{"id":"https://openalex.org/W4416549252","doi":"https://doi.org/10.1145/3719027.3765104","title":"Protocols to Code: Formal Verification of a Secure Next-Generation Internet Router","display_name":"Protocols to Code: Formal Verification of a Secure Next-Generation Internet Router","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549252","doi":"https://doi.org/10.1145/3719027.3765104"},"language":"en","primary_location":{"id":"doi:10.1145/3719027.3765104","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765104","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765104","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765104","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5103031260","display_name":"Jo\u00e3o C. Pereira","orcid":"https://orcid.org/0000-0003-4671-4132"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Jo\u00e3o Pereira","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0003-4671-4132","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041880436","display_name":"Tobias Klenze","orcid":"https://orcid.org/0000-0002-6505-3942"},"institutions":[{"id":"https://openalex.org/I4210110221","display_name":"Coalition Against Trafficking Women","ror":"https://ror.org/020qa8h77","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210110221"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tobias Klenze","raw_affiliation_strings":["Category Labs, New York, USA"],"raw_orcid":"https://orcid.org/0000-0002-6505-3942","affiliations":[{"raw_affiliation_string":"Category Labs, New York, USA","institution_ids":["https://openalex.org/I4210110221"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014532120","display_name":"Sofia Giampietro","orcid":"https://orcid.org/0009-0004-9628-0007"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Sofia Giampietro","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0009-0004-9628-0007","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098060218","display_name":"Markus Limbeck","orcid":"https://orcid.org/0009-0007-2805-6945"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Markus Limbeck","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0009-0007-2805-6945","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098034918","display_name":"Dionysios Spiliopoulos","orcid":"https://orcid.org/0000-0002-2019-3319"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Dionysios Spiliopoulos","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0002-2019-3319","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085816785","display_name":"Felix A. Wolf","orcid":"https://orcid.org/0000-0002-8573-2387"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Felix Wolf","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0002-8573-2387","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046632033","display_name":"Marco Eilers","orcid":"https://orcid.org/0000-0003-4891-6950"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Marco Eilers","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0003-4891-6950","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037740498","display_name":"Christoph Sprenger","orcid":"https://orcid.org/0000-0003-2941-5165"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Christoph Sprenger","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0003-2941-5165","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025344654","display_name":"David Basin","orcid":"https://orcid.org/0000-0003-2952-939X"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"David Basin","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0003-2952-939X","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073853337","display_name":"P\u00e9ter M\u00fcller","orcid":"https://orcid.org/0000-0001-7001-2566"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Peter M\u00fcller","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0001-7001-2566","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5056518136","display_name":"Adrian Perrig","orcid":"https://orcid.org/0000-0002-5280-5412"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Adrian Perrig","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0002-5280-5412","affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.9724,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.88551263,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1469","last_page":"1483"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11504","display_name":"Advanced Authentication Protocols Security","score":0.6725000143051147,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11504","display_name":"Advanced Authentication Protocols Security","score":0.6725000143051147,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10651","display_name":"IPv6, Mobility, Handover, Networks, Security","score":0.09529999643564224,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.03970000147819519,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.544700026512146},{"id":"https://openalex.org/keywords/cryptographic-protocol","display_name":"Cryptographic protocol","score":0.5101000070571899},{"id":"https://openalex.org/keywords/formal-verification","display_name":"Formal verification","score":0.49549999833106995},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.45969998836517334},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.42489999532699585},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.41909998655319214},{"id":"https://openalex.org/keywords/router","display_name":"Router","score":0.3652999997138977},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.349700003862381}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7777000069618225},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.544700026512146},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.5101000070571899},{"id":"https://openalex.org/C111498074","wikidata":"https://www.wikidata.org/wiki/Q173326","display_name":"Formal