A model checking-based framework for testing security properties of protocols under development

Abstract

It is important to validate the security properties of network protocols. Most validation methods either verify design models or test implementations. These two techniques are usually applied separately. For protocols under development (PUDs), which are under development and have yet to be issued as a final release, the specifications, implementations and even security properties may change. The use of verification or testing alone may not achieve satisfactory results. In this paper, we propose a security property testing framework for PUDs. Following this framework, we use several rounds of iterative validation to address changeful specifications, implementations and security properties. In each round, we combine verification and testing. We employ a model checker to facilitate verification of the design models. Then, we convert the verification results into executable test cases and test the prototype implementations. Developers can modify the specifications, implementations and security properties and subsequently perform another round of validation. Finally, they can obtain a version of the protocol that passes both verification and testing. We apply our method to two PUDs as case studies: the source address validation improvements (SAVI) and the stateful firewall application of software-defined networking (SDN). Our approach can expose vulnerabilities in different development versions. After several rounds of verification, testing and improvement, developers can release high-quality protocols.