a mobile handset, a car navigation system, a package tracking device, or a home entertainment console, developers need capable software systems, including an operating system, development tools, and supporting libraries, to gain maximum benefit from their hardware platform and to meet aggressive time-to-market goals.
Breaking New Ground: The Evolution of Linux Clustering
With a platform comprising a complete Linux distribution, enhanced for clustering, and tailored for HPC, Penguin Computing¿s Scyld Software provides the building blocks for organizations from enterprises to workgroups to deploy, manage, and maintain Linux clusters, regardless of their size.
Data Monitoring with NightStar LX
Unlike ordinary debuggers, NightStar LX doesn¿t leave you stranded in the dark. It¿s more than just a debugger, it¿s a whole suite of integrated diagnostic tools designed for time-critical Linux applications to reduce test time, increase productivity and lower costs. You can debug, monitor, analyze and tune with minimal intrusion, so you see real execution behavior. And that¿s positively illuminating.
Virtualizing Service Provider Networks with Vyatta
This paper highlights Vyatta's unique ability to virtualize networking functions using Vyatta's secure routing software in service provider environments.
High Availability Messaging Solution Using AXIGEN, Heartbeat and DRBD
This white paper discusses a high-availability messaging solution relying on the AXIGEN Mail Server, Heartbeat and DRBD. Solution architecture and implementation, as well as benefits of using AXIGEN for this setup are all presented in detail.
Understanding the Financial Benefits of Open Source
Will open source pay off? Open source is becoming standard within enterprises, often because of cost savings. Find out how much of a financial impact it can have on your organization. Get this methodology and calculator now, compliments of JBoss.
Embedded Hardware and OS Technology Empower PC-Based Platforms
The modern embedded computer is the jack of all trades appearing in many forms.
Data Management for Real-Time Distributed Systems
This paper provides an overview of the network-centric computing model, data distribution services, and distributed data management. It then describes how the SkyBoard integration and synchronization service, coupled with an implementation of the OMG¿s Data Distribution Service (DDS) standard, can be used to create an efficient data distribution, storage, and retrieval system.
7 Advantages of D2D Backup
For decades, tape has been the backup medium of choice. But, now, disk-to-disk (D2D) backup is gaining in favor. Learn why you should make the move in this whitepaper.
|
|
|
|
|
news feed