Zephyr Project RTOS – First Functional Security Authentication Submission of Open Source Real-Time Operating System

Time:2019-6-4

Zephyr Project RTOS - First Functional Security Authentication Submission of Open Source Real-Time Operating System
Author: Amber Hibberd, Ph.D. Intel Functional Safety Engineering Manager and Zephyr Project Member

Free Open Source RTOS… designed to pass security certification!

The continuous growth of connectivity devices has exposed the obvious gap in the Internet of Things market: the open source real-time operating system, which requires free licenses, has been certified by the International Electrotechnical Commission (IEC) and the International Organization for Standardization (ISO).

Zephyr Project RTOS - First Functional Security Authentication Submission of Open Source Real-Time Operating System

The Zephyr project aims to meet this need and plans to be the first in this category to submit its core operating system, including long term support (LTS) released kernels and operating system services for authentication. These certificates are important because they indicate that the product has been carefully reviewed and tested and are considered trustworthy in security-related systems.

What is functional security?

According to IEC, “functional safety depends on active systems, such as smoke detection through sensors and subsequent intelligent activation of fire extinguishing systems.” In addition, “Functional security is essentially end-to-end. It must consider the functions of components or subsystems as part of the whole automatic protection function of any system.”

On the other hand, the degree of security provided. IEC defines safety integrity level (SIL) and ISO defines automotive safety integrity level (ASIL). Essentially, these measures the likelihood of dangerous failure. The IEC 61508 standard defines four levels, and SIL 4 is the most reliable and stringent. Zephyr RTOS will target SIL 3 with hardware systems containing Zephyr software. This solves most of the device use cases designed for functional safety. For automobiles, we will submit ISO 26262 ASIL D to obtain the qualification of many automatic vehicle systems.

What is ZEPHYR doing?

The Zephyr authentication scope applies to core operating systems across the selected architecture, including kernels and operating system services. Zephyr has many RTOS elements that are still outside the scope of the first submission, such as platform drivers, board support packages, platform-specific power management implementations, file systems and sensor driver implementations.

The Zephyr project has begun to develop RTOS for functional security certification in an open source environment. We are working with certification authorities to ensure that we have the basis for submission. A key aspect of open source is inviting community contributions. We are revising our development process to maintain community involvement, while ensuring the rigorous process control required for high integrity code, and developing tool analysis. In some cases, open source can be safer because of the transparency of development and the number of eyes people from different communities are watching the code.

Zephyr RTOS functional security assessment is conducted in two stages: concept review and functional security management, and detailed testing. The first phase includes Zephyr software security requirements and architecture specifications, as well as verification and validation plans. Phase II includes all levels of software (such as software modules, software integration), fault injection testing and compliance testing of coding guidelines. Finally, authentication will establish software fault avoidance and control measures to the target integrity level.

What can developers expect?

Our LTS version will be available to developers in the middle of the year. This is a good way to start testing and prototyping certificate submission code. Once we complete the certification, product designers can use the final Zephyr OS kernel that meets the security requirements to create their hardware and application software systems. This will shorten the path to building products that require functional security environments.

We look forward to supporting industrial, automotive, smart city and other product developers who integrate Zephyr RTOS into their security-driven solutions. For more information about our free and secure RTOS, please contact us via Zephyr. We are happy to use our code in your products!

Zephyr Project RTOS - First Functional Security Authentication Submission of Open Source Real-Time Operating System

For more information or questions, please register for the Slow channel of Zephyr Project.


Zephyr Project RTOS - First Functional Security Authentication Submission of Open Source Real-Time Operating System

Dates of KubeCon + CloudNativeCon and Open Source Summit meetings:

  • Date of announcement of meeting schedule: 10 April 2019
  • Date of the event: 24-26 June 2019

KubeCon + CloudNativeCon and Open Source Summit Sponsorship Scheme
KubeCon + CloudNativeCon and Open Source Summit Diversified Scholarship are now being applied for
KubeCon + CloudNativeCon and Open Source Summit will land in China for the first time
KubeCon + CloudNativeCon and Open Source Summit ticket window, buy tickets immediately!