Automated verification of security chains in software-defined networks with synaptic

Abstract

Software-defined networks provide new facilities for deploying security mechanisms dynamically. In particular, it is possible to build and adjust security chains to protect the infrastructures, by combining different security functions, such as firewalls, intrusion detection systems and services for preventing data leakage. It is important to ensure that these security chains, in view of their complexity and dynamics, are consistent and do not include security violations. We propose in this paper an automated strategy for supporting the verification of security chains in software-defined networks. It relies on an architecture integrating formal verification methods for checking both the control and data planes of these chains, before their deployment. We describe algorithms for translating specifications of security chains into formal models that can then be verified by Satisfiability Modulo Theories (SMT) solving or model checking. Our solution is prototyped as a package, named Synaptic, built as an extension of the Frenetic family of SDN programming languages. The performances of our approach are evaluated through extensive experimentations based on the CVC4, veriT, and nuXmv checkers.

A Review on the Verification Approaches and Tools used to Verify the Correctness of Security Algorithms and Protocols

“…They used spin tool, SATMC checker tool, NuXmv updated model checker of NuSMV, CBMC checker, Scyther tool and SMT solvers. [15] A method that was designed as a packet of SDN language which makes it easy to be extended for further formal languages to check simple invariants properties…”

“…FOR SECURITY ALGORITHMS Schnepf et al [15] proposed an automated alternative method that can support the verification process of the security in chains at the early stages. The proposed strategy considered control and data planes to be analysed, which contained different security algorithms formed as security functions in chains.…”

“…Those solvers check in specific theory to solve satisfiability problems. Schnepf et al [15] proposed an algorithm that assists to verify the security in chains. The algorithm went through two verification processes; one was model checking and the other one was SMT solvers.…”

“…Model checking Thereoem proving [15] A method that was designed as a packet of SDN language. This make it easy to be extended for further formal languages that can check simple invariants properties…”

A Reo Model of Software Defined Networks

“…In this work model checking is possible via a translation to binary decision diagrams, under a similar assumption to ours: controllers are described as finite state machines. Another relevant work on automated verification is [22]. Our approach however is based on a declarative descriptions of controllers, switches, and network topology as a Reo circuits, whose automatic composition yields a finite automaton.…”