Redirecting to the new SSRG Trustworthy Systems page.

The University of New South Wales

ERTOS Honours Thesis Projects


The thesis topics listed here are available to strong undergraduate students. They are mostly associated with research projects and generally quite challenging; many topics have the potential to lead to a publication, and in average we get about one paper a year from the work of one (or more) undergraduate thesis students.

Students who are not aiming for excellence are in the wrong place here. We are generally looking for honours candidates, or students with outstanding performance in operating systems. Specifically we guarantee a thesis topic to any student who has obtained a HD grade in UNSW's Operating Systems or Advanced Operating Systems course, no matter what their other grades are!

Note that the below list is constantly updated, new topics are added as we identify them as work on various research projects proceeds. Topics marked NEW are recent additions.

UNSW students can access all of our recent student theses.

Undergraduate Thesis Topics

Present topics supervised by Gernot Heiser (official list)

  • 3211: Secure Browser OS NEW
    A secure web browser with a minimum trusted computing base has been propagated as a way to protect against browser exploits, for example IBOS. Such an approach is a big improvement over present practice, but is still at the mercy of an underlying OS which isn't trustworthy.
    This is changed with the availability of the formally-verified a seL4 microkernel, which can present a truly trustworthy basis for a secure browser. This thesis is to design and implement such a secure browser OS on seL4.
    Novelty and Contribution: First truly trustworthy web browser.
  • 3210: Evolvable Trustworthy System NEW
    The Trusted Platform Module (TPM) specified by the Trusted Computing Group (TCG) and implemented on many PC platforms supports a secure boot and remote attestation (where an external agent can ascertain that the system is in a particular software configuration). However, the TCG approach has been a considered a failure for end-user devices, as it does nothing to ensure that the “trusted” software is trustworthy and does not support upgrading it when it has found to be vulnerable.
    The formally-verified seL4 microkernel presents an opportunity to make TPMs useful: seL4 is truly trustworthy, so attesting that it is running provides real assurance of trustworthiness. seL4 itself can then be used to instantiate a trusted software stack, and protect it from untrusted components, and it can be used to upgrade the trusted software securely.
    This thesis is to build a demonstrator of an seL4-based, evolvable trustworthy system. This will require implementing TPM-facilitated secure boot of seL4 and some trusted base which can be remotely attested. If time allows, demonstrate secure software evolution.
    Novelty and Contribution: Such an approach to a practical TPM_based trusted system has not been demonstrated, and will constitute publishable research.
  • 3209: Preempt or not preempt, that is the question NEW
    A widespread belief holds that an OS kernel for real-time use must be fully preemptible (whatever that means). While preemptability is a reasonably obvious requirement for monolithic kernels, it is also used for microkernels, such as the commercial Green Hills Integrity, QNX Neutrino and research systems such as Fiasco, a member of the L4 microkernel families. In contrast, most L4 microkernels, such as Pistachio, OKL4 and seL4 are non-preemptible. The claim is that if all kernel paths are kept short enough, then preemption adds performance overheads without significantly improving real-time behaviour.
    This thesis is to quantify the performance/real-time tradeoff, and establish the criteria under which a non-preemptible kernel is a winner. This will require evaluating the hardware-dictated system-call, interrupt-handling and preemption overheads on several architectures, and establish limits on preemption-free system-call latencies and on that basis answer the question.
    Novelty and Contribution: A comprehensive treatment of this issue will provide a significant, and publishable, contribution to the theory of OS design and implementation.
  • 3116: OS for a Dataflow Computer
  • 3115: OKL4 microvisor as a systems platform
  • 3114: Native Real-time Java on L4
  • 3113: Global scheduling in virtualized systems via semantic patches
  • 2978: VT-x support for OKL4
    OKL4 uses para-virtualization to run Linux, even on x86, where pure virtualization is enabled by the VT-x extensions. This makes sense on performance-sensitive mobile devices, as para-virtualization has performance advantages over pure virtualization (see Adams and Agesen, ASPLOS'06). However, there are uses where the convenience of running an unmodified OS binary outweighs the performance penalty.
    This project is to evaluate this tradeoff for the OKL4 platform. It will enable the execution of an unmodified Linux binary on the OKL4 hypervisor, and compare the performance with OK Linux (using lmbench and other benchmarks as appropriate).
    This topic i quite open-ended, with in-depth performance analysis and performance tuning, particularly when making use of more recent VT-x features, such as two-level virtual-address translation.
  • 2977: Efficient concurrency control for high-performance microkernels
  • 594 (GH109): BLUEsat OS

I will not take on students who have not shown a convincing performance in COMP3231 ``Operating Systems''. I normally expect students to have done COMP9242 ``Advanced Operating Systems'', although I make exceptions in special cases.

