An implementation method of distributed flow table entry effective time dynamic hopping

Abstract

The application discloses a kind of distributed flow table item effective time dynamic hopping implementation methods, including distributed flow table item effective time dynamic hopping definition, implementation, and balance security, performance and resource consumption three features such as characteristic.This method, flow table item in flow table existence time is regarded as privacy, through the ladder random response mechanism of differential privacy in SDN forwarding equipment local flow table item in flow table existence time is dynamically disturbed, forms dynamic mobile flow table item attack surface, makes low-speed flow table overflow attack unable to synchronize flow table item attack surface, to the attack has realized effective active defense.The method does not need to upgrade existing SDN interface protocol and controller software, does not need to introduce trusted third party, while considering network security, guarantee network performance and expansibility, especially suitable for various types of need to support high security and large concurrent user, and has special requirements to delay and expansibility, guarantee its service quality and user experience.

Description

Technical Field

[0001] This invention relates to a dynamic time jump method, specifically a method for implementing dynamic time jump of a distributed flow table entry. Background Technology

[0002] Flow table entries are forwarding rules in Software Defined Networking (SDN). They are created, distributed, and stored in the flow tables of SDN switches by the SDN controller. Because SDN switches need to support flexible forwarding policies, their flow tables must use tri-state content-addressable memory, which is power-intensive and expensive, resulting in limited flow table space and making them a primary target for network attacks. In an SDN network, when an SDN switch receives a new data packet and cannot find a matching flow table entry, it requests the controller to generate and distribute a matching flow table entry to that flow table. If the flow table space is exhausted, the distributed flow table entry will be discarded, and the corresponding data packet will also be discarded due to the lack of a matching forwarding rule, causing regular forwarding services to be rejected. This type of attack is called an SDN flow table overflow attack.

[0003] SDN flow table overflow attacks mainly include saturation attacks, low-speed flow table overflow attacks, and slow saturation attacks. Saturation attacks send a large number of data packets in a short period, overwhelming the flow table of the target forwarding device and causing regular forwarding services to be denied. Saturation attacks do not require sniffing network settings, are easy to operate, but have extremely high packet rates, are easy to detect, and have limited damage to the network. Low-speed flow table overflow attacks and slow saturation attacks require sniffing flow table settings, constructing attack packets, and synchronizing attack packets with flow table settings so that attack packets can fill the target device's flow table with a low generation and sending rate. Low-speed flow table overflow attack packets do not need to use real IPs; the total sending rate of attack packets is usually constant, and the size usually does not exceed 0.2 times the total sending rate of legitimate packets to avoid triggering saturation attack detection mechanisms. Slow saturation attacks, on the other hand, require constructing attack packets with legitimate IPs and slowly increasing the sending rate of attack packets to survive saturation attack detection mechanisms while consuming flow table resources as much as possible. Therefore, low-speed flow table overflow attacks are slightly less difficult than slow saturation attacks, and the statistical characteristics of their attack packets are very similar to those of legitimate network short flows, device status detection information flows, and data flows from IoT sensor devices, making them more concealed, more difficult to detect, and more destructive to the network.

[0004] Defense methods against SDN low-speed flow table overflow attacks can be divided into two categories: passive defense and active defense. Passive defense refers to measures taken after an attack occurs to reduce its damage, mainly divided into detection and mitigation. Detection methods mainly include thresholding and machine learning. Thresholding first establishes an attack prediction formula and sets a threshold, then compares the predicted value with the threshold to determine whether the flow table is under attack; machine learning first inputs the dataset containing the attack flow into the machine learning algorithm to train the model, and then relies on the model to identify the attack. Mitigation measures usually refer to methods used to mitigate the damage caused by the attack after it occurs. Since the core of mitigating low-speed flow table overflow attacks is to reduce the overflow of the flow table, mitigation methods are usually divided into three categories: (1) limiting the installation speed of flow table entries; (2) redirecting the flow groups of the attacked device to adjacent devices; (3) deleting flow table entries in the attacked flow table to make room for installing new flow table entries, avoiding the rejection of forwarding services for all new flows. These mitigation measures can usually only reduce but not prevent the damage caused by the attack.

