Network configuration in a box: Towards end-to-end verification of network reachability and security

Proceedings - International Conference on Network Protocols, ICNP

Volumn , Issue , 2009, Pages 123-132

  Al Shaer, Ehab ^a   Marrero, Will ^b   El Atawy, Adel ^b   ElBadawi, Khalid ^b  

^a University of North Carolina at Charlotte   (United States)

^b DEPAUL UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS CONTROL POLICIES; COMPUTATION TREE LOGIC; CONFIGURATION RULES; CTL MODEL-CHECKING; ERROR-PRONE NETWORK; MANAGEMENT TASKS; MISCONFIGURATIONS; MULTICAST PACKET; NETWORK ACCESS CONTROL; NETWORK CONFIGURATION; NETWORK REACHABILITY; PACKET HEADER; REACHABILITY; SECURITY PROPERTIES; SECURITY REQUIREMENTS; STATE MACHINE; SYMBOLIC MODEL CHECKING; UNICAST;

ACCESS CONTROL; BINARY DECISION DIAGRAMS; BOOLEAN FUNCTIONS; INTERNET; MODEL CHECKING; NETWORK MANAGEMENT; NETWORK PROTOCOLS; ROUTERS; SECURITY SYSTEMS; SEMANTICS;

NETWORK SECURITY;

EID: 71949086200     PISSN: 10921648     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICNP.2009.5339690     Document Type: Conference Paper

References (20)

1. Configchecker. http://www.arc.cdm.depaul.edu/projects/ConfigChecker.
2. E. Al-Shaer, A. El-Atawy, and T. Samak. Automated pseudo-live testing of firewall configuration enforcement. Selected Areas in Communications, IEEE Journal on, 27(3):302-314, 2009.
3. E. Al-Shaer and H. Hamed. Discovery of policy anomalies in distributed firewalls. In Proceedings of IEEE INFOCOM'04, March 2004.
4. E. Al-Shaer, H. Hamed, R. Boutaba, and M. Hasan. Conflict classification and analysis of distributed firewall policies. IEEE Journal on Selected Areas in Communications (JSAC), 23(10), October 2005. Nominated for Best JSAC Paper Award for year 2005.
5. Richard Alimi, Ye Wang, and Y. Richard Yang. Shadow configuration as a network management primitive. In SIGCOMM '08: Proceedings of the ACM SIGCOMM 2008 conference on Data communication, pages 111-122, New York, NY, USA, 2008. ACM.
6. R. Bryant. Graph-based algorithms for Boolean function manipulation. IEEE Transactions on Computers, C-35(8):677-691, August 1986.
7. 20 states and beyond. Journal of Information and Computation, 98(2):1-33, June 1992.
8. R. Bush and T. Griffin. Integrity for virtual private routed networks. In IEEE INFOCOM 2003, volume 2, pages 1467-1476, 2003.
9. E. Allen Emerson. Temporal and modal logic. In Jan van Leeuwen, editor, Handbook of Theoretical Computer Science, volume B, chapter 16, pages 995-1072. MIT Press, 1990.
10. N. Feamster and H. Balakrishnan. Detecting BGP configuration faults with static analysis. In NSDI, 2005.
11. th IEEE Int. Conference on Distributed Computing Systems (ICDCS'04), March 2004.
12. Timothy G. Griffin and Gordon Wilfong. On the correctness of IBGP configuration. In SIGCOMM '02: Proceedings of the ACM SIGCOMM 2002 conference on Data communication, pages 17-29, 2002.
13. Hazem Hamed, Ehab Al-Shaer and Will Marrero. Modeling and verification of IPSec and VPN security policies. In IEEE International Conference of Network Protocols (ICNP'2005), Nov. 2005.
14. Kirill Levchenko, Geoffrey M. Voelker, Ramamohan Paturi, and Stefan Savage. XL: An efficient network routing algorithm. In SIGCOMM '08: Proceedings of the ACM SIGCOMM 2008 conference on Data communication, pages 15-26, New York, NY, USA, 2008. ACM.
15. J. Lind-Nielsen. The BuDDy OBDD package. http://www.bdd-portal.org/buddy. html.
16. Ratul Mahajan, David Wetherall, and Tom Anderson. Understanding BGP misconfiguration. In SIGCOMM '02: Proceedings of the ACM SIGCOMM 2002 conference on Data communications.
17. S. Narain. Network configuration management via model finding. In LISA, pages 155-168, 2005.
18. G. G. Xie, J. Zhan, D.A. Maltz, H. Zhang, A. Greenberg, G. Hjalmtysson, and J. Rexford. On static reachability analysis of ip networks. In IEEE INFOCOM 2005, volume 3, pages 2170-2183, 2005.
19. Y. Yang, C. U. Martel, and S. F. Wu. On building the minimum number of tunnels: An ordered-split approach to manage ipsec/vpn tunnels. In In 9th IEEE/IFIP Network Operation and Management Symposium (NOMS2004), pages 277-290, May 2004.
20. L. Yuan, J. Mai, Z. Su, H Chen, C. Chuah, and P. Mohapatra. FIREMAN: A toolkit for firewall modeling and analysis. In IEEE Symposium on Security and Privacy (SSP'06), May 2006.