Most topics can lead to publications.

Present topics supervised by Ihor Kuz (official list)


  • 3286: Rearchitecting a component platform for seL4 NEW
  • 3287: Secure terminal on seL4 NEW
    seL4 is a formally verified microkernel for building secure systems. A key element of such systems is secure access to terminal I/O (i.e. the screen, keyboard, and mouse), which means that different applications can get user input and output without worrying that other malicious applications (such as a key logger) can interfere. Nitpicker is a secure display architecture developed at Technical University of Dresden. In this project implement a version of Nitpicker for seL4, and use it as the basis for building a secure windowed terminal. Evaluate the resulting system by analysing its functionality, performance, and security.
  • 3288: seL4 AUTOSAR NEW
    seL4 has been developed to be the basis for building secure systems, however, it can also be used as the basis for safety-critical systems, such as those used in cars. With seL4 in such systems, it becomes possible to provide guarantees about memory isolation properties, which is crucial for safety-critical systems. Besides memory isolation, seL4 also has known timing properties, making it possible to give timing guarantees, which is important for real-time systems such as those found in cars. The goal of this project is to investigate the role that seL4 can play in such systems by implementing the AUTOSAR automotive framework to use seL4 as the underlying OS.
  • 3289: Qubes on seL4 NEW
    Qubes is a new operating system architecture for developing secure desktop systems. It is based on isolation, running each application in a separate virtual machine so that they cannot maliciously interfere with each other. However, Qubes is based on Xen, which is a relatively heavyweight, and unsecure, hypervisor. Qubes would be much better if it ran on, and relied on, seL4 for its isolation. In this project you will implement a version of Qubes on seL4, and evaluate it by running various applications to analyse the security benefits that seL4 provides.
  • 1268: Shared resources in an microkernel-based OS
    One of the key services that an OS provides is a managing access to shared resources. For example, a file system manages access to shared disk space, a network stack manages access to a network device, a window system manages access to the display, etc. In a modular, microkernel-based OS, these shared resources are managed by user-level services. In this project you will investigate ways of modelling such shared resource managers within the CAmkES component framework on L4 and develop a suitable model for building such services in a componentised environment. You will assess the suitability of this model by designing, implementing, and evaluating one or more such services (e.g., a file system, a network stack, etc.).
  • IK10: Click Modular Router on L4

Related topics supervised by Gerwin Klein (official list)


  • GWK01: Formal Model of an ARM Processor in Isabelle/HOL
    Develop a specification of an ARM processor (e.g. Xscale) suitable for use in formal verification of programs. A similar such model for an MMU-less ARM6 core has been developed by Anthony Fox at Cambridge in the HOL4 system. This should be examined for its usability, and for what is missing with respect to a full model of an Xscale processor. If time allows, an instruction-set level simulator should be generated from the model. This project is an integral part of the formal verification of the L4 micro kernel at NICTA. It connects cutting edge OS research with real-world large-scale system verification. You will work with the developers of L4 and Isabelle in an international team of PhD students and researchers in NICTA's ERTOS group.
  • GWK02: Verifying the core of standard C library in Isabelle/HOL
    You will work with a state-of-the-art interactive theorem prover (Isabelle/HOL) to formally verify the functional behaviour of a small number of basic C functions like memcpy, memset, etc. The verification of these functions is at the basis of any undertaking that wants to provide guarantees about programs implemented in C. This project is an integral and important part of the formal verification of the L4 micro kernel at NICTA. You will work with the developers of L4 and Isabelle in an international team of PhD students and researchers in NICTA's ERTOS group.
  • GWK03: Formal Model of L4 IPC and/or Threads in Isabelle/HOL
    Develop a specification of a subsystem of the L4 microkernel in the theorem prover Isabelle/HOL. L4 provides three basic abstractions - address spaces, threads and IPC. An abstract model has been developed for address spaces and the virtual memory subsystem, the aim of this project is to provide a similar model for one or both of the remaining abstractions. In addition, an investigation into high-level properties of this model will be undertaken, together with the development of proofs that the models satisfy these properties. If time allows, the model will be refined towards the L4Ka::Pistachio implementation on ARM. This project is an integral part of the formal verification of the L4 micro kernel at NICTA. It connects cutting edge OS research with real-world large-scale system verification. You will work with the developers of L4 and Isabelle in an international team of PhD students and researchers in NICTA's ERTOS group.

