  Separation kernels provide temporal/spatial separation and controlled
information flow to their hosted applications. They are introduced to decouple
the analysis of applications in partitions from the analysis of the kernel
itself. More than 20 implementations of separation kernels have been developed
and widely applied in critical domains, e.g., avionics/aerospace,
military/defense, and medical devices. Formal methods are mandated by the
security/safety certification of separation kernels and have been carried out
since this concept emerged. However, this field lacks a survey to
systematically study, compare, and analyze related work. On the other hand,
high-assurance separation kernels by formal methods still face big challenges.
In this paper, an analytical framework is first proposed to clarify the
functionalities, implementations, properties and standards, and formal methods
application of separation kernels. Based on the proposed analytical framework,
a taxonomy is designed according to formal methods application,
functionalities, and properties of separation kernels. Research works in the
literature are then categorized and overviewed by the taxonomy. In accordance
with the analytical framework, a comprehensive analysis and discussion of
related work are presented. Finally, four challenges and their possible
technical directions for future research are identified, e.g. specification
bottleneck, multicore and concurrency, and automation of full formal
verification.
