Verified compilation of abstract network policies

Abstract

Configuring large networks can be very complex. A network administrator typically has a set of high-level policies in mind when creating a network configuration, but implementing the configuration onto existing hardware often requires specifying many low-level details. As a result, configuring a network is currently a very error-prone process, and misconfigurations resulting in network outages and security vulnerabilities occur frequently in practice. We present a formally verified compiler from high-level network policies to low-level executable routing rules, to simplify the process of correctly conguring networks and enforcing network policies.