Related topics supervised by Kevin Elphinstone (official list)


  • 2981: Secure microkernel-based web server using Linux instances
    Our research group has developed a formally verified secure microkernel that supports virtualisation. We have a version of Linux that runs on top of this kernel. The goal of this project is to develop a secure web server platform consisting of a instance of Linux running in the DMZ and an instance of Linux running on the trusted network - all actually running on the same machine using the secure microkernel to separate them. This project has the chance to be deployed as a demonstrator for our groups web site.
  • KJE15: A Secure Bootstrapper for the seL4
    The seL4 microkernel is a high assurance microkernel capable of acting as a seperation kernel when it and the encompassing system is instantiated correctly. The goal of this thesis is to develop a simple component model that can specific an initial system state - i.e. the servers and applications that will run on the microkernel. THe component model is then used to generate the boot strapping code to instantiate the system with the specified seperation guarantees. The project may involve evaluating the existing CAMKES framework for the component model, and looking at formal models and guarantees for both the component model, and the generation of the boot strapper.
  • KJE16: Linux as a component.
    NICTA has various versions of Linux that run para-virtualised on various versions of micro-kernels developed here at NICTA. However, the connection between Linux and the platform is rather ad-hoc, which makes is difficult bring Linux into the principled componet framework (CAMKES) developed here at NICTA. This project would involve examining the interface between the micro-kernel and the support infrastructure to allow Linux to be just another component in the CAMKES framework.
  • KJE17: ARTEMIS robotic clarinet player
    NICTA is entering the ARTEMIS intrument playing robot competition. This project involves developing the system software side of the robot, with an eye to making it general enough to use it for future entries. It involves low-level embedded controller programming, Linux kernel programming, and application programming. A familiarity with music is also helpful.

Present topics supervised by Leonid Ryzhyk (official list)

  • 3221: Design and implementation of an algorithm for automatic device driver synthesis NEW
    Device-driver development is a notoriously difficult and error-prone task. An alternative approach to manually writing device drivers is to automatically synthesize them from a formal specification of the device and a specification of the interface between the driver and the OS. In this thesis project you will design, implement, and evaluate an algorithm for automatic driver synthesis. The main challenge involved in this project is dealing with state explosion that occurs when analysing realistic device specifications. In order to overcome this problem you will explore techniques such as compositional synthesis and abstraction refinement. This work will be carried out in close collaboration with other NICTA students and researchers working on driver synthesis.
  • 3222:Modelling of I/O devices for automatic device-driver synthesis
    Device-driver development is a notoriously difficult and error-prone task. An alternative approach to manually writing device drivers is to automatically synthesize them from a formal specification of the device and a specification of the interface between the driver and the OS. In this project you will develop specifications of several I/O devices for use in driver synthesis. Such a specification constitutes a model of device operation written in a high-level hardware description language (HDL) such as SystemVerilog or DML. You will then use these specifications to synthesise working drivers for the selected devices. In the course of this work you will identify limitations in the synthesis tool and will work with other students and researchers on improving the tool and the underlying algorithms.
  • 3071:Reliable Device Driver Framework for Linux
    As part of an effort to put an end to the numerous software failures caused by buggy device drivers, our research group is developing a new device driver architecture for Linux. This architecture eliminates certain types of bugs by design and makes writing correct drivers easier. In addition it facilitates automatic detection of driver bugs by model checking tools. In this project, you will develop Linux kernel components as part of our driver development framework and will implement and one or more drivers using this framework. You will also come up with a formal specification of the interface between the driver and the OS and will use a model checker to verify the your drivers comply with this protocol. The outcome of this work will be published in one of the top OS conferences and will be proposed for inclusion in the Linux kernel.

How to apply:

Contact the relevant supervisor.

Note: We promise a thesis topic to every interested student who has obtained a HD grade in COMP3231/COMP9201 Operating Systems or COMP9242 Advanced Operating Systems. If necessary we will define additional topics to match demand.

We will not turn down any students doing exceptionally well in OS courses. However, this does not mean that an HD in OS or Advanced OS is a prerequisite for doing a thesis with me. Interested students with lower OS marks are welcome to talk to me if they feel they can convince me that they will be able to perform well in an OS thesis.

Keep in mind that these topics are all research issues and generally at the level of Honours Theses. They are not suitable for marginal students or students with a weak understanding of operating systems. We expect you to know your OS before you start.

Past thesis reports and DiSy thesis rules (internal access only)

Postgraduate thesis topics:

Undergraduate thesis topics are also suitable for coursework Master's projects. Same conditions apply: You must have a pretty good track record in OS courses.

Information about research theses