Reasoning About Active Network Protocols Samrat Bhattacharjee Kenneth L. Calvert Ellen W. Zegura.
-
Upload
lynette-summers -
Category
Documents
-
view
216 -
download
0
Transcript of Reasoning About Active Network Protocols Samrat Bhattacharjee Kenneth L. Calvert Ellen W. Zegura.
Reasoning About Active Network Protocols
Samrat Bhattacharjee
Kenneth L. Calvert
Ellen W. Zegura
Objective
To present a model that supports reasoning about the correctness of the underlying active network platform the injected algorithm
independent of the injected program
Overview
Problem definition and the relationship between the reasoning methods and the network API
Slot based programming model Example of an underlying program Example of an injected program
Network model
Nodes Channels Active node behavior
fixed part variable part
Problem statement
To reason about the global behavior based on fixed part of each node’s behavior certain constraints on the injected program
Flexibility of the interface should not be lost
Slot based programming model
SlotsBinding to slotsRaising the slot
Form of the Underlying Program Form of the Injected Program
Form of the Underlying Program
Uniform for every node Union of two programs
N and DS Interface between Underlying program and the Injected
program Raising of slots ( v.state = slot.i.raise ) Termination of a slot ( v.state = slot.i.complete ) Resource accounting
• injected program statements can execute only if ( v.rt.i.usage < v.rt.i.bound )• if ( v.rt.usage = v.rt.i.bound ) DS sets v.state = slot.i.complete• v.Progress.i indicates that slot processing does not deadlock
Form of the Underlying Program …
Receptive programvariables partitioned into classes : C, R, W, Xvariables read by injected program don’t change ( while
the slot is raised ) injected program increments v.rt.i.usage ( till it reaches
v.rt.i.bound ) slots terminate only when their resources are exhausted every slot eventually terminates
(compatible with the interface expected by, and is ready to accept injected programs)
Form of the Injected Program Injected program is Acceptable if
all variables named in both N and J are in R or W no variable in R can be modified in J
Modify program statements (during injection) in J, to increment v.rt.i.usage in DS, to check for slot termination Inj (N, J) – parallel composition of N DS and J
Properties of Injection Inj (N, J) is Receptive P holds in Inj ( Inj (N, J), I ) if and only if P holds in Inj (N, I J) default slot behavior and program modifications do not affect the
parallel composition
Properties of Injection …
Pure predicates Global Safety property Global Progress property
Underlying Program
endpoint v.outC, v.inC ErrProc, NullProc v.state = {idle, slot.i.raise, slot.i.complete, newPkt,
routePkt, routeFound} v.RouteTable(d)
Program Node
Initialization If channel is non-empty
read message
initialize usage counter
Raise message arrival event Route message to proper channel Raise routing done event Send message on proper channel and update counters
Program Node
Program DS
Initialization Set SlotCondition if slot is raised and resource is
available Increase resource usage if no other program active Terminate slot processing if resource bound is
exceeded
Program DS
Local Node Properties ( Node DS )
NP0 – Message processing at any node is bounded NP1 – All messages in the channel are processed
by the Node NP2 – Messages are routed to the correct next hop
Global Node Properties
GP0 – All messages are eventually delivered to their destination
Local Node Properties ( Node DS )
NP0 – v.idle v.idle NP1 – m i.inC[j] at(m,i) NP2 – at(m,v) & D(m) > 0 m v.outC[j]
Global Node Properties
GP0 – at(m,i) at(m,node(m,d)
Injected Program
Identity of Home node for each mobile resource is known at all nodes
State variables in the node indicate the (un)availability of the resource
Each node stores last known location (v.rLoc) and timestamp (v.rLC)
Each resource carries last hop (res.loc) and timestamp (res.ts)
Mobile resource leaves a trail using the Update message Access message follows the trail Access messages are stored in v.rQ
Transitions for Node State
Program - Mobility
Resource r is initially located at r.home; this is known to all other nodes
Re-direct accesses containing stale information Update local clock and forwarding information if message
contains newer information Resource arrives at node v; Deliver all queued messages Resource arrived from other node; Increment clock, send
message to last known location Resource migrated back to node v from node v; Increment clock Access to migrating resource; Queue access, and redirect
current message to NullProc New update; v.rStable detects empty v.rQ Forward queued messages to new location till queue is empty
Program - Mobility
Composing Mobility with Node Safety property specified for writing into v.Msg
Stable v.Msg.type Access & v.Msg = m From Stable, GP0 we get GP1
GP1 at(m,i) & m.type Access at(m, node(m.d))
Properties of Inj(Node, Mobility) Resource timestamp and logical clocks at each node can only
increase Unstable periods at each node are finite Each time the resource arrives at a node, the node's logical clock
is increased Periods at which a node is in migration state are always finite.
Global properties of Node Mobility GP1 at(m,v) & m.type = Access at(m,m.d) or
{ i :: at(m,i) & i.Cur } or { j :: atq(m,j) or j.rLC > m.ts }
Access message always finds the resource, new update or is delivered to its destination
at(m,v) & m.type = Access at(m,m.d) or { i :: at(m,i) & i.Cur } or
{ j :: atq(m,j) or j.rLC > m.ts } or { v :: v.SlotCondition.0 }
Properties of Mobility are preserved unless resource bounds are violated
Conclusion
The middle of the road approach seems to be a correct approach to reason about global behavior
Will it be easy to reason about the correctness in a more complex model?
The behavior of the network during the dissemination of the injected code in the network needs to be analyzed