A formal approach for network security policy validation

Fulvio Valenza1, 2
+, Tao Su1, Serena Spinoso1, Antonio Lioy1, Riccardo Sisto1, and Marco Vallini1


1Politecnico di Torino, Dip. di Automatica e Informatica, Torino, Italy

2CNR-IEIIT, c.so Duca degli Abruzzi 24, Torino I-10129, Italy




Network security is a crucial aspect for administrators due to increasing network size and number of functions and controls (e.g. firewall, DPI, parental control). Errors in configuring security controls may result in serious security breaches and vulnerabilities (e.g. blocking legitimate traffic or permitting unwanted traffic) that must be absolutely detected and addressed. This work proposes a novel approach for validating network policy enforcement, by checking the network status and configuration, and detection of the possible causes in case of misconfiguration or software attacks. Our contribution exploits formal methods to model and validate the packet processing and forwarding behaviour of security controls, and to validate the trustworthiness of the controls by using remote attestation. A prototype implementation of this approach is proposed to validate different scenarios.

Keywords: network security policy, policy conflict analysis, policy validation, remote attestation.


+: Corresponding author: Fulvio Valenza
Politecnico di Torino, Dip. di Automatica e Informatica, Corso Duca degli Abruzzi, 24, 10129 Torino , Tel: +39-(0)11-090-7192


Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications (JoWUA)
Vol. 8, No. 1, pp. 79-100, March 2017 [pdf]