model checking dynamic datapaths
play

Model Checking Dynamic Datapaths Aurojit Panda, Katerina Argyraki, - PowerPoint PPT Presentation

Oct 27, 2023 •156 likes •585 views

Model Checking Dynamic Datapaths Aurojit Panda, Katerina Argyraki, Scott Shenker UC Berkeley, ICSI, EPFL Networks: Not Just for Delivery Enforce a variety of invariants: Packet Isolation: Packets from A can not reach B Content

  1. Model Checking Dynamic Datapaths Aurojit Panda, Katerina Argyraki, Scott Shenker UC Berkeley, ICSI, EPFL

  2. Networks: Not Just for Delivery • Enforce a variety of invariants: • Packet Isolation: Packets from A can not reach B • Content Isolation: Content X never accessible by A. • Rate Limiting: B limited to M requests per second.

  3. Invariants are Global • Existing work on verifying global invariants • Anteater, HSA, VeriFlow. • Key assumption • Forwarding state dictated by control plane.

  4. Many Datapaths are "Dynamic" • Dynamic : Forwarding State a ff ected by tra ffi c. • Examples • Middle boxes • Learning switches • Loose Source Record Route IP option.

  5. Dynamic Behavior can Violate Invariants 10.0.0.1 > 10.0.1.1 10.0.0.1 10.0.1.1 Firewall deny: 10.0.0.1-> 10.0.1.1 10.0.0.2 10.0.1.2

  6. Dynamic Behavior can Violate Invariants 10.0.0.1 10.0.1.1 Firewall deny: 10.0.0.1-> 10.0.1.1 10.0.0.2 10.0.1.2

  7. Dynamic Behavior can Violate Invariants 10.0.0.1 10.0.1.1 Firewall deny: 10.0.0.1-> 10.0.1.1 10.0.0.2 10.0.1.2

  8. Dynamic Behavior can Violate Invariants 10.0.0.1 > 10.0.1.1 10.0.0.1 10.0.1.1 Proxy Firewall 10.1.0.1 deny: 10.0.0.1-> 10.0.1.1 10.0.0.2 10.0.1.2

  9. Dynamic Behavior can Violate Invariants 10.0.0.1 10.0.1.1 10.1.0.1 > 10.0.1.1 Proxy Firewall 10.1.0.1 deny: 10.0.0.1-> 10.0.1.1 10.0.0.2 10.0.1.2

  10. Another Example 10.0.0.1 > 10.0.1.1 BAD 10.0.0.1 10.0.1.1 Compression IDS Middlebox if BAD send to 10.0.1.2 10.0.0.2 10.0.1.2

  11. Another Example 10.0.0.1 > 10.0.1.1 10.0.0.1 10.0.1.1 gzip(BAD) Compression IDS Middlebox if BAD send to 10.0.1.2 10.0.0.2 10.0.1.2

  12. Another Example 10.0.0.1 > 10.0.1.1 gzip(BAD) 10.0.0.1 10.0.1.1 Compression IDS Middlebox if BAD send to 10.0.1.2 10.0.0.2 10.0.1.2

  13. Why is this a Problem in the Real World? • Networks are complex and enforce many invariants. • Hard for administrators to keep global image in head. • NFV: Easier to make changes that violate invariants. • Goal: • Check invariants for networks with dynamic elements.

  14. Focusing on Middleboxes for this talk.

  15. High-Level Solution • Treat network as a large program. • Middleboxes are functions in this program. • Use model checking to check the network. • Naive implementation intractable • Challenge: • Network → Program so model checking is tractable.

  16. Scaling through Modularity • Three techniques • Middlebox models (what to model?) • Leverage service chaining. • Policy choices that speedup analysis.

