In network management, when it comes to security breaches, human error constitutes a dominant factor. We present our tool topoS which automatically synthesizes low-level network configurations from high-level security goals. The automation and a feedback loop help to prevent human errors. Except for a last serialization step, topoS is formally verified with Isabelle HOL, which prevents implementation errors. In a case study, we demonstrate topoS by example. For the first time, the complete transition from high-level security goals to both firewall and SDN configurations is presented.
Header Space Analysis (HSA) @cite_8 , Anteater @cite_13 , and Config -Checker @cite_19 verify several horizontal safety properties on the interface abstraction, such as absence of forwarding loops. By analyzing reachability @cite_16 @cite_21 @cite_13 @cite_19 @cite_8 , horizontal consistency of the interface abstraction with an access control matrix can also be verified. Verification of incremental changes to the interface abstraction can be done in real-time with VeriFlow @cite_28 , which can also prevent installation of violating rules. These models of the interface abstraction have many commonalities: The network boxes in all models are stateless and the network topology is a graph, connecting the entity's interfaces. A function models packet traversal at a network box. These models could be considered as a giant (extended) finite state machine (FSM), where the state of a packet is an (interface @math packet) pair and the network topology and forwarding function represent the state transition function @cite_21 @cite_30 . Anteater @cite_13 differs in that interface information is implicit and packet modification is represented by relations over packet histories.
@cite_30 @cite_8 @cite_28 @cite_21 @cite_19 @cite_16 @cite_13
2138556012 1882012874 2011228372 2271364167
Recent studies show that configurations of network access control is one of the most complex and error prone network management tasks. For this reason, network misconfiguration becomes the main source for network unreachablility and vulnerability problems. In this paper, we present a novel approach that models the global end-to-end behavior of access control configurations of the entire network including routers, IPSec, firewalls, and NAT for unicast and multicast packets. Our model represents the network as a state machine where the packet header and location determines the state. The transitions in this model are determined by packet header information, packet location, and policy semantics for the devices being modeled. We encode the semantics of access control policies with Boolean functions using binary decision diagrams (BDDs). We then use computation tree logic (CTL) and symbolic model checking to investigate all future and past states of this packet in the network and verify network reachability and security requirements. Thus, our contributions in this work is the global encoding for network configurations that allows for general reachability and security property-based verification using CTL model checking. We have implemented our approach in a tool called ConfigChecker. While evaluating ConfigChecker, we modeled and verified network configurations with thousands of devices and millions of configuration rules, thus demonstrating the scalability of this approach. Today's networks typically carry or deploy dozens of protocols and mechanisms simultaneously such as MPLS, NAT, ACLs and route redistribution. Even when individual protocols function correctly, failures can arise from the complex interactions of their aggregate, requiring network administrators to be masters of detail. Our goal is to automatically find an important class of failures, regardless of the protocols running, for both operational and experimental networks. To this end we developed a general and protocol-agnostic framework, called Header Space Analysis (HSA). Our formalism allows us to statically check network specifications and configurations to identify an important class of failures such as Reachability Failures, Forwarding Loops and Traffic Isolation and Leakage problems. In HSA, protocol header fields are not first class entities; instead we look at the entire packet header as a concatenation of bits without any associated meaning. Each packet is a point in the 0,1 L space where L is the maximum length of a packet header, and networking boxes transform packets from one point in the space to another point or set of points (multicast). We created a library of tools, called Hassel, to implement our framework, and used it to analyze a variety of networks and protocols. Hassel was used to analyze the Stanford University backbone network, and found all the forwarding loops in less than 10 minutes, and verified reachability constraints between two subnets in 13 seconds. It also found a large and complex loop in an experimental loose source routing protocol in 4 minutes. In this paper, a unified analytical framework is established to study the stability, throughput, and delay performance of homogeneous buffered IEEE 802.11 networks with Distributed Coordination Function (DCF). Two steady-state operating points are characterized using the limiting probability of successful transmission of Head-of-Line (HOL) packets p given that the network is in unsaturated or saturated conditions. The analysis shows that a buffered IEEE 802.11 DCF network operates at the desired stable point p=pL if it is unsaturated. pL does not vary with backoff parameters, and a stable throughput can be always achieved at pL. If the network becomes saturated, in contrast, it operates at the undesired stable point p=pA, and a stable throughput can be achieved at pA if and only if the backoff parameters are properly selected. The stable regions of the backoff factor q and the initial backoff window size W are derived, and illustrated in cases of the basic access mechanism and the request-to-send clear-to-send (RTS CTS) mechanism. It is shown that the stable regions are significantly enlarged with the RTS CTS mechanism, indicating that networks in the RTS CTS mode are much more robust. Nevertheless, the delay analysis further reveals that lower access delay is incurred in the basic access mode for unsaturated networks. If the network becomes saturated, the delay performance deteriorates regardless of which mode is chosen. Both the first and the second moments of access delay at pA are sensitive to the backoff parameters, and shown to be effectively reduced by enlarging the initial backoff window size W. In this work we study local checkability of network properties like s-t reachability, or whether the network is acyclic or contains a cycle. A structural property S of a graph G is locally checkable, if there is a prover-and-verifier pair (P, V) as follows. The prover P assigns a label to each node in graphs satisfying S. The verifier V is a constant time distributed algorithm that returns Yes at all nodes if G satisfies S and was labeled by P, and No for at least one node if G does not satisfy S, regardless of the node labels. The quality of (P, V) is measured in terms of the label size. We obtain (asymptotically) tight bounds for the bit complexity of the latter two problems for undirected as well as directed networks, where in the directed case we consider one-way and two-way communication, i.e., we distinguish whether communication is possible only in the edge direction or not. For the one-way case we obtain a new asymptotically tight lower bound for the bit complexity of s-t reachability. For the two-way case we devise an emulation technique that allows us to transfer a previously known s-t reachability upper bound without asymptotic loss in the bit complexity.