💻 computer science

CB-VER: A Stable Foundation for Modular Control Plane Verification

This paper introduces \textsc{CB-Ver}, a modular framework that verifies eventually-stable network control plane properties by synthesizing and validating a "converges-before graph" through parallel SMT-based component checks and formal soundness proofs in Lean, while also enabling the automatic generation of component interfaces from desired correctness properties.

Original authors: Dexin Zhang, Timothy Alberdingk Thijm, David Walker, Aarti Gupta

Published 2026-05-21

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Dexin Zhang, Timothy Alberdingk Thijm, David Walker, Aarti Gupta

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, global network of routers (the "brains" of the internet) as a giant, chaotic city where millions of people are constantly shouting directions to each other to find the best way to a specific destination. Sometimes, they shout conflicting directions, or messages get lost, causing traffic jams or people getting stuck in loops.

The paper introduces a new tool called CB-VER (Control Plane Verification) designed to act like a super-smart traffic engineer. Its job is to prove that, no matter how chaotic things get at first, the network will eventually settle down into a calm, stable state where everyone knows the correct path to their destination.

Here is how it works, broken down into simple concepts:

1. The Problem: "Eventually Stable" Truths

In this network city, things are rarely perfect immediately. Routers might be confused for a few seconds. But network operators care about eventually-stable properties. This means: "If we stop changing the rules and let the system run, will everyone eventually agree on a path and stay that way forever?"

Examples of these properties include:

Reachability: "Will everyone eventually be able to reach the hospital?"
Access Control: "Will the VIPs eventually be blocked from entering the restricted zone?"
Path Length: "Will everyone eventually take the shortest route?"

2. The Core Idea: The "Promise" and the "Map"

To verify this without simulating every single second of the network's life (which would take forever), CB-VER uses a clever two-step strategy involving two main concepts: Interfaces and the CB-Graph.

The Interfaces (The "Promises")

Imagine every router is a worker in a factory. Instead of checking every single thing the worker does, the tool asks the user to write down two "promises" (called Interfaces) for each router:

The "Anytime" Promise (I): A loose promise about what routes the router might hold at any moment (even while it's confused).
The "Final" Promise (Q): A stricter promise about what the router will hold once it has settled down.

The tool checks if these promises make sense locally. For example, if Router A promises to send a specific type of package, does Router B's promise guarantee it can handle that package?

The CB-Graph (The "Relay Race Map")

This is the paper's biggest innovation. To prove the network will actually settle down, the tool builds a special map called a CB-Graph (Converges-Before Graph).

Think of this like a relay race:

The Start Line (CB-Roots): Some routers start with the correct route immediately (like the race starter).
The Handoffs (CB-Edges): The tool draws arrows between routers to show that if Router A has the correct route, it can successfully pass the baton to Router B, ensuring Router B also gets the correct route.

If the tool can draw a map where every single router is connected back to the Start Line through these handoffs, it proves that the "correctness" will eventually ripple through the entire network. If the map is broken (some routers are isolated), the network might never stabilize.

3. How the Tool Works (The Process)

User Input: The user provides the network design and the "promises" (Interfaces) for each router.
Local Check: The tool uses a logic engine (an SMT solver) to check if the promises hold up locally. "If I have this, do you get that?"
Map Building: The tool automatically draws the CB-Graph. It asks: "Can we connect everyone to the Start Line using these valid handoffs?"
The Verdict:
- Success: If the map connects everyone, the tool says, "Yes, the network is guaranteed to stabilize with these properties."
- Failure: If the map is broken, the tool says, "No, and here is exactly where the connection failed."

4. Bonus Features: Fault Tolerance and Auto-Design

The paper highlights two extra superpowers of this tool:

Fault Tolerance (The "Break-Proof" Test):
The tool can simulate broken roads (failed connections). It asks, "If we cut 1, 2, or 3 of these handoff arrows, is the map still connected?" If the map stays connected even with broken lines, the network is fault-tolerant. This tells engineers exactly how resilient their system is.
Auto-Synthesis (The "Reverse Engineer"):
Usually, humans have to write the "promises." But CB-VER can also work backward. If you give it a perfect map (a connected CB-Graph), it can use a different logic engine to automatically write the promises for every router. It's like saying, "Here is the perfect race plan; tell me what rules each runner needs to follow to make it happen."

Summary

CB-VER is a verification tool that proves complex computer networks will eventually calm down and work correctly. It does this by:

Asking for simple "promises" from each part of the network.
Automatically drawing a "relay race map" (CB-Graph) to prove that the correct behavior spreads to everyone.
Checking if the network can survive broken connections.
Even being able to write the rules for you if you provide the map.

The authors proved their math is correct using a formal logic system (Lean) and tested it on real-world network examples, showing it works fast and handles large, complex systems better than older methods.

Technical Summary: CB-VER: A Stable Foundation for Modular Control Plane Verification

1. Problem Statement

Network operators manage vast, complex networks where configuration errors in the control plane frequently lead to significant outages. These failures often stem from violations of eventually-stable properties—conditions that, once established at some time $\tau$ , hold forever thereafter provided the environment remains unchanged. Examples include eventual reachability, access control, and path length constraints.

Existing verification tools face limitations:

Monolithic approaches (e.g., Minesweeper) struggle to scale with network size and complex policies.
Modular approaches (e.g., Timepiece, Lightyear) often require synchronous network models, manual path specifications, or fail to support expressive liveness properties and fault tolerance analysis.
There is a lack of tools that can automatically synthesize the necessary abstractions (interfaces) to prove these properties or analyze fault tolerance based on the verification structure.

