A Separation Kernel Formal Security Policy

Separation kernels mediate interaction between partitions in a secure system. System security policies can be developed about systems that use separation kernels that rely only on the appropriate separation kernel operation. We introduce a formal security policy for a separation kernel in ACL2, and argue for its usefulness by comparing it with other formalisms and by using it in a proof involving the correctness of a rewall application.