A Model Checking Based Approach for Detecting SDN Races

Abstract

The paper is devoted to the verification of Software Defined Networking (SDN) components and their compositions. We focus on the interaction between three basic entities, an application, a controller, and a switch. When the application submits a request to the controller, containing a set of rules to configure, these rules are expected to be 'pushed' and correctly applied by the switch of interest. However, this is not always the case, and one of the reasons is the presence of races or concurrency issues in SDN components and related interfaces. We propose a model checking based approach for deriving test sequences that can identify SDN races. The test generation strategy is based on model checking, and related formal verification is performed with the use of extended automata specifying the behavior of the components of interest; Linear Temporal Logic (LTL) formulas are utilized to express the properties to check. We generalize the races of interest and propose an approach for deriving the corresponding LTL formulas that are later used for verifiation. The Spin model checker is used for that purpose and thus, Promela specifications for interacting components are also provided; those are: the ONOS REST API, the ONOS controller and an OpenFlow Switch. An experimental evaluation with the aforementioned components showcases the existence of race conditions in their compositions.

Toward Automated Attack Discovery in SDN Controllers Through Formal Verification

“…SVHunter [56] targets D2C2 vulnerabilities (data dependency creation and chaining) exploitable by attackers. SDN-fuzzer [57] detects storage vulnerabilities in NMDA-based controllers; and Evgenii Vinarskii et al [58] have proposed a modeling approach for identifying concurrency issues (i.e., races) in controllers. Due to the distinct nature of these studies, they were not included in our direct comparison.…”

“…The formal methods have also been integrated into SDN security practices, with formal verification techniques being extensively applied in the SDN control plane. Canini et al [21] examined NOX controller applications using symbolic execution, while Vinarskii et al [58] and Lu et al [62] explored the concurrency races problems between components in SDN network. While these studies focused on specific controller types, our work delves into universal issues arising from common design principles in the SDN paradigm.…”

On the Modeling of Sequential Reactive Systems by Means of Real Time Automata

“…Может случиться так (см. [15]), что контроллер ПКС при получении входного временного слова ( 1 , 1 ), ( 2 , 2 ), где 1 < 2 , выдаёт входное временное слово ( 2 , 1 ), ( 1 , 2 ), где 2 < 1 , т.е. второе правило будет установлено раньше первого.…”

On the Modeling of Sequential Reactive Systems by Means of Real Time Automata

“…Может случиться так (см. [15] которое удовлетворяет свойству безопасности . Данный пример показывает, что операционная семантика TFSM, которая определена в терминах преобразования временных слов, мало пригодна для эффективного решения на ее основе задачи верификации свойств безопасности вычислений TFSM.…”

“…Эти команды доставляются коммутаторам по каналам сети с некоторой задержкой, и поэтому порядок выполнения команд, вносящих изменения в таблицы коммутации, может отличаться от того порядка, в котором они были сформированы контроллером ПКС. Возможна такая ситуация, описанная в [15], когда контроллер получает пару запросов 1 и 2 на добавление новых правил от коммутаторов сети 1 и 2 в моменты времени 1 и 2 соответственно, где 1 < 2 . В ответ на каждый из этих запросов контроллер формирует команду добавления в таблицы коммутации новых правил, и эта команда может быть доставлена коммутатору и выполнена им с некоторой задержкой .…”