Applying Formal Methods to Networking: Theory, Techniques and Applications

Despite its great importance, modern network infrastructure is remarkable for the lack of rigor in its engineering. The Internet which began as a research experiment was never designed to handle the users and applications it hosts today. The lack of formalization of the Internet architecture meant limited abstractions and modularity, especially for the control and management planes, thus requiring for every new need a new protocol built from scratch. This led to an unwieldy ossified Internet architecture resistant to any attempts at formal verification, and an Internet culture where expediency and pragmatism are favored over formal correctness. Fortunately, recent work in the space of clean slate Internet design---especially, the software defined networking (SDN) paradigm---offers the Internet community another chance to develop the right kind of architecture and abstractions. This has also led to a great resurgence in interest of applying formal methods to specification, verification, and synthesis of networking protocols and applications. In this paper, we present a self-contained tutorial of the formidable amount of work that has been done in formal methods, and present a survey of its applications to networking.Comment: 30 pages, submitted to IEEE Communications Surveys and Tutorial

Routing-Verification-as-a-Service (RVaaS): Trustworthy Routing Despite Insecure Providers

Computer networks today typically do not provide any mechanisms to the users to learn, in a reliable manner, which paths have (and have not) been taken by their packets. Rather, it seems inevitable that as soon as a packet leaves the network card, the user is forced to trust the network provider to forward the packets as expected or agreed upon. This can be undesirable, especially in the light of today's trend toward more programmable networks: after a successful cyber attack on the network management system or Software-Defined Network (SDN) control plane, an adversary in principle has complete control over the network. This paper presents a low-cost and efficient solution to detect misbehaviors and ensure trustworthy routing over untrusted or insecure providers, in particular providers whose management system or control plane has been compromised (e.g., using a cyber attack). We propose Routing-Verification-as-a-Service (RVaaS): RVaaS offers clients a flexible interface to query information relevant to their traffic, while respecting the autonomy of the network provider. RVaaS leverages key features of OpenFlow-based SDNs to combine (passive and active) configuration monitoring, logical data plane verification and actual in-band tests, in a novel manner

Verificare: a platform for composable verification with application to SDN-Enabled systems

Software-Defined Networking (SDN) has become increasing prevalent in both the academic and industrial communities. A new class of system built on SDNs, which we refer to as SDN-Enabled, provide programmatic interfaces between the SDN controller and the larger distributed system. Existing tools for SDN verification and analysis are insufficiently expressive to capture this composition of a network and a larger distributed system. Generic verification systems are an infeasible solution, due to their monolithic approach to modeling and rapid state-space explosion. In this thesis we present a new compositional approach to system modeling and verification that is particularly appropriate for SDN-Enabled systems. Compositional models may have sub-components (such as switches and end-hosts) modified, added, or removed with only minimal, isolated changes. Furthermore, invariants may be defined over the composed system that restrict its behavior, allowing assumptions to be added or removed and for components to be abstracted away into the service guarantee that they provide (such as guaranteed packet arrival). Finally, compositional modeling can minimize the size of the state space to be verified by taking advantage of known model structure. We also present the Verificare platform, a tool chain for building compositional models in our modeling language and automatically compiling them to multiple off-the-shelf verification tools. The compiler outputs a minimal, calculus-oblivious formalism, which is accessed by plugins via a translation API. This enables a wide variety of requirements to be verified. As new tools become available, the translator can easily be extended with plugins to support them