  17. Consider a DPI Middlebox Labeled Harmful ... Receive Send Lookup flow packet packet state Labeled Many steps Benign to analyze traffic Real processing pipeline Expensive to combine: Exponential growth

  18. Consider a DPI Middlebox Labeled Harmful ... Receive Send Lookup flow packet packet state Labeled Many steps Benign to analyze traffic Important for Global Properties

  19. The DPI Model in Math For any packet p sent by DPI box d ∀ send ( d, e, p ) ⇒ ∃ e 0 : recv ( e 0 , d, p ) = p was received by d p was marked harmful ∧ ( d.label ( p ) = harmful ∨ d.label ( p ) = benign) or benign ∧ rtime ( d, p ) < stime ( d, p ) also p was received before being sent

  20. Model Globally Significant Behavior • Checking model accuracy? • Verify code against model. • Enforce model.

  21. Simple Models not Enough Firewall Firewall Firewall Firewall Firewall Firewall 10.0.0.1 10.0.0.2 Networks with 25 middleboxes take 32.2 seconds.

  22. • Modeling middleboxes • Leverage service chaining • Policies for scalability

  23. Networks of Middleboxes Load Balancer Web Server Web Server Proxy Network Web Server Web Server IDS Web Server WAN Opt

  24. Networks of Middleboxes Load Balancer Web Server Web Server Proxy Network Web Server Web Server IDS Web Server WAN Opt Also provide annotations on when paths are taken.

  25. Networks of Middleboxes Load Balancer Web Server Web Server Proxy Network Web Server Web Server IDS Web Server WAN Opt Also provide annotations on when paths are taken.

  26. Networks of Middleboxes Load Balancer Web Server Web Server Proxy Network Web Server Web Server IDS Web Server WAN Opt Also provide annotations on when paths are taken.

  27. Service Chaining • Solutions to implement such chaining. • Limits middlebox states to be checked. • Middlebox state depends on past tra ffi c. • Chaining policy de fi nes sources of tra ffi c. • Network path: set of middleboxes traversed.

  28. • Modeling middleboxes • Leverage service chaining • Policies for scalability

  29. How much of the Network to Consider? M0 M4 M8 M12 M1 M5 M9 M13 B M2 M6 M10 M14 M3 M7 M11 M15 A Prove A isolated from B. Network Path is set of Middleboxes Traversed.

  30. How much of the Network to Consider? M0 M4 M8 M12 M1 M5 M9 M13 B M2 M6 M10 M14 M3 M7 M11 M15 A Prove A isolated from B. Network Path is set of Middleboxes Traversed.

  31. How much of the Network to Consider? M0 M4 M8 M12 M1 M5 M9 M13 B M2 M6 M10 M14 M3 M7 M11 M15 A Prove A isolated from B. Network Path is set of Middleboxes Traversed.

  32. Consider Only Network Path • Pro: Scales with path length not size of network • Con: Not generally applicable • Allows scaling to 10000s of nodes. • Trivial test (2 endhosts, 1 fi rewall, no ACLs) • With pruning 0.11 seconds (with 25000 mboxes) • Without pruning 32.2 seconds (with 25 mboxes)

  33. When can we Prune Part of the Network? Application 10.0.0.1 Firewall Application Proxy Web Server 10.0.0.2 Firewall • Path Independence • Model checking behavior: Enables pruning. • Robustness: Network changes remain local

  34. Achieving Path Independence Application 10.0.0.1 Firewall Application Proxy Web Server 10.0.0.2 Firewall • Solution depends on invariant and network.

  35. Achieving Path Independence Application 10.0.0.1 Firewall Application Application Proxy Web Server 10.0.0.2 Firewall Firewall • Solution depends on invariant and network. • Add a fi rewall before the proxy.

  36. Achieving Path Independence Application 10.0.0.1 Firewall Application Proxy Web Server 10.0.0.2 Firewall • Solution depends on invariant and network. • Add a fi rewall before the proxy. • Change proxy to enforce access invariants.

  37. Achieving Path Independence Application 10.0.0.1 Firewall Application Proxy Web Server 10.0.0.2 Firewall • Solution depends on invariant and network. • Add a fi rewall before the proxy. • Change proxy to enforce access invariants. • Can automatically check path independence.