2. Methodology: Abstract Convergence and CB-Graphs

The authors propose CB-VER, a modular verification framework based on a new theory of abstract convergence. The core methodology involves three main components:

A. Network Model and Semantics

The control plane is modeled as an asynchronous message-passing system where routers exchange routes (messages) using protocols like BGP, OSPF, or RIP. The model uses a multi-sorted first-order theory (encoded in SMT) to represent routes, merge functions (route selection), and transfer functions (policy application). The semantics assume fair schedules where messages are eventually delivered.

B. Modular Interfaces ( $I$ and $Q$ )

To enable modular verification, every network device $v$ is associated with two interfaces:

$I(v)$ (Invariant Interface): An overapproximation of all states (routes) the device can enter at any time during execution.
$Q(v)$ (Convergence Interface): An overapproximation of the eventually-stable states the device converges to.

The verification strategy is two-fold:

Prove that all nodes eventually converge to states within $Q(v)$ .
Prove that every state in $Q(v)$ satisfies the user's correctness property $Y(v)$ (i.e., $Q(v) \implies Y(v)$ ).

C. The Converges-Before (CB) Graph

To prove that the network converges to $Q$ , the framework introduces the CB-graph, a witness for the convergence process.

CB-Roots: Nodes that converge to $Q(v)$ immediately at $t=0$ (e.g., border nodes originating routes).
CB-Edges: Directed edges $(u, v)$ where the transfer of a route from $u \in Q(u)$ to $v$ guarantees that $v$ will select a route in $Q(v)$ , regardless of $v$ 's prior state in $I(v)$ .

Theorem 1: If a CB-graph is connected (every node is reachable from a CB-root via CB-edges) and all local verification conditions hold, then the entire network abstractly converges to $Q$ .

3. Key Contributions

1. The CB-VER Verification Algorithm

CB-VER automates the verification process through the following steps:

Local Verification Conditions (VCs): It generates and checks SMT-based VCs for:
- Invariant Maintenance: Ensuring $I$ is an inductive invariant ( $VC_{Init}$ , $VC_{Inv}$ ).
- Property Implication: Ensuring $Q$ implies the desired property $Y$ ( $VC_{Prop}$ ).
- CB-Graph Construction: Identifying valid CB-roots ( $VC_{CBroot}$ ) and CB-edges ( $VC_{CBedge}$ ).
Parallel Synthesis: The tool synthesizes a maximal CB-graph automatically by checking all nodes and edges in parallel.
Connectivity Check: It performs a graph traversal to verify if the synthesized CB-graph connects all nodes. If connected, the property is verified.

2. Fault Tolerance Analysis

The synthesized CB-graph inherently represents the maximal connectivity for the given interfaces. By analyzing the connectivity of this graph, CB-VER can determine $k$ -fault tolerance: the network remains correct under any combination of $k$ edge failures if the CB-graph remains connected after removing $k$ edges. This is implemented using a variant of Dinitz's algorithm.

3. Automated Interface Synthesis (CB-2IQ)

The paper addresses the "inverted problem": given a desired CB-graph and property $Y$ , can we synthesize the interfaces $I$ and $Q$ ?

The authors formulate this as a Constrained Horn Clause (CHC) problem.
They developed a prototype tool, CB-2IQ, which uses off-the-shelf CHC solvers (e.g., Spacer/Z3) to automatically generate valid interfaces $I$ and $Q$ that satisfy the verification conditions.

4. Formal Soundness

The entire theory, including the network semantics and the correctness of the verification algorithm, is formalized and proven sound in the Lean theorem prover.

4. Evaluation Results

The authors evaluated CB-VER and CB-2IQ on three benchmark sets: synthetic fat-tree networks (20–2000 nodes), the real-world Internet2 network (~300 nodes), and Batfish tutorial networks.

Expressiveness (RQ1): CB-VER successfully verified diverse properties (Reachability, Path Length, Valley-Free, Hijack prevention) across all network sizes and topologies.
Performance (RQ2):
- CB-VER scales effectively, verifying properties on 2000-node fat-tree networks within 20 minutes.
- It significantly outperforms the monolithic verifier (Minesweeper-style), which frequently timed out or ran out of memory on larger instances.
- Performance is generally comparable to the modular verifier Timepiece, with CB-VER showing marginal improvements in complex policy benchmarks (Valley-Free) and slight overhead in simple reachability checks.
Fault Tolerance (RQ3): The tool successfully performed push-button fault tolerance analysis. For example, it determined that a 2000-node fat-tree could tolerate 19 edge failures for reachability, while specific router types in other benchmarks had lower tolerance.
Interface Synthesis: CB-2IQ successfully synthesized interfaces for fat-tree networks. In most cases, it was faster than monolithic verification (up to 27x faster for Reachability), demonstrating that automated synthesis is a viable alternative to manual interface specification.

5. Significance and Claims

The paper claims that CB-VER provides a stable foundation for modular control plane verification by:

Generalizing Modular Verification: It supports asynchronous networks and a broader class of eventually-stable properties than previous modular tools.
Automating the "Witness": Unlike tools requiring manual path specifications, CB-VER automatically synthesizes the CB-graph, which serves as the convergence witness.
Enabling Fault Tolerance: It uniquely links the verification structure (the CB-graph) directly to fault tolerance analysis, allowing engineers to quantify resilience.
Closing the Loop: Through CB-2IQ, it demonstrates that interfaces can be automatically synthesized from a desired convergence structure, reducing the manual burden on network operators.

The authors position this work as a practical advancement that bridges the gap between theoretical convergence proofs and scalable, automated network verification, specifically targeting the "eventually-stable" properties that are critical for network reliability but difficult to verify with existing monolithic or restrictive modular tools.