A Verification Method of SDN Firewall Applications

Kang, Miyoung; Choi, Jin Young; Kang, Inhye; Kwak, Hee Hwan; Ahn, So Jin; Shin, Myung Ki

doi:10.1587/transcom.2015ebp3329

Cited by 7 publications

(8 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…VeriSDN [7], [9] is a framework verifying the firewall application from among SDN applications by using pACSR [9], an extension of the algebra of communicating shared resources (ACSR) [19], [20]. It verifies the rule conflicts that occur due to the multiple applications executed within the SDN controller.…”

Section: Related Workmentioning

confidence: 99%

“…We use the simplified rules determining whether to forward a packet with the IP information as in [8], [9], [22]. Rules are applied to each packet sequentially using the example of firewall rules described in [8], [9], [22], which is modified by adding the protocol information to rules, as summarized in Table 2.…”

Section: ) Firewall Policy For An Sdn Controllermentioning

confidence: 99%

“…Formal methods have been suggested to mathematically prove that the application rules are conflict-free. NICE [2], HAS [3], Kuai [4], Veriflow [5], SDNRacer [6], and VeriSDN [7]- [9] have leveraged formal methods to verify the correctness of an SDN network. Our work uses formal methods to verify that there are no rule conflicts in the SDN network in terms of SDN switch rules that correctly implement firewall applications or policies.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Formal Verification of SDN-Based Firewalls by Using TLA+

Kim

Kang

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

Software-defined networking (SDN) has generated increased interest due to the rapid growth in the amount of data generated by the development of the Internet and communications, the commercialization of 5G, and increasingly complex networks. While SDN is more advantageous than traditional networks in terms of efficient network management, rapid deployment, and dynamic scalability, the correctness of a network configuration must be ensured in advance. In other words, SDN components such as network devices, SDN controllers, and applications need to be deployed correctly and must be free of rule conflicts, particularly between various application policies; otherwise, it may result in network paralysis in the worst case. This paper assumes that the SDN network is free of rule conflicts when the rules in the SDN switches correctly obey firewall application or policies. To solve this problem, this paper proposes a verification framework for SDN using TLA+. We show that the firewall rule behavior of switches can be formalized using TLA+, and this is verified with the TLC model checker that uses TLA+ as the model description language. We check two different types of topology models through our verification framework to ensure that the same firewall rules are maintained even if the topology changes. The findings show that the firewall rules may be inconsistent as the topology changes. INDEX TERMS Firewall, formal methods, software-defined networking, TLA+.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: ) Firewall Policy For An Sdn Controllermentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Formal Verification of SDN-Based Firewalls by Using TLA+

Kim

Kang

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…This algorithm underlies the Synoptic 1 tool [9] that can learn Markov models of processes. The Invarimint tool [18] is also based on k-tails but produces simpler, socalled declarative automata, without probabilities on the edges. In the field of statistical automata learning algorithms, there is the approach proposed by Carrasco [19] for inferring grammar of languages by stochastic methods used in [20] for learning inexact automata from logs of behaviors.…”

Section: Related Workmentioning

confidence: 99%

Generation of SDN policies for protecting android environments based on automata learning

Schnepf

Badonnel

Lahmadi

et al. 2018

NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

Software-defined networking offers new opportunities for protecting end users and their applications. In that context, dedicated chains can be built to combine different security functions, such as firewalls, intrusion detection systems and services for preventing data leakage. To configure these security chains, it is important to have an adequate model of the patterns that end user applications exhibit when accessing the network. We propose an automated strategy for learning the networking behavior of end applications using algorithms for generating finite state models. These models can be exploited for inferring SDN policies ensuring that applications respect the observed behavior: such policies can be formally verified and deployed on SDN infrastructures in a dynamic and flexible manner. Our solution is prototypically implemented as a collection of Python scripts that extend our Synaptic verification package. The performance of our strategy is evaluated through extensive experimentations and is compared to the Synoptic and Invarimint automata learning algorithms.

show abstract

“…VeriFlow [18] also proposes support for the realtime verification of OpenFlow rules, but its low level of abstraction may make it cumbersome to verify large security chains. Finally, VeriSDN [19] is another example of control plane verification in the specific case of SDN-based firewalls, although the verification of more sophisticated security functions is considered. In a similar spirit, work by Shaer et al [20] considers anomaly detection in distributed firewalls.…”

Section: Related Workmentioning

confidence: 99%

Automated verification of security chains in software-defined networks with synaptic

Schnepf¹,

Badonnel²,

Lahmadi³

et al. 2017

2017 IEEE Conference on Network Softwarization (NetSoft)

View full text Add to dashboard Cite

Software-defined networks provide new facilities for deploying security mechanisms dynamically. In particular, it is possible to build and adjust security chains to protect the infrastructures, by combining different security functions, such as firewalls, intrusion detection systems and services for preventing data leakage. It is important to ensure that these security chains, in view of their complexity and dynamics, are consistent and do not include security violations. We propose in this paper an automated strategy for supporting the verification of security chains in software-defined networks. It relies on an architecture integrating formal verification methods for checking both the control and data planes of these chains, before their deployment. We describe algorithms for translating specifications of security chains into formal models that can then be verified by Satisfiability Modulo Theories (SMT) solving or model checking. Our solution is prototyped as a package, named Synaptic, built as an extension of the Frenetic family of SDN programming languages. The performances of our approach are evaluated through extensive experimentations based on the CVC4, veriT, and nuXmv checkers.

show abstract

A Verification Method of SDN Firewall Applications

Cited by 7 publications

References 12 publications

Formal Verification of SDN-Based Firewalls by Using TLA+

Formal Verification of SDN-Based Firewalls by Using TLA+

Generation of SDN policies for protecting android environments based on automata learning

Automated verification of security chains in software-defined networks with synaptic

Contact Info

Product

Resources

About