[0005] Proactive defense against low-speed flow table overflow attacks refers to early warning or resilient defense mechanisms built before an attack occurs, aiming to eliminate network security risks and reduce damage. Traditional proactive defense is a fortress-like system built with various means such as firewalls, intrusion detection, host monitoring, identity authentication, antivirus software, and vulnerability patching. However, due to the static nature of network systems and the asymmetry of attack and defense information, time, and cost, it is often inadequate and costly when combating unknown attacks. Currently, there are no successful cases of using traditional proactive defense methods to resist low-speed flow table overflow attacks.

[0006] Moving Target Defense (MTD) is a revolutionary proactive defense technology. Unlike traditional proactive defenses that attempt to eliminate all security vulnerabilities, MTD continuously alters the morphological characteristics of the target system, increasing the diversity, dynamism, and randomness of system attributes. This limits the opportunities for vulnerabilities to be continuously exposed and exploited, increases the difficulty and cost of attacks, and enhances the system's proactive defense capabilities.

[0007] In the SDN field, MTD (Mean Transmission Dealing) primarily relies on centralized implementation using controllers. This can be achieved by randomizing the expiration time of flow table entries through controllers, dynamically changing the IP and MAC addresses, forwarding paths, and topology of forwarding devices or hosts through virtualization, or maintaining a controller pool to offload traffic from abnormal controllers. While centralized MTD increases the difficulty of low-speed flow table overflow attacks—for example, dynamic changes to host addresses make it harder to identify the attack source, and dynamic changes to forwarding paths and topology make it harder to pinpoint the target flow table—this centralized approach places excessive demands on the controller's resources and security. In practice, it struggles to meet the needs of applications with large user bases and high scalability and security requirements, such as online healthcare, online banking, and online insurance and securities. Summary of the Invention

[0008] This invention addresses the shortcomings of existing technologies by providing a method for dynamically changing the validity period of distributed flow table entries. This method can effectively defend against low-speed flow table overflow attacks, achieving effective proactive defense, adjusting system security, and ultimately balancing the security, performance, and resource consumption of SDN systems.

[0009] The technical solution to achieve the objective of this invention is:

[0010] A method for dynamically changing the validity period of a distributed flow table entry includes the following steps:

[0011] 1) Definition of dynamic jump in validity period of distributed flow table entries:

[0012] 1.1) Definition of Flow Table Entry Validity Time: A flow table entry is a forwarding rule of a software-defined network (SDN) forwarding device. It is created by the SDN controller, issued to the SDN switches, and stored in the flow table of the switch. Since the forwarding devices of the SDN need to support flexible forwarding strategies, the flow table of the switch needs to be stored in a tri-state content-addressable memory. Because tri-state content-addressable memory consumes a lot of power and is expensive, and each SDN flow table entry usually contains a lot of content and occupies a lot of memory space, the flow table of the SDN switch usually has limited capacity. In order to effectively utilize the limited flow table resources of the switch, the SDN architecture stipulates that each flow table entry has a validity time in the flow table. Flow table entries that have expired will be cleared from the flow table to make room for newly issued flow table entries. This time is called the flow table entry validity time.

[0013] 1.2) Definition of dynamic change of flow table entry validity time: The validity time of a flow table entry is usually preset and written into the relevant fields of the flow table entry by the controller when the controller creates the flow table entry. After the flow table entry is issued by the controller and stored in the flow table of the switch, the switch usually does not change the flow table entry or the validity time of the flow table entry. However, the switch will manage the flow table entry, that is, periodically check the lifespan of the flow table entry in the flow table and compare it with the validity time of the flow table entry set by the controller and written into the relevant fields of the flow table entry to determine whether the flow table entry has expired in the flow table and then delete it from the flow table. Therefore, the validity time written into the flow table entry is usually static. However, the controller can modify the validity time through specific commands. When the controller continuously changes the validity time written into the flow table entry, the validity time becomes a dynamically changed validity time. This method of realizing dynamic change of flow table entry validity time through the controller is called centralized dynamic change of flow table entry validity time, because the controller is a logically centralized unit in the software-defined network, which performs centralized and unified control and management of all forwarding devices.

