FlowChecker: Configuration analysis and verification of federated OpenFlow infrastructures

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2010, Pages 37-44

  Al Shaer, Ehab ^a   Al Haj, Saeed ^a  

^a University of North Carolina at Charlotte   (United States)

Author keywords

access control; automated analysis; binary decision diagrams; configuration verification; openflow

Indexed keywords

AUTOMATED ANALYSIS; BINARY DECISION; CONFIGURATION ANALYSIS; CONFIGURATION VERIFICATION; CONNECTED NETWORKS; MISCONFIGURATIONS; MODEL CHECKER; MULTIPLE USER; OPENFLOW; REAL NETWORKS; WRITING RULES;

ACCESS CONTROL; MODEL CHECKING; SECURITY SYSTEMS; TIME SWITCHES;

BINARY DECISION DIAGRAMS;

EID: 78650109005     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1866898.1866905     Document Type: Conference Paper

References (20)

1. E. Al-Shaer and H. Hamed. Firewall policy advisor for anomaly detection and rule editing. In IEEE/IFIP Integrated Management (IM'2003), March 2003. Best Paper Award.
2. E. Al-Shaer, H. Hamed, R. Boutaba, and M. Hasan. Conflict classification and analysis of distributed firewall policies. IEEE Journal on Selected Areas in Communications (JSAC), 23(10), October 2005. Nominated for Best JSAC Paper Award for year 2005.
3. E. Al-Shaer, W. Marrero, and A. El-Atawy. Network configuration in a box: Towards end-to-end verification of network reachability and security. In IEEE International Conference of Network Protocols (ICNP'2009), Oct. 2009.
4. E. S. Al-shaer and H. H. Hamed. Discovery of policy anomalies in distributed firewalls. In In IEEE INFOCOM '04, pages 2605-2616, 2004.
5. R. Alimi, Y. Wang, and Y. R. Yang. Shadow configuration as a network management primitive. SIGCOMM Comput. Commun. Rev., 38(4):111-122, 2008.
6. R. Bryant. Graph-based algorithms for Boolean function manipulation. IEEE Transactions on Computers, C-35(8):677-691, August 1986.
7. 20 states and beyond. Journal of Information and Computation, 98(2):1-33, June 1992.
8. R. Bush and T. G. Griffin. Integrity for virtual private routed networks. In IEEE INFOCOM 2003, volume 2, pages 1467-1476, 2003.
9. E. A. Emerson. Temporal and modal logic. In J. van Leeuwen, editor, Handbook of Theoretical Computer Science, volume B, chapter 16, pages 995-1072. MIT Press, 1990.
10. N. Feamster and H. Balakrishnan. Detecting BGP configuration faults with static analysis. In NSDI, 2005.
11. th IEEE Int. Conference on Distributed Computing Systems (ICDCS'04), March 2004.
12. T. G. Griffin and G. Wilfong. On the correctness of IBGP configuration. In SIGCOMM '02: Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, pages 17-29, New York, NY, USA, 2002. ACM.
13. N. Gude, T. Koponen, J. Pettit, B. Pfaff, M. Casado, N. McKeown, and S. Shenker. Nox: towards an operating system for networks. SIGCOMM Comput. Commun. Rev., 38(3):105-110, 2008.
14. H. Hamed, E. Al-Shaer, and W. Marrero. Modeling and verification of ipsec and vpn security policies. In ICNP '05: Proceedings of the 13TH IEEE International Conference on Network Protocols, pages 259-278, 2005.
15. J. Lind-Nielsen. The BuDDy OBDD package. http://www.bdd-portal.org/buddy. html.
16. R. Mahajan, D. Wetherall, and T. Anderson. Understanding BGP misconfiguration. In SIGCOMM '02: Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, pages 3-16, New York, NY, USA, 2002. ACM.
17. N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner. Openflow: enabling innovation in campus networks. SIGCOMM Comput. Commun. Rev., 38(2):69-74, 2008.
18. R. Sherwood, G. Gibb, K.-K. Yap, G. Appenzeller, M. Casado, N. McKeown, and G. Parulkar. Flowvisor: A network virtualization layer. Technical Report OpenFlow Technical Report 2009-1, Deutsche Telekom Inc. R&D Lab, Stanford University, Nicira Networks, October 2009.
19. G. Xie, J. Z. D. Maltz, H. Zhang, A. G. G. Hjalmtysson, and J. Rexford. On static reachability analysis of ip networks. In IEEE INFOCOM 2005, volume 3, pages 2170- 2183, 2005.
20. L. Yuan, J. Mai, Z. Su, H. Chen, C. Chuah, and P. Mohapatra. FIREMAN: A toolkit for firewall modeling and analysis. In IEEE Symposium on Security and Privacy (SSP'06), May 2006.