  38. Achieving Path Independence Application 10.0.0.1 Firewall Application Proxy Web Server 10.0.0.2 Firewall • Solution depends on invariant and network. • Add a fi rewall before the proxy. • Change proxy to enforce access invariants. • Can automatically check path independence.

  39. Tools for Checking Invariants • We have implemented a tool with these optimizations. • Leverages Z3, a SMT solver from Microsoft. • Implemented in about 3700 lines of Python code • The models themselves are less than 1500 lines. • Models about 10 di ff erent middlebox kinds. • Much of the space: Expressing math in Python.

  40. Early Results from Tools 10.0.0.1 > 10.1.0.1 IP Router ACL IP Router 10.0.0.1 10.0.1.1 10.1.0.1 Firewall 10.1.0.2 deny: 10.0.0.1-> 10.0.1.1 • Use Loose Source Routing to circumvent fi rewall • Invariant: No packets from 10.0.0.1 to 10.0.1.1 • We can verify this in 0.39 seconds.

  41. Early Results from Tools 10.1.0.1 > 10.0.1.1 IP Router ACL IP Router 10.0.0.1 10.0.1.1 10.1.0.1 Firewall 10.1.0.2 deny: 10.0.0.1-> 10.0.1.1 • Use Loose Source Routing to circumvent fi rewall • Invariant: No packets from 10.0.0.1 to 10.0.1.1 • We can verify this in 0.39 seconds.

  42. Summary • Path independent policies and invariants: • Easy to maintain, easy to check. • Check if policies + invariants are path independent. • Check if those invariants hold. • O ffl ine but quick veri fi cation possible.

Recommend

Dynamic Partial-Order Reduction for Model Checking Software Cormac Flanagan Patrice Godefroid

Dynamic Partial-Order Reduction for Model Checking Software Cormac Flanagan Patrice Godefroid

Dynamic Partial-Order Reduction for Model Checking Software Cormac Flanagan Patrice Godefroid UC Santa Cruz Bell Labs Presented by: Ulrich Mller Model Checking Given a multithreaded program Wed like to check for deadlocks and

462 views • 17 slides
Statistical Statistical Statistical Model Statistical Model Model Checking Model Checking

Statistical Statistical Statistical Model Statistical Model Model Checking Model Checking

Statistical Statistical Statistical Model Statistical Model Model Checking Model Checking Checking Checking for Timed Automata Timed Automata Coll C l C ll b llabora orators: t ors: Peter Bulychev, Alexandre David Axel Legay, Marius

725 views • 59 slides
Hoare Logic and Model Checking Model Checking Lecture 11: Model checking for Computation Tree

Hoare Logic and Model Checking Model Checking Lecture 11: Model checking for Computation Tree

Hoare Logic and Model Checking Model Checking Lecture 11: Model checking for Computation Tree Logic Dominic Mulligan Based on previous slides by Alan Mycroft and Mike Gordon Programming, Logic, and Semantics Group University of Cambridge

402 views • 25 slides
Software Model Checking Software Model Checking via Static and Dynamic via Static and Dynamic

Software Model Checking Software Model Checking via Static and Dynamic via Static and Dynamic

Software Model Checking Software Model Checking via Static and Dynamic via Static and Dynamic Program Analysis Program Analysis Patrice Godefroid Godefroid Patrice Bell Laboratories, Lucent Technologies Bell Laboratories, Lucent

1.05k views • 56 slides
Dynamic Reductions for Model Checking Concurrent Software Alfons Laarman alfons@laarman.com

Dynamic Reductions for Model Checking Concurrent Software Alfons Laarman alfons@laarman.com

Introduction Transactions Dynamic Experiments Conclusion Dynamic Reductions for Model Checking Concurrent Software Alfons Laarman alfons@laarman.com Henning G unther , Ana Sokolova and Georg Weissenbacher Formal Methods in Systems