verification","level":2,"score":0.49549999833106995},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.47760000824928284},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.47609999775886536},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.45969998836517334},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.42489999532699585},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.41909998655319214},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.3652999997138977},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.349700003862381},{"id":"https://openalex.org/C15927051","wikidata":"https://www.wikidata.org/wiki/Q246593","display_name":"Cryptographic primitive","level":4,"score":0.34290000796318054},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.3327000141143799},{"id":"https://openalex.org/C75606506","wikidata":"https://www.wikidata.org/wiki/Q1049183","display_name":"Formal methods","level":2,"score":0.3276999890804291},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.32109999656677246},{"id":"https://openalex.org/C22111027","wikidata":"https://www.wikidata.org/wiki/Q1070427","display_name":"Internet security","level":4,"score":0.3050999939441681},{"id":"https://openalex.org/C141492731","wikidata":"https://www.wikidata.org/wiki/Q1052621","display_name":"Message authentication code","level":3,"score":0.29600000381469727},{"id":"https://openalex.org/C100485629","wikidata":"https://www.wikidata.org/wiki/Q1669397","display_name":"Hash-based message authentication code","level":4,"score":0.295199990272522},{"id":"https://openalex.org/C35341882","wikidata":"https://www.wikidata.org/wiki/Q8795","display_name":"Internet Protocol","level":3,"score":0.2948000133037567},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.2743000090122223},{"id":"https://openalex.org/C44209976","wikidata":"https://www.wikidata.org/wiki/Q1327773","display_name":"Non-repudiation","level":3,"score":0.2653000056743622},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.2596000134944916},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.25380000472068787},{"id":"https://openalex.org/C143724316","wikidata":"https://www.wikidata.org/wiki/Q312468","display_name":"Series (stratigraphy)","level":2,"score":0.25220000743865967}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3719027.3765104","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765104","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765104","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:doi:10.3929/ethz-c-000787572","is_oa":true,"landing_page_url":"http://hdl.handle.net/20.500.11850/787572","pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference Paper"}],"best_oa_location":{"id":"doi:10.1145/3719027.3765104","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765104","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765104","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5055464087","display_name":null,"funder_award_id":"RS-2024-00440780","funder_id":"https://openalex.org/F4320328359","funder_display_name":"Ministry of Science and ICT, South Korea"}],"funders":[{"id":"https://openalex.org/F4320328359","display_name":"Ministry of Science and ICT, South Korea","ror":"https://ror.org/01wpjm123"},{"id":"https://openalex.org/F4320336702","display_name":"Zurich Information Security and Privacy Center","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416549252.pdf","grobid_xml":"https://content.openalex.org/works/W4416549252.grobid-xml"},"referenced_works_count":30,"referenced_works":["https://openalex.org/W1155763687","https://openalex.org/W1495368328","https://openalex.org/W1528322206","https://openalex.org/W2006731094","https://openalex.org/W2023035194","https://openalex.org/W2029693536","https://openalex.org/W2044186122","https://openalex.org/W2091776255","https://openalex.org/W2136310957","https://openalex.org/W2147323041","https://openalex.org/W2167814583","https://openalex.org/W2288327952","https://openalex.org/W2296772897","https://openalex.org/W2316113835","https://openalex.org/W2536639940","https://openalex.org/W2640092413","https://openalex.org/W2742515467","https://openalex.org/W2744406816","https://openalex.org/W2767162229","https://openalex.org/W2816958343","https://openalex.org/W2981644358","https://openalex.org/W3013443015","https://openalex.org/W3214700495","https://openalex.org/W3215696917","https://openalex.org/W4250846042","https://openalex.org/W4310881471","https://openalex.org/W4385679766","https://openalex.org/W4400973470","https://openalex.org/W4413756574","https://openalex.org/W7078765679"],"related_works":[],"abstract_inverted_index":{"We":[0,29],"present":[1],"the":[2,11,32,38,66,80],"first":[3],"formally-verified":[4],"Internet":[5,13],"router,":[6],"which":[7],"is":[8],"part":[9],"of":[10,41,49,87],"SCION":[12,15],"architecture.":[14],"routers":[16],"run":[17],"a":[18,47],"cryptographic":[19],"protocol":[20,50],"for":[21],"secure":[22],"packet":[23],"forwarding":[24],"in":[25,54,84],"an":[26,59],"adversarial":[27],"environment.":[28],"verify":[30],"both":[31],"protocol's":[33],"network-wide":[34],"security":[35],"properties":[36,40],"and":[37,56,77],"low-level":[39],"its":[42],"implementation.":[43],"Namely,":[44],"we":[45,57],"develop":[46],"series":[48,86],"models":[51],"by":[52],"refinement":[53],"Isabelle/HOL":[55],"use":[58],"automated":[60],"program":[61],"verifier":[62],"to":[63,79],"prove":[64],"that":[65],"router's":[67],"Go":[68],"code":[69],"satisfies":[70],"crash":[71],"freedom,":[72],"freedom":[73],"from":[74],"data":[75],"races,":[76],"adheres":[78],"most":[81],"concrete":[82],"model":[83],"our":[85],"refinements.":[88],"Both":[89],"verification":[90],"efforts":[91],"are":[92],"soundly":[93],"linked":[94],"together.":[95]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2025-11-23T00:00:00"}