Principles of Security and Trust

Volume 7215 of the series Lecture Notes in Computer Science pp 51-68

Parametric Verification of Address Space Separation

  • Jason FranklinAffiliated withCarnegie Mellon University
  • , Sagar ChakiAffiliated withCarnegie Mellon University
  • , Anupam DattaAffiliated withCarnegie Mellon University
  • , Jonathan M. McCuneAffiliated withCarnegie Mellon University
  • , Amit VasudevanAffiliated withCarnegie Mellon University


The address translation subsystem of operating systems, hypervisors, and virtual machine monitors must correctly enforce address space separation in the presence of adversaries. The size, and hierarchical nesting, of the data structures over which such systems operate raise challenges for automated model checking techniques to be fruitfully applied to them. We address this problem by developing a sound and complete parametric verification technique that achieves the best possible reduction in model size. Our results significantly generalize prior work on this topic, and bring interesting systems within the scope of analysis. We demonstrate the applicability of our approach by modeling shadow paging mechanisms of Xen version 3.0.3 and ShadowVisor, a research hypervisor developed for the x86 platform.