FaVe: Modeling IPv6 firewalls for fast formal verification
- As virtualization drives the automation of networking, the validation of security properties becomes more and more challenging eventually ruling out manual inspections. While formal verification in Software Defined Networks is provided by comprehensive tools with high speed reverification capabilities like NetPlumber for instance, the presence of middlebox functionality like firewalls is not considered. Also, they lack the ability to handle dynamic protocol elements like IPv6 extension header chains. In this work, we provide suitable modeling abstractions to enable both - the inclusion of firewalls and dynamic protocol elements. We exemplarily model the Linux ip6tables/netfilter packet filter and also provide abstractions for an application layer gateway. Finally, we present a prototype of our formal verification system FaVe.
Verfasserangaben: | Claas LorenzORCiD, Sebastian Kiekheben, Bettina SchnorORCiDGND |
---|---|
DOI: | https://doi.org/10.1109/NetSys.2017.7903956 |
Titel des übergeordneten Werks (Englisch): | International Conference on Networked Systems (NetSys) 2017 |
Verlag: | IEEE |
Verlagsort: | New York |
Publikationstyp: | Sonstiges |
Sprache: | Englisch |
Datum der Erstveröffentlichung: | 24.04.2017 |
Erscheinungsjahr: | 2017 |
Datum der Freischaltung: | 18.11.2022 |
Aufsatznummer: | 16836488 |
Seitenanzahl: | 8 |
Organisationseinheiten: | An-Institute / Hasso-Plattner-Institut für Digital Engineering gGmbH |
DDC-Klassifikation: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme |
Peer Review: | Referiert |