Abstractions for model checking SDN controllers

Sethi, Divjyot; Narayana, Srinivas; Malik, Sharad

doi:10.1109/fmcad.2013.6679403

Cited by 38 publications

(31 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On the other hand, if the network administrator wants to determine the set of policies violated by the external domain, she executes AudIt with the minisatprover option and could take up to 1.5s. These measures are lower than the values reported on [20], for the same Fat Tree topology composed of 20 switches, 16 hosts, and 48 links. We test forwarding and reachability on a Intel i5 at 3.0 GHz, with 3.74 GB RAM.…”

Section: Experiments and Resultscontrasting

confidence: 69%

“…Test cases are divided into two groups: information gathering, and violation inferencing. We run the controller on a server and deploy a test-network using mininet 2 , which operate as external domain and implement the example topology used by Sethi in [20]. From another terminal, which operates as owner domain, we run our AudIt interface and extract traffic information from the controller.…”

Section: Experiments and Resultsmentioning

confidence: 99%

“…Figure 7 shows two evaluations over the same topology and set of policies. We implement the same FatTree topology also described in [20] to compare our approach. AudIt takes less than a second using the minisat solver, which only finds if an instance accomplishes the set of policies.…”

Section: Experiments and Resultsmentioning

confidence: 99%

See 2 more Smart Citations

Checking Multi-domain Policies in SDN

Maldonado-Lopez

Calle

Donoso

2016

INT J COMPUT COMMUN

View full text Add to dashboard Cite

Programmable Network like SDN allows administrators to program network infrastructure according to service demand and custom-defined policies. Network policies are interpreted by the centralized controller to define actions and rules to process the network traffic on devices that belong to a single domain. However, actual networks are multi-domain where several domains are interconnected. Then, because SDN controllers in a domain cannot define nor monitor policies in other domains, network administrators cannot ensure that their own policies, origin policies are being enforced by the domains not directly managed by them (i.e. foreign domains). We present AudiT, a multi-domain SDN policy verifier that identifies whether an origin policy is enforced by foreign domains. AudiT comprises (1) model for network topology, policies, and flows, (2) an Audit protocol to gather information about the actions performed by network devices to carry the flows of interest, and (3) a validation engine that takes that information and detects security policy violations, and (4) an extension to the OpenFlow protocol to enable external auditing. This paper presents our approach and illustrates its application using an example considering multiple SDN networks.

show abstract

Section: Experiments and Resultscontrasting

confidence: 69%

Section: Experiments and Resultsmentioning

confidence: 99%

See 1 more Smart Citation

Checking Multi-domain Policies in SDN

Maldonado-Lopez

Calle

Donoso

2016

INT J COMPUT COMMUN

View full text Add to dashboard Cite

show abstract

“…Each connection between ports represents a bidirectional communication channel that may reorder packets. 11 message cm1 = add(r1) 12 message cm2 = add(r2) 13 message cm3 = add(r3) 14 for sw in [sw1, sw2]: 15 send_message(cm1, sw) 16 send_message(cm2, sw) 17 send_message(cm3, sw) Listing 1: Controller for SSH Moreover, the switches are connected to a controller through dedicated links. Packets are routed in the network using flow tables in switches.…”

Section: Introductionmentioning

confidence: 99%

Kuai: A model checker for software-defined networks

Majumdar

Tetali

Wang

2014

2014 Formal Methods in Computer-Aided Design (FMCAD)

View full text Add to dashboard Cite

In software-defined networking (SDN), a software controller manages a distributed collection of switches by installing and uninstalling packet-forwarding rules in the switches. SDNs allow flexible implementations for expressive and sophisticated network management policies.We consider the problem of verifying that an SDN satisfies a given safety property. We describe Kuai, a distributed enumerative model checker for SDNs. Kuai takes as input a controller implementation written in Murphi, a description of the network topology (switches and connections), and a safety property, and performs a distributed enumerative reachability analysis on a cluster of machines. Kuai uses a set of partial order reduction techniques specific to the SDN domain that help reduce the state space dramatically. In addition, Kuai performs an automatic abstraction to handle unboundedly many packets traversing the network at a given time and unboundedly many control messages between the controller and the switches.We demonstrate the scalability and coverage of Kuai on standard SDN benchmarks. We show that our set of partial order reduction techniques significantly reduces the state spaces of these benchmarks by many orders of magnitude. In addition, Kuai exploits large-scale distribution to quickly search the reduced state space.

show abstract

“…Sethi et al [36] present dataand network-state abstractions for model checking SDN controllers. Their approach extends verification to an arbitrarily number of packets by considering only one concrete packet for the verification task.…”

Section: Related Workmentioning

confidence: 99%

Systematically testing OpenFlow controller applications

et al. 2015

View full text Add to dashboard Cite

The emergence of OpenFlow-capable switches enables exciting new network functionality, at the risk of programming errors that make communication less reliable. The centralized programming model, where a single controller program manages the network, seems to reduce the likelihood of bugs. However, the system is inherently distributed and asynchronous, with events happening at different switches and end hosts, and inevitable delays affecting communication with the controller. In this paper, we present efficient, systematic techniques for testing unmodified controller programs. Our NICE tool applies model checking to explore the state space of the entire system-the controller, the switches, and the hosts. Scalability is the main challenge, given the diversity of data packets, the large system state, and the many possible event orderings. To address this, we propose a novel way to augment model checking with symbolic execution of event handlers (to identify representative packets that exercise code paths on the controller). We also present a simplified OpenFlow switch model (to reduce the state space), and effective strategies for generating event interleavings likely to uncover bugs. Our prototype tests Python applications on the popular NOX platform. In testing three real applications-a MAC-learning switch, in-network server load balancing, and energy-efficient traffic engineering-we uncover thirteen bugs.

show abstract

Abstractions for model checking SDN controllers

Cited by 38 publications

References 8 publications

Checking Multi-domain Policies in SDN

Checking Multi-domain Policies in SDN

Kuai: A model checker for software-defined networks

Systematically testing OpenFlow controller applications

Contact Info

Product

Resources

About