TowardsaDeclarativeLanguageandSystemforSecure.pptVIP

Towards a Declarative Language and System for Secure Networking Martín Abadi1,2, Boon Thau Loo3 Motivation Designing secure network protocols is hard Imperative languages makes process tedious and error-prone Explore the use of declarative languages for secure networking: “Ask for what you want, not how to implement it” Success of database research 70’s – today: Database research has revolutionized data management Approach Examine two classes of declarative languages: Database query language for declarative networking Logic-based access control languages in distributed systems Contribution: Compare these two classes of languages Propose a unifying declarative language and system Why might this be useful? Intellectually interesting to compare two languages Single declarative language and system Ease of management Many useful examples: authenticated routing protocols, secure overlays, DNSSEC, trust management in shared testbeds, P2P information sharing, etc. Fine-grained control over interaction between security and network protocol Potential for cross-layer analysis and optimizations Distributed query engines to process security policies Outline Background: Declarative networking Access control related languages Introduction to Datalog Network Datalog and Binder languages Secure Network Datalog Language design Examples Future Directions Declarative Networking A declarative framework for networks: Declarative specifications of networks, compiled to distributed dataflows Distributed query engine to execute distributed dataflows to implement protocols Observation: Recursive queries are a natural fit for routing Network Datalog (NDlog) language A Declarative Network Declarative Networking Declarative Routing [SIGCOMM ’05]: Extensible Routers (balance of flexibility, efficiency and safety). Textbook routing protocols (3-8 lines) Declarative Overlays [SOSP ’05]: Rapid prototyping of new overlay networks Chord DHT overlay routing (47 lines) Narada Mesh (16 lines) Dat