research-article

Safely and automatically updating in-network ACL configurations with intent language

Authors:

Bingchuan Tian,

Hongqiang Harry Liu,

Chunsheng Wang,

Ben Y. ZhaoAuthors Info & Claims

SIGCOMM '19: Proceedings of the ACM Special Interest Group on Data Communication

Pages 214 - 226

https://doi.org/10.1145/3341302.3342088

Published: 19 August 2019 Publication History

Abstract

In-network Access Control List (ACL) is an important technique in ensuring network-wide connectivity and security. As cloud-scale WANs today constantly evolve in size and complexity, in-network ACL rules are becoming increasingly more complex. This presents a great challenge to the updating process of ACL configurations: network operators are frequently required to update "tangled" ACL rules across thousands of devices to meet diverse business requirements, and even a single ACL misconfiguration may lead to network disruptions. Such increasing challenges call for an automated system to improve the efficiency and correctness of ACL updates. This paper presents Jinjing, a system that aids Alibaba's network operators in automatically and correctly updating ACL configurations in Alibaba's global WAN. Jinjing allows the operators to express in a declarative language, named LAI, their update intent (e.g., ACL migration and traffic control). Then, Jinjing automatically synthesizes ACL update plans that satisfy their intent. At the heart of Jinjing, we develop a set of novel verification and synthesis techniques to rigorously guarantee the correctness of update plans. In Alibaba, our operators have used Jinjing to efficiently update their ACLs and have thus prevented significant service downtime.

Supplementary Material

MP4 File (p214-tian.mp4)

Download
1183.14 MB

References

[1]

Beckett, R., Gupta, A., Mahajan, R., and Walker, D. A general approach to network configuration verification. In ACM SIGCOMM (SIGCOMM) (2017).

Digital Library

[2]

Beckett, R., Gupta, A., Mahajan, R., and Walker, D. Control plane compression. In ACM SIGCOMM (SIGCOMM) (2018).

Digital Library

[3]

Beckett, R., Mahajan, R., Milstein, T. D., Padhye, J., and Walker, D. Don't mind the gap: Bridging network-wide objectives and device-level configurations. In ACM SIGCOMM (SIGCOMM) (2016).

Digital Library

[4]

Beckett, R., Mahajan, R., Milstein, T. D., Padhye, J., and Walker, D. Network configuration synthesis with abstract topologies. In 38th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) (2017).

Digital Library

[5]

Brucker, A. D., Brügger, L., Kearney, P., and Wolff, B. Verified firewall policy transformations for test case generation. In International Conference on Software Testing, Verification and Validation (ICST) (2010).

Digital Library

[6]

Cardwell, N., Cheng, Y., Brakmo, L., Mathis, M., Raghavan, B., Dukkipati, N., Chu, H.-k. J., Terzis, A., and Herbert, T. Packetdrill: scriptable network stack testing, from sockets to packets. In USENIX Annual Technical Conference (ATC) (2013).

Digital Library

[7]

Chen, F., Liu, A. X., Hwang, J., and Xie, T. First step towards automatic correction of firewall policy faults. ACM Transactions on Autonomous and Adaptive Systems (TAAS) 7 (2012).

Digital Library

[8]

Davis, M., Logemann, G., and Loveland, D. A machine program for theorem-proving. Communications of the ACM 5, 7 (1962), 394--397.

Digital Library

[9]

Davis, M., and Putnam, H. A computing procedure for quantification theory. Journal of the ACM (JACM) 7, 3 (1960), 201--215.

Digital Library

[10]

El-Hassany, A., Tsankov, P., Vanbever, L., and Vechev, M. T. Network-wide configuration synthesis. In 29th International Conference on Computer Aided Verification (CAV) (2017).

[11]

El-Hassany, A., Tsankov, P., Vanbever, L., and Vechev, M. T. NetComplete: Practical network-wide configuration synthesis with autocompletion. In 15th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2018).

Digital Library

[12]

Fayaz, S. K., Sharma, T., Fogel, A., Mahajan, R., Millstein, T., Sekar, V., and Varghese, G. Efficient network reachability analysis using a succinct control plane representation. In 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI) (2016).