905 views • 51 slides
Bounded Model Checking bmc Revision: 1.11 1 [BiereCimattiClarkeZhu99] uses SAT for model

Bounded Model Checking bmc Revision: 1.11 1 [BiereCimattiClarkeZhu99] uses SAT for model

Bounded Model Checking bmc Revision: 1.11 1 [BiereCimattiClarkeZhu99] uses SAT for model checking historically not the first symbolic model checking approach scales better than original BDD based techniques mostly incomplete in

521 views • 28 slides
CTL Chapter 6 Part 2 Overview Review CTL Model Checking CTL model Checking algorithms

CTL Chapter 6 Part 2 Overview Review CTL Model Checking CTL model Checking algorithms

CTL Chapter 6 Part 2 Overview Review CTL Model Checking CTL model Checking algorithms for ( U ) Counter Examples and witnesses Symbolic Model Checking (Thursday) Binary Decision Trees

740 views • 40 slides
Hoare Logic and Model Checking Model Checking But perhaps theres a clever way of

Hoare Logic and Model Checking Model Checking But perhaps theres a clever way of

Hoare Logic and Model Checking Model Checking But perhaps theres a clever way of compiling one into the other? Both have very different models of time How do they compare? We have seen two widely used temporal logics Relative

510 views • 10 slides
Hoare Logic and Model Checking 1. You should be able to model simple systems in NuSMV, an LTL

Hoare Logic and Model Checking 1. You should be able to model simple systems in NuSMV, an LTL

Hoare Logic and Model Checking 1. You should be able to model simple systems in NuSMV, an LTL Other interesting books: Model Checking by Clarke, Grumberg, and Peled Principles of Model Checking by Baier and Katoen 3 Course

636 views • 11 slides
CS104 Computer Organization and Design Datapaths CS104 (Hilton): Datapaths [Slides adapted from

CS104 Computer Organization and Design Datapaths CS104 (Hilton): Datapaths [Slides adapted from

CS104 Computer Organization and Design Datapaths CS104 (Hilton): Datapaths [Slides adapted from A. Roths] 1 Admin Homework Homework 4 out tonight Due Monday March 26 th Download/check your submissions Reading: Chapter

1.48k views • 131 slides
Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and

Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and

Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and Extensible Model Checking Framework a Modular and Extensible Model Checking Framework 3rd Estonian Summer School in Computer and System Science

301 views • 8 slides
Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and

Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and

Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and Extensible Model Checking Framework a Modular and Extensible Model Checking Framework 3rd Estonian Summer School in Computer and System Science

777 views • 31 slides
Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and

Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and

Software Model Checking Using Bogor Software Model Checking Using Bogor a Modular and Extensible Model Checking Framework a Modular and Extensible Model Checking Framework 3rd Estonian Summer School in Computer and System Science

628 views • 34 slides
Modeling and Analyzing Concurrent Systems using Model Checking Robert B. France 1 What is

Modeling and Analyzing Concurrent Systems using Model Checking Robert B. France 1 What is

Modeling and Analyzing Concurrent Systems using Model Checking Robert B. France 1 What is Model Checking? Model checking is an automated technique that, given a finite-state model of a system and a logical property , systematically

484 views • 36 slides
Automated Reasoning LTL Model Checking Alan Bundy Automated Reasoning LTL Model Checking

Automated Reasoning LTL Model Checking Alan Bundy Automated Reasoning LTL Model Checking

Automated Reasoning LTL Model Checking Alan Bundy Automated Reasoning LTL Model Checking Lecture 9, page 1 Introduction So far we have looked at theorem proving Powerful, especially where good sets of rewrite rules or decision procedures

639 views • 26 slides
Model Checking: the Interval Way Alberto Molinari ( j.w. with L. Bozzelli, A. Montanari, A. Peron,

Model Checking: the Interval Way Alberto Molinari ( j.w. with L. Bozzelli, A. Montanari, A. Peron,

