Verifiable Policy-Defined Networking Using Metagraphs

Ranathunga, Dinesha; Roughan, Matthew; Nguyen, Hung

doi:10.1109/tdsc.2020.2974727

Cited by 7 publications

(14 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Reachability between the source and target sets in a metagraph is defined by the existence of (valid) metapaths between the two. Additionally, metapaths have a dominance property which can be used to determine redundant components (edges or elements) [15]. Once identified, those components can be safely removed from the policies.…”

Section: From Graphs To Metagraphsmentioning

confidence: 99%

“…We use its formal foundations to verify whether the actual deployment of a policy (i.e., its implementation) matches its initial specification. We rely on this structure since, by design, it provides means to locate conflicts and avoid redundancy [15]. Metagraphs provide more fine-grained verification process than with other structures like usual graphs.…”

Section: Introductionmentioning

confidence: 99%

“…Policy analysis mainly deals with policy evaluation and anomaly analysis: checking for errors like incorrect policy specifications, conflicts and sub-optimizations affecting either a single policy or a set of policies [3] being the primary research topic. Works in this area use different techniques to achieve this goal, such as model checking [17], [18], binary decision diagrams [19], graph theory [20], Deterministic Finite State Automata (DFSA) [21], First Order Logic (FOL) [22], geometrical models [23], answer set programming [24], petri nets [25] and metagraphs [15]. Policy evaluation instead deals with checking whether a request is satisfied by a set of policies.…”

Section: Introductionmentioning

confidence: 99%

“…Verification is achieved by translating the properties into a boolean satisfiability problem and using a SAT solver, whereas we use metagraphs which come with a useful visual representation of the policies. On the other hand, even though metagraphs have emerged as one of the most suited tool for representing and reasoning about policies, they are still underused with only few existing works in the literature [15], [16], [28]- [30]. Basu and Blanning [16] compiled all the research on metagraphs up until 2007 in a book, which is the reference for general metagraph theory and applications.…”

Section: Introductionmentioning

confidence: 99%

“…They do not verify policy implementations against their specifications. Closer to our contribution, Ranathunga et al [15] use metagraphs to model network policies for distributed firewalls. In particular, they use specific metagraph properties to detect redundancies and conflicts in those policies.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Verification of Cloud Security Policies

Miller

Mérindol

Gallais³

et al. 2021

2021 IEEE 22nd International Conference on High Performance Switching and Routing (HPSR)

View full text Add to dashboard Cite

Companies like Netflix increasingly use the cloud to deploy their business processes. Those processes often involve partnerships with other companies, and can be modeled as workflows where the owner of the data at risk interacts with contractors to realize a sequence of tasks on the data to be secured.In practice, access control is an essential building block to deploy these secured workflows. This component is generally managed by administrators using high-level policies meant to represent the requirements and restrictions put on the workflow. Handling access control with a high-level scheme comes with the benefit of separating the problem of specification, i.e. defining the desired behavior of the system, from the problem of implementation, i.e. enforcing this desired behavior. However, translating such high-level policies into a deployed implementation can be error-prone.Even though semi-automatic and automatic tools have been proposed to assist this translation, policy verification remains highly challenging in practice. In this paper, our aim is to define and propose structures assisting the checking and correction of potential errors introduced on the ground due to a faulty translation or corrupted deployments. In particular, we investigate structures with formal foundations able to naturally model policies. Metagraphs, a generalized graph theoretic structure, fulfill those requirements: their usage enables to compare high-level policies to their implementation. In practice, we consider Rego, a language used by companies like Netflix and Plex for their release process, as a valuable representative of most common policy languages. We propose a suite of tools transforming and checking policies as metagraphs, and use them in a global framework to show how policy verification can be achieved with such structures. Finally, we evaluate the performance of our verification method.

show abstract

Section: From Graphs To Metagraphsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%