Formal Verification of SDN-Based Firewalls by Using TLA+

Abstract

Software-defined networking (SDN) has generated increased interest due to the rapid growth in the amount of data generated by the development of the Internet and communications, the commercialization of 5G, and increasingly complex networks. While SDN is more advantageous than traditional networks in terms of efficient network management, rapid deployment, and dynamic scalability, the correctness of a network configuration must be ensured in advance. In other words, SDN components such as network devices, SDN controllers, and applications need to be deployed correctly and must be free of rule conflicts, particularly between various application policies; otherwise, it may result in network paralysis in the worst case. This paper assumes that the SDN network is free of rule conflicts when the rules in the SDN switches correctly obey firewall application or policies. To solve this problem, this paper proposes a verification framework for SDN using TLA+. We show that the firewall rule behavior of switches can be formalized using TLA+, and this is verified with the TLC model checker that uses TLA+ as the model description language. We check two different types of topology models through our verification framework to ensure that the same firewall rules are maintained even if the topology changes. The findings show that the firewall rules may be inconsistent as the topology changes. INDEX TERMS Firewall, formal methods, software-defined networking, TLA+.

Automated Firewall Configuration in Virtual Networks

“…Formal verification has been introduced in this field by some subsequent articles ( [11], [15], [16], [17], [18]), which underlined the importance of formal correctness assurance for the automatically computed configurations. Formal verification of firewall configurations has recently become a vital requirement for critical environments, as underlined in [6]. All these approaches miss some of the other features characterizing our approach.…”

“…Designing and managing these complex architectures requires automation, because positioning and configuring virtual instances manually can likely lead to incorrect or non-optimal solutions, in addition to taking excessive time. Instead, automation, paired with formal verification techniques (e.g., [5] or [6]), is the key for computing provably correct and optimized solutions rapidly enough.…”

On the Approaches to Cyber-physical Systems Simulation

“…On contrary, deterministic models are significantly more complex and can represent only a single behavior at most [12]. Reasoning in terms of non-deterministic models, it should be noted that model checking technique on the basis of FSM (Finite-state Machine) has already proved itself to be a plausible solution: checking the design solutions for Amazon Web Services [13], implementing the Temporal Logic of Actions (TLA), corresponding TLA+ formalism and TLC (TLA Checker) model checker [14]; specifying and verifying the rules of Firewall (on the basis of TLA) [15]; modeling and developing the fault-tolerant safety-critical modules for a platform for railway control applications up to safety integrity level 4 (on the basis of TLA) [16].…”

A Reo Model of Software Defined Networks

“…In the recent years several formal models of SDN (e.g. [2,15,16]) have been proposed in order to test or check that a network behave correctly.…”

“…It does not support update of flow tables nor routing of multiple packets. TLA+ [18] has also been used to model the behaviour of SDN but in a very restrictive manner, allowing only a single switch [16]. Formal models are used not only to verify properties of an SDN such as consistency of flow tables, violation of safety policies, or forwarding loops, but also for finding flaws in security protocols using CSP and the model checker PAT [24].…”