Digital Library

[13]

Fogel, A., Fung, S., Pedrosa, L., Walraed-Sullivan, M., Govindan, R., Mahajan, R., and Millstein, T. A general approach to network configuration analysis. In 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2015).

Digital Library

[14]

Gember-Jacobson, A., Akella, A., Mahajan, R., and Liu, H. H. Automatically repairing network control planes using an abstract representation. In 26th Symposium on Operating Systems Principles (SOSP) (2017), pp. 359--373.

Digital Library

[15]

Gember-Jacobson, A., Viswanathan, R., Akella, A., and Mahajan, R. Fast control plane analysis using an abstract representation. In ACM SIGCOMM (SIGCOMM) (2016).

Digital Library

[16]

Hajjat, M. Y., Sun, X., Sung, Y. E., Maltz, D. A., Rao, S. G., Sripanidkulchai, K., and Tawarmalani, M. Cloudward bound: Planning for beneficial migration of enterprise applications to the cloud. In ACM SIGCOMM (SIGCOMM) (2010).

Digital Library

[17]

Hallahan, W. T., Zhai, E., and Piskac, R. Automated repair by example for firewalls. In Formal Methods in Computer Aided Design (FMCAD) (2017).

Digital Library

[18]

Horn, A., Kheradmand, A., and Prasad, M. R. Delta-net: Real-time network verification using atoms. In 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (Mar. 2017).

Digital Library

[19]

Hwang, J., Xie, T., Chen, F., and Liu, A. X. Fault localization for firewall policies. In International Symposium on Reliable Distributed Systems (SRDS) (2009).

Digital Library

[20]

Jayaraman, K., Bjørner, N., Outhred, G., and Kaufman, C. Automated analysis and debugging of network connectivity policies. In Technical Report MSR-TR-2014-102 (2014).

[21]

Kazemian, P., Varghese, G., and McKeown, N. Header space analysis: Static checking for networks. In 9th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2012).

Digital Library

[22]

Khurshid, A., Zhou, X., Zhou, W., Caesar, M., and Godfrey, P. B. VeriFlow: Verifying network-wide invariants in real time. In 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2013).

Digital Library

[23]

Liu, A. X. Formal verification of firewall policies. In International Conference on Communications (ICC) (2008).

[24]

Lopes, N. P., Bjørner, N., Godefroid, P., Jayaraman, K., and Varghese, G. Checking beliefs in dynamic networks. In 12th USENIX Symposium on Networked System Design and Implementation (NSDI) (2015).

Digital Library

[25]

Narain, S., Levin, G., Malik, S., and Kaul, V. Declarative infrastructure configuration synthesis and debugging. J. Network Syst. Manage. 16, 3 (2008), 235--258.

Digital Library

[26]

Nelson, T., Ferguson, A. D., Yu, D., Fonseca, R., and Krishnamurthi, S. Exodus: Toward automatic migration of enterprise network configurations to SDNs. In 1st ACM SIGCOMM Symposium on Software Defined Networking Research (SOSR) (2015).

Digital Library

[27]

Panda, A., Argyraki, K., Sagiv, M., Schapira, M., and Shenker, S. New directions for network verification. In LIPIcs-Leibniz International Proceedings in Informatics (2015), vol. 32, Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik.

[28]

Panda, A., Lahav, O., Argyraki, K. J., Sagiv, M., and Shenker, S. Verifying reachability in networks with mutable datapaths. In 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2017).

Digital Library

[29]

Quoitin, B., and Uhlig, S. Modeling the routing of an autonomous system with C-BGP. IEEE Network 19, 6 (2005), 12--19.

Digital Library

[30]

Selman, B., Mitchell, D. G., and Levesque, H. J. Generating hard satisfiability problems. Artificial intelligence 81, 1-2 (1996), 17--29.

Digital Library

[31]

Stoenescu, R., Popovici, M., Negreanu, L., and Raiciu, C. Symnet: Scalable symbolic execution for modern networks. In ACM SIGCOMM (SIGCOMM) (Aug. 2016).

