150 likes | 306 Views
VeriCon : Towards Verifying Controller Programs in SDNs (PLDI 2014). Thomas Ball, Nikolaj Bjorner , Aaron Gember , Shachar Itzhaky , Aleksandr Karbyshev , Mooly Sagiv , Michael Schapira , Asaf Valadarsky. Traditional Computer Networks. Control plane: d istributed algorithms.
E N D
VeriCon: Towards Verifying Controller Programs in SDNs(PLDI 2014) Thomas Ball, NikolajBjorner, Aaron Gember, ShacharItzhaky, AleksandrKarbyshev, MoolySagiv, Michael Schapira,AsafValadarsky
Traditional Computer Networks Control plane: distributed algorithms Data plane: packet streaming
New Paradigm:Software Defined Networking (SDN) logically-centralized control in software smart but slow software API to the data plane (e.g., OpenFlow) dumb but fast hardware switches
Controller: Programmability APP APP APP Controller events from switches topology changes, traffic statistics, arriving packets commands to switches (un)install rules, query statistics
Desired Network Properties • Routing • No forwarding loops, no black holes, … • Security • ACL, firewall, middleboxes, … • Traffic Engineering • Load balancing, VM migration, … • …
Traditional Networks vs. SDN • Guaranteeing these properties in a traditional network is nearly impossible • Switch / Router code is a “black box” • Protocols are distributed across devices. • SDN opens up the possibility of applying formal software verification to networks! • Accessible code • Centralized control
Existing Approaches • Finite-state model checking • E.g., NICE & Verificare • Analyzing network snapshots • E.g., HSA • Run-time checks • E.g., VeriFlow & NetPlumber Might miss bugs! Discover bugs too late & run-timeoverhead
Dream Scenario • Verify network-wide propertiesin compile time • Find violations before they occur! • Provable verification • Prove correctness for correct programs • Find a counterexample for incorrect programs(useful for debugging)
The VeriCon Tool Restrictions on Topology (T) Controller Code (P) Desired Properties Verification Conditions Generator T P “” SAT Solver Proof Counterexample
VeriCon: Challenges and Solutions • Programmer must specify properties in 1st-order logic • We build a tool that infers formulas for SDN programs • Future research: static analysis • SDN programs must be coded in a specific language (CSDN) • VeriCon can be extended to support Java, Python, etc. • SAT solver might not terminate! • SDN programs considered are in a sub-family of FOL • … solver termination guaranteed! • VeriCon assumes atomicity of events • “Existing” solutions • Future research: verify stronger properties
Summary • SDN opens up the possibility for applying formal verification to networks • VeriCon is the first system to provably verify SDN programs at compile time • for unbounded topology, #packets, etc.