[0014] 1.3) Definition of dynamic change of validity time of distributed flow table entries: Unlike the centralized method that causes the validity time of flow table entries to change through the controller, dynamic change of validity time of distributed flow table entries refers to the method of dynamically changing the validity time of flow table entries through the forwarding device;

[0015] 2) Implementation of dynamic change of validity period for distributed flow table entries:

[0016] 2.1) Initialize the set of aging actions for flow table entries and the corresponding probability set :

[0017] 2.1.1) Determine the set of aging actions for flow table items. , arrive The values ​​are all different, and the total number of aging actions included in the aging action set is... Each aging process In the aging set, it is represented by a real number, indicating the rate of aging. Assume... The duration of the current flow table entry in the flow table. The trigger cycle of the aging timer, when When, it indicates that normal aging is performed according to the timer trigger cycle, that is... ;when When this time, it indicates that the flow table entries are not aging, that is... ;when When this occurs, it indicates that the flow meter is aging faster than normal; when When this occurs, it indicates that the effective time of the flow table entry is longer but the aging rate is slower than normal; when When this occurs, it indicates that the effective time of the flow table entry has decreased;

[0018] 2.1.2) Determine the probability set of the aging action to be adopted. The probability set contains a total of probabilities. The first aging action in the aging action set. The corresponding probability is The probabilities corresponding to the other aging actions are all This ensures that the sum of all probabilities is 1, and satisfies the requirements of the laddered random response mechanism;

[0019] 2.1.3) Because a stepped random response is added to the flow table entry aging process, the original flow table entry aging process based on the timer trigger period, i.e., based on the system clock, is disturbed. The disturbance strength is equal to the privacy budget є of the stepped random response. ;

[0020] 2.2) Determine if the aging timer for the flow table entry has been triggered. If triggered, and The following steps are used to call the flow table entry aging submodule with stepped random response as input parameters:

[0021] 2.2.1) For each entry in the flow table, age the entry. The aging process is as follows:

[0022] a) Generate a random number ;

[0023] b) Compare random numbers and aging actions Corresponding probability The size, if The aging action of this flow table item is Otherwise, generate another random number. And compare And the magnitude of other probabilities, if The aging action of this flow table item is ,like The aging action of this flow table item is And so on, until... The aging action selection for this flow meter item ;

[0024] c) Record the aging action selected for this flow table item as... ;

[0025] d) Update the current existence time of the flow table entry after aging. ,in The duration of a flow table entry within the flow table. This is the trigger period of the timer;

[0026] 2.2.2) Determine whether each entry in the flow table has completed aging. If not, return to step 2.2.1); otherwise, output the latest existence time of each entry. The aging process has ended;

[0027] 2.2.3) Delete flow table entries whose existence time is longer than the validity time of the flow table entry:

[0028] 2.2.4) Return to step 2.2).

[0029] 3) Dynamic transitions in the validity period of distributed flow entries can balance the security, performance, and resource consumption of an SDN system. The security of an SDN network refers to its ability to defend against low-speed flow table overflow attacks. By perturbing the flow entry aging process, dynamic transitions in the validity period of flow entries can be achieved, ultimately preventing the synchronization of low-speed flow table overflow attack flows with the validity period of flow entries, effectively preventing flow table overflow. The perturbation capability of the flow entry aging process represents the security of the SDN system. According to the tiered random response mechanism, the perturbation capability is represented by the privacy budget є= Calculation, therefore adjustment This adjusts the ability to perturb the effective time. Meanwhile, the average aging value of each aging of the flow table item after perturbation is expressed as... The existence time of the flow table item after aging is The duration of this existence affects the main performance indicators of the SDN network (such as the network's packet forwarding time and the total number of packets forwarded to the controller) and resource consumption (such as the consumption of flow table space). Therefore, the dynamic change of the validity time of distributed flow table entries balances the security, main performance and resource consumption of the SDN network by adjusting the values ​​of aging actions and probabilities.

