Abstract:Network managers configure networks to enforce various high-level policies, and to respond to the wide range of network events (e.g., attacks, intrusions, malicious route announcements from neighbors) that may occur. It is incredibly difficult to specify these high-level policies in terms of distributed low-level configuration. These high-level policies hold only if the distributed configurations are well equipped to react to unsafe and unreliable environments (e.g., malicious route announcements, unsafe components and devices). Therefore, it is important to proactively verify whether network policies hold across continually changing environments in terms of current network configurations. State-of-the-art policy verification techniques are limited because they can check only the Boolean policies (e.g., forwarding reachability, waypoint or blackhole-freeness). However, many policy violations express themselves in quantitative ways (e.g., a link becomes overloaded). In this paper, we propose quantitative network verification (QNV) analyzing the quantitative policies of networks across unsafe and unreliable environments. QNV translates network configurations into a symbolic simulation model that captures the stable states to which the network forwarding will converge as a result of interactions between routing protocols. It then generates a logical formula matrix that describes network forwarding in the event of failures and verifies quantitative policies based on the formula matrix. We implement QNV and evaluate it on realistic and synthetic configurations. Our evaluation shows that QNV can precisely verify quantitative policies in only a few minutes, even in large networks.

Tiramisu: Fast and General Network Verification

Modular Control Plane Verification via Temporal Invariants

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Kirigami, the Verifiable Art of Network Cutting

Carbide: Highly Reliable Networks Through Real-Time Multiple Control Plane Composition

Design and FPGA Verification of a Novel Reliable Real-Time Data Transfer System

Beyond a Centralized Verifier: Scaling Data Plane Checking Via Distributed, On-Device Verification.

Abstract interpretation of distributed network control planes

Toward Comprehensive Network Verification: Practices, Challenges and Beyond

Fast Inverse Model Transformation: Algebraic Framework for Fast Data Plane Verification

Verifying Isolation Properties in the Presence of Middleboxes

LIGHTYEAR: Using Modularity to Scale BGP Control Plane Verification

Mahjong: A Generic Framework for Network Data Plane Verification

ProbNV: probabilistic verification of network control planes

Verifying Reachability in Networks with Mutable Datapaths

Mind the Gap: Monitoring the Control-Data Plane Consistency in Software Defined Networks.

Network Can Help Check Itself: Accelerating SMT-based Network Configuration Verification Using Network Domain Knowledge

Proactively Verifying Quantitative Network Policy Across Unsafe and Unreliable Environments

Real Time Control Plane Verification.

TurboNet: Faithfully Emulating Networks with Programmable Switches

Seagull: Privacy preserving network verification system