Digital Library

[32]

Sung, Y. E., Rao, S. G., Xie, G. G., and Maltz, D. A. Towards systematic design of enterprise networks. In ACM CoNEXT (CoNEXT) (2008).

Digital Library

[33]

Velner, Y., Alpernas, K., Panda, A., Rabinovich, A., Sagiv, M., Shenker, S., and Shoham, S. Some complexity results for stateful network verification. In 22nd International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS) (2016).

Digital Library

[34]

Wang, A., Jia, L., Zhou, W., Ren, Y., Loo, B. T., Rexford, J., Nigam, V., Scedrov, A., and Talcott, C. L. FSR: formal analysis and implementation toolkit for safe interdomain routing. IEEE/ACM Transactions on Network (ToN) 20, 6 (2012), 1814--1827.

Digital Library

[35]

Yoon, M., Chen, S., and Zhang, Z. Minimizing the maximum firewall rule set in a network with multiple firewalls. IEEE Transactions on Computers 59 (2010).

Digital Library

[36]

Yuan, L., Mai, J., Su, Z., Chen, H., Chuah, C., and Mohapatra, P. Fireman: A toolkit for Firewall modeling and analysis. In IEEE Symposium on Security and Privacy (IEEE S&P) (2006).

Digital Library

[37]

Zaostrovnykh, A., Pirelli, S., Pedrosa, L., Argyraki, K., and Candea, G. A formally verified NAT. In ACM SIGCOMM (SIGCOMM) (2017).

Digital Library

[38]

Zhang, S., Ivancic, F., Lumezanu, C., Yuan, Y., Gupta, A., and Malik, S. An adaptable rule placement for software-defined networks. In 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) (2014).

Digital Library

[39]

Zhang, S., Mahmoud, A., Malik, S., and Narain, S. Verification and synthesis of firewalls using SAT and QBF. In 20th IEEE International Conference on Network Protocols (ICNP) (2012).

Digital Library

Cited By

Xin YJia CLi WRottenstreich OXu YXie GTian ZLi J(2025)A Heterogeneous and Adaptive Architecture for Decision-Tree-Based ACL Engine on FPGAIEEE Transactions on Computers10.1109/TC.2024.347795574:1(263-277)Online publication date: 1-Jan-2025
https://dl.acm.org/doi/10.1109/TC.2024.3477955
Huang YDu HZhang XNiyato DKang JXiong ZWang SHuang T(2025)Large Language Models for Networking: Applications, Enabling Techniques, and ChallengesIEEE Network10.1109/MNET.2024.343575239:1(235-242)Online publication date: Jan-2025
https://doi.org/10.1109/MNET.2024.3435752
Li RYe FYuan YYang RTian BGuo TWu HZhu XGuan ZMa QZeng XXu CCai DZhai EVanbever LZhang I(2024)Reasoning about network traffic load property at production scaleProceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation10.5555/3691825.3691884(1063-1081)Online publication date: 16-Apr-2024
https://dl.acm.org/doi/10.5555/3691825.3691884
Show More Cited By

Index Terms

Safely and automatically updating in-network ACL configurations with intent language
1. Networks
  1. Network properties
    1. Network reliability
  2. Network services
    1. Network management

Recommendations

Enforcing ACL Access Control on Android Platform
Information Security
Abstract
Android is an operating system with Linux kernel running on smartphone. Part of system resources are provided in the form of APIs offered by system service. Access permission to these resources for application is controlled in Android middleware ...
Practical Role-Based Access Control

This article presents access control from a general and a role-based perspective. The article's focus is role based Access Control from a practical vice a theoretical perspective. The article starts with some access control definitions and two secure ...
Access control lists in password capability environments

With reference to a protection system featuring active subjects that attempt to access passive, typed objects, we propose a set of mechanisms supporting the distribution, verification, review and revocation of access privileges. In our approach, a ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

SIGCOMM '19: Proceedings of the ACM Special Interest Group on Data Communication

August 2019

526 pages

ISBN:9781450359566

DOI:10.1145/3341302

General Chairs:
Jianping Wu
Tsinghua University, China
,
Wendy Hall
University of Southampton, UK

Copyright © 2019 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGCOMM: ACM Special Interest Group on Data Communication