[0030] This invention presents a method for proactively and effectively defending against low-speed flow table overflow attacks in SDN by dynamically changing the validity period of flow table entries. It features high scalability, high security, and decentralization. This technical solution is applicable to software-defined physical networks based on the OpenFlow protocol. By upgrading the system software of SDN switches deployed on the data plane, the validity period of forwarding rules (flow table entries) stored in the SDN switch flow tables is considered network privacy. Combined with a differential privacy tiered random response mechanism, the aging of flow table entries is dynamically changed locally on the switch, allowing the actual validity period of flow table entries to change dynamically on the switch. This method does not require upgrading existing SDN interface protocols or SDN controller software, nor does it require the introduction of trusted third parties. While ensuring network performance and scalability, it achieves the movement of the flow table attack surface, providing effective proactive defense against low-speed flow table overflow attacks. It is particularly suitable for 5G networks to ensure the quality of service and user experience of applications requiring high security, supporting a large number of concurrent users, and with special requirements for latency and reliability, such as online healthcare, online banking, and online insurance and securities.

[0031] This technical solution treats the validity period of flow entries in the flow table as network privacy information. By upgrading the flow entry aging submodule of the flow entry management module in the SDN switch system software, the tiered random response mechanism from differential privacy is applied to flow entry aging. The validity period of flow entries, which normally age according to the clock, is randomly perturbed locally on the switch. This creates a random deviation between the actual validity period of a flow entry and the validity period set and written to the flow entry by the controller during entry creation. This makes it difficult for low-speed flow table overflow attacks to synchronize with the attack surface represented by the validity period of flow entries, thus achieving effective proactive defense against low-speed flow table overflow attacks. Since the tiered random response has an accurate mathematical model, and the perturbation strength is a function of random probability, adjusting the random probability can adjust the system's security. Meanwhile, since the main performance and resource consumption of SDN systems are sensitive to the validity period of flow table entries, and since the expected value of the validity period after perturbation can be calculated as an unbiased estimate of the true value based on the mathematical model of stepped random response, this technical solution can adjust the degree of perturbation of the validity period of flow table entries by adjusting the random probability, ultimately balancing the security, performance, and resource consumption of the SDN system. Because the perturbation intensity of time and its impact on system performance in this technical solution are characterizable and adjustable, and are implemented locally on the switch, completely decoupled from the switch implementation, it meets the needs of applications with large user volumes and high requirements for scalability and security in real-world networks, such as online healthcare, online banking, and online insurance and securities.

[0032] This technical solution is applicable to the proactive defense of SDN physical networks against low-speed flow table overflow attacks. When deployed on forwarding devices (such as switches) in the SDN network data plane, the SDN controller and the interface protocols between the control and data planes (such as the OpenFlow protocol) do not require upgrades. Attached Figure Description

[0033] Figure 1 This embodiment describes an SDN network architecture diagram with a distributed flow table entry validity time dynamic jump system.

[0034] Figure 2 This is a functional structure diagram of the forwarding device system software described in this embodiment;

[0035] Figure 3 This is a flowchart describing the flow entry aging module of the flow entry management module of the forwarding device system software in this embodiment.

[0036] Figure 4 This is a schematic diagram illustrating the principle of selecting flow table aging actions based on probability in this embodiment. Detailed Implementation

[0037] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.

[0038] Example:

[0039] A method for dynamically changing the validity period of a distributed flow table entry includes the following steps:

[0040] 1) Definition of dynamic jump in validity period of distributed flow table entries:

[0041] 1.1) Definition of Flow Table Entry Validity Time: A flow table entry is a forwarding rule of a software-defined network (SDN) forwarding device. It is created by the SDN controller, issued to the SDN switches, and stored in the flow table of the switch. Since the forwarding devices of the SDN need to support flexible forwarding strategies, the flow table of the switch needs to be stored in a tri-state content-addressable memory. Because tri-state content-addressable memory consumes a lot of power and is expensive, and each SDN flow table entry usually contains a lot of content and occupies a lot of memory space, the flow table of the SDN switch usually has limited capacity. In order to effectively utilize the limited flow table resources of the switch, the SDN architecture stipulates that each flow table entry has a validity time in the flow table. Flow table entries that have expired will be cleared from the flow table to make room for newly issued flow table entries. This time is called the flow table entry validity time.

