Quantifying and Verifying Reachability for Access Controlled Networks

Abstract

Abstract-Quantifying and querying network reachability is important for security monitoring and auditing as well as many aspects of network management such as troubleshooting, maintenance, and design. Although attempts to model network reachability have been made, feasible solutions to computing network reachability have remained unknown. In this paper, we propose a suite of algorithms for quantifying reachability based on network configurations [mainly Access Control Lists (ACLs)] as well as solutions for querying network reachability. We present a network reachability model that considers connectionless and connection-oriented transport protocols, stateless and stateful routers/ firewalls, static and dynamic NAT, PAT, IP tunneling, etc. We implemented the algorithms in our network reachability tool called Quarnet and conducted experiments on a university network. Experimental results show that the offline computation of reachability matrices takes a few hours, and the online processing of a reachability query takes 0.075 s on average.

A twofold model for the analysis of access control policies in industrial networked systems

“…Unessential details about the traffic control devices such as firewalls, switches and routers, will be omitted in the following, as well as the techniques for computing the reachability of nodes, since the theory, data structures and algorithms presented in [40] fit in well with our framework and have been borrowed consequently. In particular, our model takes into account the same network elements at the basis of the methodology of [40], and we assume that the whole network reachability has already been computed by means of [40], and is available through simple queries.…”

“…In particular, our model takes into account the same network elements at the basis of the methodology of [40], and we assume that the whole network reachability has already been computed by means of [40], and is available through simple queries. This implies that our view of the network is static, that is its connectivity properties are not affected by the actions of players.…”

“…A single rule for a specific device may not include all the elements in the table, and wildcards are also allowed. We will not discuss filtering rules in more details in this paper, since we rely on [40] for the network reachability computation. Such a rule format is general, and contains the union of the fields needed in firewall rules, switch rules, and so on.…”

“…(15) returns a pair consisting of a datalink address dla and a network address na such that na is bound to dla for some physical port of ω ★ . According to the approach presented in [40], we also assume that the network reachability has already been computed and stored in a suitable database that can simply be queried. Thus the general query in Eq.…”

Towards test-driven software defined networking

“…In the last years, various testing techniques have been proposed. Some of them (e.g., [27], [28], [29]) analyze the configuration of traditional networks and are hard to extend to SDN controller verification, e.g., because bound to specific network protocols. Others propose testing frameworks targeted to SDN (e.g., [30], [16]).…”