A software defined networking architecture for secure routing

Tese de mestrado, Segurança Informática, Universidade de Lisboa, Faculdade de Ciências, 2014O tamanho e aceitação que a internet ganhou veio ajudar à inovação e a partilha entre utilizadores, mas em contrapartida aumentou o risco de tanto a infraestrutura da internet como as pessoas que a utilizam serem alvos de ciber-ataques. Esta é apenas uma visão parcial do problema, pois para suportar a crescente utilização da internet a infraestrutura cresceu sem a maturação de vários protocols e algoritmos que executam alguns dos serviços mais básicos com que convivemos todos os dias na internet. Um dos melhores exemplos ´e o do Border Gateway Protocol, um protocolo de troca de informação de roteamento que está em uso há mais de 20 anos mas possui vários problemas de segurança conhecidos. O desenho inicial do protocolo, aliado à ineficiência das redes tradicionais impediram a adoção das várias adições de segurança já propostas para o protocolo. O protocolo não possui atualizações de segurança que o protejam contra os vários tipos de ataques já descobertos, como prefix hijacking, intercepção e ataques no plano de dados. Estes ataques podem ter consequências graves durante períodos de tempo não negligenciáveis, como reportado em [33, 19]. As propostas já existentes, como o S-BGP[27], soBGP[48] e Origin Authentication[12], apesar de eficazes na proteção contra um ou mais ataques contra o BGP, não foram adoptadas na prática devido aos seus elevados requisitos computacionais ou de implementação. Neste trabalho resumimos os problemas para adopcão de soluções de segurança em três pontos principais: 1. Algumas soluções requerem poder computacional ou capacidade de memória que nem todos os dispositivos de rede que correm BGP em funcionamento conseguem suportar; 2. A solução requer alterações ao protocolo BGP em funcionamento; 3. A solução não garante benefícios de segurança imediatos ao AS que a adoptar; A investigação actual tem chegado à conclusão que muitos dos problemas das redes tradicionais surgem devido `a necessidade de os dispositivos de rede participarem em protocolos complexos para executar funções de rede que vão além do seu objetivo: encaminhar pacotes [24]. Como consequência, as redes tornaram-se bastante complexas e portanto difíceis de gerir e escalar. A falta de segurança radica também neste problema. Em alternativa às redes tradicionais, a comunidade científica e a indústria têm vindo a adoptar um novo tipo de redes, as Software Defined Networks (SDN). Estas redes sepathe datapathram o plano de controlo do plano de dados, passando toda a lógica e estado de rede para um controlador logicamente centralizado, mantendo nos dispositivos de rede apenas a tarefa de encaminhar pacotes. Os controladores SDN implementam funções de rede através de aplicações que executam no próprio ambiente do controlador em vez de obrigar os dispositivos de rede a implementarem esses protocolos. Um desses controladores é o OpenDaylight, que tem o apoio de alguns dos maiores nomes da indústria como a Cisco, IBM, HP e Juniper, e espera-se ser a principal referência no futuro. Neste trabalho propomos duas aplicações SDNs para o controlador OpenDaylight: RFProxy e BGPSec. O RFProxy é um dos três componentes base da aplicação Route- Flow, uma plataforma de servic¸os de roteamento para SDN. O RFProxy é o único componente da aplicação a executar no controlador e é responsável por gerir e configurar os switches de acordo com as decisões tomadas pelo RFServer. Esta aplicação vem aumentar o número de opções para a utilização do RouteFlow e proporciona uma plataforma de roteamento avançada e eficiente para o OpenDaylight. A aplicação BGPSec tem como objetivo garantir proteção contra ataques de prefix hijacking, onde um atacante tenta redireccionar todo o tráfego destinado a um AS para si. Esta proteção é conseguida através da validação dos dados recebidos do BGP. Ao utilizar uma aplicação para a validação dos anúncios BGP em vez de obrigar os dispositivos de rede a executarem este processamento, o desenho e implementação tornam-se mais simples e permitem um maior conjunto de opções quando comparado com as implementações necessárias em redes tradicionais. A utilização de uma aplicação SDN para este efeito é algo inovador e traz vantagens quando comparada com as redes tradicionais. Em particular, o ambiente SDN permite mitigar os dois primeiros problemas de adopção de uma extensão de segurança, ao passar o processamento para o controlador e a não requerer uma alteração protocolo BGP. As contribuições principais deste trabalho podem ser resumidas da seguinte forma: 1. Implementação e avaliação de um serviço avançado de roteamento em ambiente SDN, nomeadamente ao controlador OpenDaylight; 2. Análise dos problemas de segurança do BGP e das extensões de segurança já propostas para redes tradicionais; 3. Desenho, implementação e avaliação de uma aplicação de segurança para o BGP baseada em SDN;The Internet has evolved from a small group of interconnected computers to an infrastructure that supports billions of devices including computers, smartphones, etc, all with increasing demands in terms of network requirements. The architecture of traditional networks hinders their capability of fulfilling these demands, mainly due to the tight coupling of the data and control planes. Network devices are required to handle and participate in complex distributed protocols to perform network tasks such as routing, making networks very complex and thus affecting their scalability, performance, management and innovation ease. The Border Gateway Protocol, the de facto protocol for routing between Autonomous Systems (ASes) is one of the fundamental protocols for the operation of the internet. However, it was created in a time where the internet was composed of fewer ASes that trusted each other and in the information they provided, which is now unsafe to assume. The internet growth also resulted in an increase in the attacks against the internet routing infrastructure, and several misbehaviors have been detected, either due to attacks against the protocol or misconfiguration. Although several solutions have been presented to solve the security issues of BGP, no proposal has yet been adopted due to three main reasons:_ The solution requires either a computational power or memory size that not all currently deployed BGP speakers will be able to withstand; _ The solution incurs changes to the BGP protocol currently in use; _ The solution does not bring immediate security benefits for the adopting AS; Software-Defined Networking (SDN) is an emerging network paradigm that aims to solve the problems of traditional networks by decoupling the data and control planes, moving the latter to a logically centralized controller while making network devices execute solely the former. All network tasks and applications run on top of the controller, which abstracts the network and greatly simplifies the development and testing of new applications and protocols. Forwarding rules are installed and removed using OpenFlow, a vendor-independent communications protocol for SDNs. Several SDN controllers have been developed by different companies and researchers, several of them open-source. One of such kind is the OpenDaylight (ODL) controller, supported by some of the top names in the IT industry (e.g. Cisco, IBM, HP). The goal of ODL is to create a controller of reference and help accelerate SDN evolution and adoption. Although the controller is the core component of a SDN, network logic is performed by an application running on top of it. An example is RouteFlow, a routing platform that provides flexible and scalabe IP routing services to a SDN. Routing decisions are made by creating a virtual network that mimics the topology of the physical infrastructure and by analyzing the routing tables of the virtual devices. RouteFlow is composed by three components: RFClient, RFServer and RFProxy, with the latter running in the controller. The first contribution of this work is the implementation and evaluation of the RFProxy module for the OpenDaylight controller. An SDN architecture provides a new environment to improve BGP security through the creation of an application to run on top of the controller. Such approach mitigates the first two adoption problems mentioned above by offloading the additional processing to the controller and by not requiring changes to the BGP protocol. The other contribution of this work is the study and analysis of the BGP security problems and traditional solutions, and how to address them in a SDN environment. We implemented and evaluated BGPSec, a security application for the OpenDaylight controller that provides the network with protection against prefix hijacking attacks, where a malicious AS tries to direct the traffic destined to an AS onto itself