[0042] 1.2) Definition of dynamic change of flow table entry validity time: The validity time of a flow table entry is usually preset and written into the relevant fields of the flow table entry by the controller when the controller creates the flow table entry. After the flow table entry is issued by the controller and stored in the flow table of the switch, the switch usually does not change the flow table entry or the validity time of the flow table entry. However, the switch will manage the flow table entry, that is, periodically check the lifespan of the flow table entry in the flow table and compare it with the validity time of the flow table entry set by the controller and written into the relevant fields of the flow table entry to determine whether the flow table entry has expired in the flow table and then delete it from the flow table. Therefore, the validity time written into the flow table entry is usually static. However, the controller can modify the validity time through specific commands. When the controller continuously changes the validity time written into the flow table entry, the validity time becomes a dynamically changed validity time. This method of realizing dynamic change of flow table entry validity time through the controller is called centralized dynamic change of flow table entry validity time, because the controller is a logically centralized unit in the software-defined network, which performs centralized and unified control and management of all forwarding devices.

[0043] 1.3) Definition of dynamic change of validity time of distributed flow table entries: Unlike the centralized method that causes the validity time of flow table entries to change through the controller, dynamic change of validity time of distributed flow table entries refers to the method of dynamically changing the validity time of flow table entries through the forwarding device;

[0044] 2) Implementation of dynamic change of validity period for distributed flow table entries:

[0045] 2.1) Initialize the set of aging actions for flow table entries and the corresponding probability set :

[0046] 2.1.1) Determine the set of aging actions for flow table items. , arrive The values ​​are all different, and the total number of aging actions included in the aging action set is... Each aging process In the aging set, it is represented by a real number, indicating the rate of aging. Assume... The duration of the current flow table entry in the flow table. The trigger cycle of the aging timer, when When, it indicates that normal aging is performed according to the timer trigger cycle, that is... ;when When this time, it indicates that the flow table entries are not aging, that is... ;when When this occurs, it indicates that the flow meter is aging faster than normal; when When, it indicates that the time a flow table entry exists in the flow table is longer, but the aging rate is slower than normal; when When this occurs, it indicates that the effective time of the flow table entry has decreased;

[0047] 2.1.2) Determine the probability set of the aging action to be adopted. The probability set contains a total of probabilities. The first aging action in the aging action set. The corresponding probability is The probabilities corresponding to the other aging actions are all This ensures that the sum of all probabilities is 1, and satisfies the requirements of the laddered random response mechanism;

[0048] 2.1.3) Because a stepped random response is added to the flow table entry aging process, the original flow table entry aging process based on the timer trigger period, i.e., based on the system clock, is disturbed. The disturbance strength is equal to the privacy budget є of the stepped random response. ;

[0049] 2.2) Determine if the aging timer for the flow table entry has been triggered. If triggered, and The following steps are used to call the flow table entry aging submodule with stepped random response as input parameters:

[0050] 2.2.1) For each entry in the flow table, age the entry. The aging process is as follows:

[0051] a) Generate a random number ;

[0052] b) Compare random numbers and aging actions Corresponding probability The size, if The aging action of this flow table item is Otherwise, generate another random number. And compare And the magnitude of other probabilities, if The aging action of this flow table item is ,like The aging action of this flow table item is And so on, until... The aging action selection for this flow meter item ;

[0053] c) Record the aging action selected for this flow table item as... ;

[0054] d) Update the current existence time of the flow table entry after aging. ,in The duration of a flow table entry within the flow table. This is the trigger period of the timer;

[0055] 2.2.2) Determine whether each entry in the flow table has completed aging. If not, return to step 2.2.1). Otherwise, output the latest existence time of each entry, and the aging process ends.

[0056] 2.2.3) Remove flow table entries whose existence time is longer than the validity time of the flow table entry;

[0057] 2.2.4) Return to step 2.2).

