Constructing Mid-points for Two party Asynchronous Protocols Petar - PowerPoint PPT Presentation

Constructing Mid-points for Two party Asynchronous Protocols Petar Tsankov, Mohammad Torabi Dashti, David Basin ETH Z¨ urich OPODIS’11 December 16, 2011

Context, motivation, goals Protocols, end-points, mid-points December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 2

Context, motivation, goals Protocols, end-points, mid-points Mid-point End-point End-point Mid-points: relay, redirect, filter communication � December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 2

Context, motivation, goals Protocols, end-points, mid-points Mid-point End-point End-point Mid-points: relay, redirect, filter communication � can enforce a protocol (e.g. stateful firewalls) � December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 2

Context, motivation, goals How to implement a mid-point? Mid-point End-point End-point We need a specification! December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 3

Context, motivation, goals How to implement a mid-point? Mid-point End-point End-point We need a specification! Protocols specifications: specify the end-points’ behavior � do not specify the mid-point’s behavior � December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 3

Context, motivation, goals How to implement a mid-point? Mid-point End-point End-point We need a specification! Protocols specifications: specify the end-points’ behavior � do not specify the mid-point’s behavior � The problem How do we implement a system, when we don’t know what it should do? December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 3

Context, motivation, goals Why mid-point specifications? Mid-points are often incorrectly implemented 1 : QUALITY CONTROL � Checkpoint, netfilter/iptables, ISA Server REJECTED 1 Case study by D. Bidder-Senn, D. Basin, G. Caronni. “Midpoints versus endpoints: From protocols to firewalls” December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 4

Context, motivation, goals Why mid-point specifications? Mid-points are often incorrectly implemented 1 : QUALITY CONTROL � Checkpoint, netfilter/iptables, ISA Server REJECTED Mid-point specifications are useful for: Model-driven development � Code inspection � Model-based testing � 1 Case study by D. Bidder-Senn, D. Basin, G. Caronni. “Midpoints versus endpoints: From protocols to firewalls” December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 4

Context, motivation, goals Why mid-point specifications? Mid-points are often incorrectly implemented 1 : QUALITY CONTROL � Checkpoint, netfilter/iptables, ISA Server REJECTED Mid-point specifications are useful for: Model-driven development � Code inspection � Model-based testing � . . . they are a good starting point to implement a mid-point 1 Case study by D. Bidder-Senn, D. Basin, G. Caronni. “Midpoints versus endpoints: From protocols to firewalls” December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 4

Context, motivation, goals Goal Protocol specification Mid-point specification Communication environment specification December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 5

Context, motivation, goals Goal Protocol specification Mid-point specification Communication environment specification December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 5

Roadmap Context, motivation, goals � Challenges � � The model Framework � � TCP case study Future work � December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 6

Challenges Challenge: Channels fidelity Mid-point Mid-point End-point End-point Time 1 Time 2 December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 7

Challenges Challenge: Channels fidelity Mid-point Mid-point End-point End-point Time 1 Time 2 ❳❳❳❳❳❳❳❳❳❳❳ property lose duplicate reorder channel Reliable no no no Resilient no yes yes Lossy yes no yes December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 7

Challenges Challenge: Non-determinism Under-specification � - allow alternative behaviors 0 0 rcv(syn) snd(synack) snd(rst) 1 1 2 2 3 3 � Abstraction - probabilistic choices December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 8

The model The setting 1 2 C i C o 1 M 2 E E 1 2 C o C i E 1 , E 2 : the end-points � C 1 o , C 1 i , C 2 o , C 2 � i : channels Assumption The end-points and the channels are formally specified We need to compute M December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 9

The model Process algebraic specifications End-points and channels are specified µ CRL � Benefits: General purpose process algebra with mature tool support 1 2 C i C o 1 M 2 E E 1 2 C o C i December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 10

The model Process algebraic specifications End-points and channels are specified µ CRL � Benefits: General purpose process algebra with mature tool support � We can compute the parallel composition of processes Example: P = E 1 � C 1 i � C 1 o P 1 2 C i C o 1 M 2 E E 1 2 C o C i December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 10

The model Process algebraic specifications End-points and channels are specified µ CRL � Benefits: General purpose process algebra with mature tool support We can compute the parallel composition of processes � Example: P = E 1 � C 1 i � C 1 o 2 C o P M 2 E 2 C i December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 10

The model Definition of enforcement Reference model � 1 1 2 2 C i C i C o C o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q Implementation � model M December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q Implementation � P' Q' model M December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q Implementation � P' Q' model M I = P ′ � M � Q ′ December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q Implementation � P' Q' model M I = P ′ � M � Q ′ December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q Implementation � P' Q' model M I = P ′ � M � Q ′ December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q Implementation � P' Q' model M I = P ′ � M � Q ′ December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11

The model Definition of enforcement Reference model � P Q P = E 1 � C 1 i � C 1 o Q = E 2 � C 2 i � C 2 1 1 2 2 C i C i C o C o o 1 1 2 2 E E E E 1 1 2 2 C o C o C i C i R = P � Q Implementation � P' Q' model M I = P ′ � M � Q ′ December 16, 2011 Constructing Mid-points for Two-party Asynchronous Protocols 11