Model Checking: the Interval Way Alberto Molinari ( j.w. with L. Bozzelli, A. Montanari, A. Peron, P. Sala ) University of Udine Department of Mathematics, Computer Science, and Physics (DMIF) July 27, 2018 MODEL CHECKING Model checking : the

701 views • 38 slides
Hoare Logic and Model Checking Model Checking Lecture 7: Introduction and background Dominic

Hoare Logic and Model Checking Model Checking Lecture 7: Introduction and background Dominic

Hoare Logic and Model Checking Model Checking Lecture 7: Introduction and background Dominic Mulligan Based on previous slides by Alan Mycroft and Mike Gordon Programming, Logic, and Semantics Group, University of Cambridge Academic year

972 views • 41 slides
Hoare Logic and Model Checking Model Checking See NuSMV homepage to download: http://nusmv.fbk.eu/

Hoare Logic and Model Checking Model Checking See NuSMV homepage to download: http://nusmv.fbk.eu/

Hoare Logic and Model Checking Model Checking See NuSMV homepage to download: http://nusmv.fbk.eu/ Was popular in semiconductor industry via Cadence SMV Could handle large models A re-implementation of the SMV model checker: Good

110 views • 10 slides
Probabilisti tic Model Checking in Practi tice Dave Parker Oxford University

Probabilisti tic Model Checking in Practi tice Dave Parker Oxford University

Probabilisti tic Model Checking in Practi tice Dave Parker Oxford University Computing Laboratory Quantitative Model Checking PhD School, Copenhagen, March 2010 Overview Tool support for probabilistic model checking The PRISM

317 views • 14 slides
Hoare Logic and Model Checking Model Checking Lecture 10: Computation Tree Logic (CTL) Dominic

Hoare Logic and Model Checking Model Checking Lecture 10: Computation Tree Logic (CTL) Dominic

Hoare Logic and Model Checking Model Checking Lecture 10: Computation Tree Logic (CTL) Dominic Mulligan Based on previous slides by Alan Mycroft and Mike Gordon Programming, Logic, and Semantics Group University of Cambridge Academic year

1.15k views • 48 slides
Towards efficient model checking for variants of ATL under different semantics Wojciech Penczek

Towards efficient model checking for variants of ATL under different semantics Wojciech Penczek

Specification of Strategic Abilities in ATL* Model checking Multi-Valued ATL* Partial order reductions for sATL* Simpler strategies for Timed ATL Conclusions Towards efficient model checking for variants of ATL under different semantics

1.1k views • 88 slides
Model Checking in Systems Biology s Brim and Milan ska and David Lubo Ce Safr

Model Checking in Systems Biology s Brim and Milan ska and David Lubo Ce Safr

Model Checking in Systems Biology s Brim and Milan ska and David Lubo Ce Safr anek Masaryk University Czech Republic SFM 2013 1/150 Outline Introduction 1 LTL Model Checking 2 Parallel LTL Model Checking 3 Discrete

2.18k views • 199 slides
Infinite State Model-Checking of Propositional Dynamic Logics Stefan G oller and Markus Lohrey

Infinite State Model-Checking of Propositional Dynamic Logics Stefan G oller and Markus Lohrey

Infinite State Model-Checking of Propositional Dynamic Logics Stefan G oller and Markus Lohrey Universit at Stuttgart August 25, 2006 Stefan G oller and Markus Lohrey Universit at Stuttgart Infinite State Model-Checking of

1.35k views • 71 slides
Introduction to Model Checking Radu Mateescu Inria Univ. Grenoble Alpes LIG What is model

Introduction to Model Checking Radu Mateescu Inria Univ. Grenoble Alpes LIG What is model

Introduction to Model Checking Radu Mateescu Inria Univ. Grenoble Alpes LIG What is model checking? Model checking is the method by which a desired behavioral property of a reactive system is verified over a given system (the model )

606 views • 32 slides

More recommend