[0058] 3) Dynamic transitions in the validity period of distributed flow entries can balance the security, performance, and resource consumption of an SDN system. The security of an SDN network refers to its ability to defend against low-speed flow table overflow attacks. By perturbing the flow entry aging process, dynamic transitions in the validity period of flow entries can be achieved, ultimately preventing the synchronization of low-speed flow table overflow attack flows with the validity period of flow entries, effectively preventing flow table overflow. The perturbation capability of the flow entry aging process represents the security of the SDN system. According to the tiered random response mechanism, the perturbation capability is represented by the privacy budget є= Calculation, therefore adjustment This adjusts the ability to perturb the effective time. Meanwhile, the average aging value of each aging of the flow table item after perturbation is expressed as... The existence time of the flow table item after aging is The duration of this existence affects the main performance indicators of the SDN network (such as the network's packet forwarding time and the total number of packets forwarded to the controller) and resource consumption (such as the consumption of flow table space). Therefore, the dynamic change of the validity time of distributed flow table entries balances the security, main performance and resource consumption of the SDN network by adjusting the values ​​of aging actions and probabilities.

[0059] In this example, the distributed flow table entry validity time dynamic jump system is deployed in the software system of the switch on the data plane of a standard SDN network. For example... Figure 1 As shown, a standard SDN network consists of two planes: the control plane and the data plane. The control plane contains one or more logically centralized SDN controllers, while the data plane contains forwarding devices and terminal devices. Forwarding devices mainly refer to SDN switches, and terminal devices mainly refer to network-connected devices such as computers and mobile phones. The controllers in the control plane and the forwarding devices in the data plane interact through control channels and southbound interfaces, while the forwarding devices and terminal devices in the data plane interact through data channels and existing network protocols. In this example, the distributed flow table entry validity time dynamic transition system is deployed on the software system of the forwarding devices in the data plane. Therefore, this example does not require changes to the existing controllers and southbound interfaces, but it does require an upgrade to the software of the forwarding devices.

[0060] This example demonstrates the system software deployed on an SDN forwarding device. The functional structure of the SDN forwarding device system software is as follows: Figure 2As shown. The system software of the SDN forwarding device mainly consists of two modules: flow forwarding and flow entry management. The flow forwarding module is primarily responsible for forwarding data packets received by the forwarding device according to forwarding rules. When the forwarding device receives a data packet, the flow forwarding module first parses the data packet and then searches for a matching flow entry (forwarding rule) in the flow table based on relevant fields. If a matching flow entry is found, the flow forwarding module forwards the received data packet according to the forwarding action specified in the flow entry. If no matching flow entry is found, the flow forwarding module generates a flow entry creation and installation request and sends the request to the controller through a secure communication channel. The controller receives the request, encapsulates the matching flow entry into a response, distributes it through the secure communication channel, and installs it into the flow table. The flow forwarding module then forwards the received data packets according to the matching flow entry, ultimately completing the packet forwarding. The flow entry management module of the SDN forwarding device system software is mainly responsible for managing the lifecycle of flow entries. This flow entry management module updates the liveness status of each flow entry periodically using a timer. When the timer is triggered, this module checks the existence time of each flow table entry in the flow table and compares it with the set validity time for writing the flow table entry. If the current existence time is greater than or equal to the set validity time, it means that the life cycle of the flow table entry has ended, and the flow table entry will be removed from the flow table to make room for newly issued flow table entries. If the current existence time is less than the set validity time, the flow table entry will continue to be retained in the flow table for its life cycle.

[0061] This example requires upgrading the flow entry aging submodule of the flow entry management module in the forwarding device system software. The flowchart of the flow entry aging submodule with the dynamically changing flow entry validity time system in this example is as follows: Figure 3 As shown, this submodule starts by initializing the aging action set and the corresponding probability set. It first activates the flow table entry aging timer, giving a trigger period. When the timer is triggered, the submodule ages each flow table entry one by one. The aging process is essentially updating the existence time of each flow table entry. In a normal aging process, the updated existence time of a flow table entry equals the sum of its original existence time and the aging timer trigger period. With the addition of a dynamic jump system for the validity time of flow table entries, the aging submodule needs to select an aging action based on a given probability, update the existence time of each flow table entry according to the aging action, until all flow table entries are updated, and then return to the flow table entry aging timer to check if the timer has been triggered.

[0062] This example requires maintaining a set of aging actions. and probability set The set of aging actions can be set as needed. There are several different aging actions, each with a probability of being executed. This probability must satisfy the following two requirements: when one of the probabilities is... When, the other probabilities are (1- ) / (m-1), ensuring that the sum of all probabilities is 1. Table 1 gives the set of aging actions containing 4 different aging actions and the probability that each aging action may be executed. Table 2 gives the meaning of the values ​​of different aging actions.