DyNetKAT: An Algebra of Dynamic Networks

We introduce a formal language for specifying dynamic updates for Software Defined Networks. Our language builds upon Network Kleene Algebra with Tests (NetKAT) and adds constructs for synchronisations and multi-packet behaviour to capture the interaction between the control- and data-plane in dynamic updates. We provide a sound and ground-complete axiomatisation of our language. We exploit the equational theory to provide an efficient reasoning method about safety properties for dynamic networks. We implement our equational theory in DyNetiKAT -- a tool prototype, based on the Maude Rewriting Logic and the NetKAT tool, and apply it to a case study. We show that we can analyse the case study for networks with hundreds of switches using our initial tool prototype

Secure Diagnostics And Forensics With Network Provenance

In large-scale networks, many things can go wrong: routers can be misconfigured, programs can be buggy, and computers can be compromised by an attacker. As a result, there is a constant need to perform network diagnostics and forensics. In this dissertation, we leverage the concept of provenance to build better support for diagnostic and forensic tasks. At a high level, provenance tracks causality between network states and events, and produces a detailed explanation of any event of interest, which makes it a good starting point for investigating network problems. However, in order to use provenance for network diagnostics and forensics, several challenges need to be addressed. First, existing provenance systems cannot provide security properties on high-speed network traffic, because the cryptographic operations would cause enormous overhead when the data rates are high. To address this challenge, we design secure packet provenance, a system that comes with a novel lightweight security protocol, to maintain secure provenance with low overhead. Second, in large-scale distributed systems, the provenance of a network event can be quite complex, so it is still challenging to identify the problem root cause from the complex provenance. To address this challenge, we design differential provenance, which can identify a symptom event’s root cause by reasoning about the differences between its provenance and the provenance of a similar “reference” event. Third, provenance can only explain why a current network state came into existence, but by itself, it does not reason about changes to the network state to fix a problem. To provide operators with more diagnostic support, we design causal networks – a generalization of network provenance – to reason about network repairs that can avoid undesirable side effects in the network. Causal networks can encode multiple diagnostic goals in the same data structure, and, therefore, generate repairs that satisfy multiple constraints simultaneously. We have applied these techniques to Software-Defined Networks, Hadoop MapReduce, as well as the Internet’s data plane. Our evaluation with real-world traffic traces and network topologies shows that our systems can run with reasonable overhead, and that they can accurately identify root causes of practical problems and generate repairs without causing collateral damage

Merlin: A Language for Provisioning Network Resources

This paper presents Merlin, a new framework for managing resources in software-defined networks. With Merlin, administrators express high-level policies using programs in a declarative language. The language includes logical predicates to identify sets of packets, regular expressions to encode forwarding paths, and arithmetic formulas to specify bandwidth constraints. The Merlin compiler uses a combination of advanced techniques to translate these policies into code that can be executed on network elements including a constraint solver that allocates bandwidth using parameterizable heuristics. To facilitate dynamic adaptation, Merlin provides mechanisms for delegating control of sub-policies and for verifying that modifications made to sub-policies do not violate global constraints. Experiments demonstrate the expressiveness and scalability of Merlin on real-world topologies and applications. Overall, Merlin simplifies network administration by providing high-level abstractions for specifying network policies and scalable infrastructure for enforcing them