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 19 August 2019

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

SIGCOMM '19

Sponsor:

SIGCOMM

SIGCOMM '19: ACM SIGCOMM 2019 Conference

August 19 - 23, 2019

Beijing, China

Acceptance Rates

Overall Acceptance Rate 462 of 3,389 submissions, 14%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

64
Total Citations
View Citations
2,157
Total Downloads

Downloads (Last 12 months)186
Downloads (Last 6 weeks)19

Reflects downloads up to 01 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Xin YJia CLi WRottenstreich OXu YXie GTian ZLi J(2025)A Heterogeneous and Adaptive Architecture for Decision-Tree-Based ACL Engine on FPGAIEEE Transactions on Computers10.1109/TC.2024.347795574:1(263-277)Online publication date: 1-Jan-2025
https://dl.acm.org/doi/10.1109/TC.2024.3477955
Huang YDu HZhang XNiyato DKang JXiong ZWang SHuang T(2025)Large Language Models for Networking: Applications, Enabling Techniques, and ChallengesIEEE Network10.1109/MNET.2024.343575239:1(235-242)Online publication date: Jan-2025
https://doi.org/10.1109/MNET.2024.3435752
Li RYe FYuan YYang RTian BGuo TWu HZhu XGuan ZMa QZeng XXu CCai DZhai EVanbever LZhang I(2024)Reasoning about network traffic load property at production scaleProceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation10.5555/3691825.3691884(1063-1081)Online publication date: 16-Apr-2024
https://dl.acm.org/doi/10.5555/3691825.3691884
Karimi PPirelli SKakarla SBeckett RSegarra SLi BNamyar PArzani B(2024)Towards Safer Heuristics With XPlainProceedings of the 23rd ACM Workshop on Hot Topics in Networks10.1145/3696348.3696884(68-76)Online publication date: 18-Nov-2024
https://dl.acm.org/doi/10.1145/3696348.3696884
Ding WLi JNiu ZChen HXu HSekar VYu MSeneviratne AVeitch D(2024)Poster: Automating Network Configuration with Natural Language IntentsProceedings of the ACM SIGCOMM 2024 Conference: Posters and Demos10.1145/3672202.3673721(19-21)Online publication date: 4-Aug-2024
https://dl.acm.org/doi/10.1145/3672202.3673721
Chen H(2024)Interpretable Network Synthesis via Localized SpecificationsProceedings of the 2024 SIGCOMM Workshop on Formal Methods Aided Network Operation10.1145/3672199.3673889(51-53)Online publication date: 4-Aug-2024
https://dl.acm.org/doi/10.1145/3672199.3673889
Kou TSun HZhuang ZQi QWang JLiao J(2024)Accelerating ACL Configuration Update through Data Plane AnalysisProceedings of the 2024 SIGCOMM Workshop on Formal Methods Aided Network Operation10.1145/3672199.3673888(48-50)Online publication date: 4-Aug-2024
https://dl.acm.org/doi/10.1145/3672199.3673888
Weintraub BKim JTao RNita-Rotaru COkhravi HTian DUjcich BLuo BLiao XXu JKirda ELie D(2024)Exploiting Temporal Vulnerabilities for Unauthorized Access in Intent-based NetworkingProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3670301(3630-3644)Online publication date: 2-Dec-2024
https://dl.acm.org/doi/10.1145/3658644.3670301
Wang CScazzariello MFarshin AFerlin SKostić DChiesa M(2024)NetConfEval: Can LLMs Facilitate Network Configuration?Proceedings of the ACM on Networking10.1145/36562962:CoNEXT2(1-25)Online publication date: 13-Jun-2024
https://dl.acm.org/doi/10.1145/3656296
Li RYuan YYe FLiu MYang RYu YGuo TMa QZeng XXu CCai DZhai ESekar VYu MSeneviratne AVeitch D(2024)A General and Efficient Approach to Verifying Traffic Load Properties under Arbitrary k FailuresProceedings of the ACM SIGCOMM 2024 Conference10.1145/3651890.3672246(228-243)Online publication date: 4-Aug-2024
https://dl.acm.org/doi/10.1145/3651890.3672246
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten