Model checking invariant security properties in OpenFlow

Son, Sooel; Shin, Seungwon; Yegneswaran, Vinod; Porras, Phillip; Gu, Guofei

doi:10.1109/icc.2013.6654813

Cited by 129 publications

(74 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Also, Qazi et al [84] present a policy security monitoring layer for efficient middlebox-specific traffic steering. Another work that goes in this direction is proposed by Son et al [85].…”

Section: Securitymentioning

confidence: 95%

Resilience support in software-defined networking: A survey

et al. 2015

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is an architecture for computer networking that provides a clear separation between network control functions and forwarding operations. The abstractions supported by this architecture are intended to simplify the implementation of several tasks that are critical to network operation, such as routing and network management. Computer networks have an increasingly important societal role, requiring them to be resilient to a range of challenges. Previously, research into network resilience has focused on the mitigation of several types of challenges, such as natural disasters and attacks. Capitalising on its benefits, including increased programmability and a clearer separation of concerns, significant attention has recently focused on the development of resilience mechanisms that use software-defined networking approaches. In this article, we present a survey that provides a structured overview of the resilience support that currently exists in this important area. We categorize the most recent research on this topic with respect to a number of resilience disciplines. Additionally, we discuss the lessons learned from this investigation, highlight the main challenges faced by SDNs moving forward, and outline the research trends in terms of solutions to mitigate these challenges . 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 This article presents a survey on the support for network resilience in SoftwareDefined Networking (SDN). This has been the subject of intense investigation by the academic and industrial community in the past few years, as evidenced by the number of papers included in our survey (159 references in total). Capitalizing on the benefits of SDN, including increased programmability and a clearer separation of concerns, significant attention has recently focused on the development of resilience mechanisms that use software-defined networking approaches. Thus, a wide range of solutions to classical network problems have been revisited using this architecture, but many problems continue to be challenging.Our survey investigates the resilience support that currently exists in this important area, and categorizes the most recent research on this topic with respect to a number of resilience disciplines. Additionally, we discuss the lessons learned from this investigation, highlight the main challenges faced by SDNs moving forward, and outline the research trends in terms of solutions to mitigate these challenges. The aim of the survey is to offer to the reader a structured view of network resilience in the SDN spectrum, and how resilience aspects are supported in these architectures.We believe that this subject material is closely aligned with the objectives of the journal. Please be assured that:1. This paper has not been published or accepted for publication w...

show abstract

“…Also, Qazi et al [84] present a policy security monitoring layer for efficient middlebox-specific traffic steering. Another work that goes in this direction is proposed by Son et al [85].…”

Section: Securitymentioning

confidence: 95%

Resilience support in software-defined networking: A survey

et al. 2015

View full text Add to dashboard Cite

show abstract

“…These solutions provide tools that generally translate a data plane configuration to a model, upon which different techniques are used to prove that it satisfies a set of properties related to a given network policy. Examples of this approach include (MAI et al, 2011), (SON et al, 2013, (LOPES et al, 2015), and (LOPES et al, 2016). Different types of properties can be proved depending on the verification tool.…”

Section: Data Plane Verificationmentioning

confidence: 99%

“…Model checking is the process of modeling the system and its properties, and checking if the properties are valid in all states of the model. Thus, the advantage of symbolic execution over model-checking is performance: symbolic engines use SMT solvers to make path reachability decisions only, while modelchecking based approaches encode both network models and their properties into the solvers (e.g., as in (SON et al, 2013;LOPES et al, 2016)). However, symbolic execution faces the path explosion problem, arising from the exponential nature of traversing all paths of an execution tree.…”

Section: Symbolic Executionmentioning

confidence: 99%

“…It acts by assuring that the program meets the properties stated by its requirements. Several approaches have been developed in order to check if a given data plane satisfies a set of intended properties (SON et al, 2013;DOBRESCU;ARGYRAKI, 2014;LOPES et al, 2015;PANDA et al, 2017). However, the ones that are able to model P4 programs cannot reason about program-specific properties.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Uncovering Bugs in P4 Programs with Assertion-based Verification

Freire

Neves

Leal

et al. 2018

Proceedings of the Symposium on SDN Research

View full text Add to dashboard Cite

“…More closely related works to these specific aspects are discussed in the context of the corresponding chapters, where the contributions and technical details of this thesis are presented. [113] Flow rules checker Use prefix tree( an ordered tree data structure) FLOVER [114] Flow rules checker Utilise the satisfiability modulo theories Assertion [115] SDN application debugger…”

Section: Security Of the Southbound Interfacementioning

confidence: 99%

Security in software defined networks

Alharbi¹

View full text Add to dashboard Cite

Software Defined Networking (SDN) is an emerging computer network paradigm and represents one of the most promising technologies to simplify network management and configuration through increased network programmability and abstraction. In contrast to traditional networks, in SDN, the control plane, which makes decisions on how to forward traffic, is separated from the data plane, which transmits traffic to selected destinations. That makes network control (via the SDN controller) more programmable, dynamic and centralised. With the higher level of abstraction that SDN provides, network administrators can more easily configure network services and manage traffic flows without having to configure a large number of individual network devices (switches and routers). The great potential of SDN has led to significant deployments in data centres, wide area networks, etc., and it is growing at a rapid pace.Security is a critical aspect of networking in general and is particularly vital in SDN. Due to its fundamentally new architecture, SDN presents new potential security vulnerabilities and risks. Security in SDN has not received much attention yet, given that it is very distinct and unique.The goal of this PhD was to address this gap and analyse the security of the SDN infrastructure, identify vulnerabilities and weaknesses, and propose corresponding solutions and improvements. The focus was on the fundamental aspects and components of SDN, in particular the building blocks of the control plane components include Topology Discovery, Address Resolution Protocol (ARP) Handling and Virtualisation Layer. Finally, the thesis thoroughly explored and investigated the most common and effective attacks against the SDN architecture.

show abstract

Model checking invariant security properties in OpenFlow

Cited by 129 publications

References 6 publications

Resilience support in software-defined networking: A survey

Resilience support in software-defined networking: A survey

Uncovering Bugs in P4 Programs with Assertion-based Verification

Security in software defined networks

Contact Info

Product

Resources

About