[0063] Table 1. Time Aging Strategy for Flow Entries

[0064]

[0065] Table 2. Aging actions, probabilities, aging values, and descriptions for flow table entries. A positive number

[0066]

[0067] In this example, the aging submodule needs to select aging actions based on probability. According to Tables 1 and 2, given a set of aging actions (2), the probability of the first aging action is... The probability of other aging actions is When selecting aging actions based on probability, such as... Figure 4 As shown, first, a random number between 0 and 1 is generated, and then a selection with a probability of is chosen based on the size of this random number. Is it an aging process or some other process, for example: a random number is 0.2, if 0.2 is greater than a given... The probability of choosing is small. aging action Otherwise, generate another 0 to 1. Random numbers between [a certain range], based on the size and probability of the random numbers. Determine which of the other actions to choose. If the random number is greater than 0 and less than or equal to 0.25, select the aging action. If the random number is greater than 0.25 and less than or equal to 0.5, select the aging action. Otherwise, choose aging actions. The methods for generating random numbers and selecting aging actions, while adhering to the basic principles of the laddered random response mechanism, can be modified according to the programming language and performance requirements.

[0068] This example is developed based on the open-source software switch Openvswitch. It eliminates the need to upgrade the controller software and OpenFlow protocol, providing a high-performance, highly secure, and highly scalable proactive defense method against low-speed flow table overflow attacks. It is low-cost, highly compatible, and can guarantee the quality of service and user experience for different types of applications.

Claims

1. A method for dynamically changing the validity period of distributed flow table entries, characterized in that the method is applied to a forwarding device and incorporates a laddered random response mechanism from differential privacy into the aging model of flow table entries to adjust the ability to perturb the validity period. The method includes the following steps: 1.1) Initialize the set of aging actions for flow table entries and the corresponding probability set ; a) Determine the set of aging actions for flow table items , arrive The values ​​are all different, and the total number of aging actions included in the aging action set is... Each aging process Let be a real number, representing the rate of aging. Assume... The duration of the current flow table entry in the flow table. The trigger cycle of the aging timer, when hour, This indicates that normal aging is performed according to the timer trigger cycle; when hour, This indicates that the flow table entries are not aged; when When this occurs, it indicates that the flow meter is aging faster than normal; when When, it indicates that the time a flow table entry exists in the flow table is longer, but the aging rate is slower than normal; when When this occurs, it indicates that the duration of a flow table entry in the flow table is shortened; b) Determine the probability set of the aging action to be adopted. The probability set contains a total of probabilities. The first aging action in the aging action set. The corresponding probability is The probabilities corresponding to the other aging actions are all ; 1.2) Determine if the aging timer for the flow table entry has been triggered. If triggered, ... and The following steps are used to call the flow table entry aging submodule with stepped random response as input parameters: 1.2.1) Age each entry in the flow table, including: a) Generate a random number ; b) Combine it with aging processes Corresponding probability If a comparison is made, The aging action of this flow table item is ; Otherwise, generate another random number. And compare And the magnitude of other probabilities, if The aging action of this flow table item is ,like The aging action of this flow table item is And so on, until... The aging action selection for this flow meter item ; c) Record the aging action selected for this flow table item as... ; d) Update the current existence time of the flow table entry after aging. ,in The duration of a flow table entry within the flow table. This is the trigger period of the timer; 1.2.2) Determine whether each entry in the flow table has completed aging. If not, return to step 1.2.1); otherwise, output the latest existence time of each entry. ,Finish; 1.2.3) Remove flow table entries whose existence time is longer than the validity time of the flow table entry; 1.2.4) Return to step 1.2).

2. The method for dynamically changing the validity period of a distributed flow table entry according to claim 1, characterized in that, Based on the aforementioned tiered random response mechanism, the perturbation capability is represented by a privacy budget є= Calculation, therefore adjustment This adjusts the ability to perturb the effective time. Meanwhile, the average aging value of each aging of the flow table item after perturbation is expressed as... The existence time of the flow table item after aging is T+( The duration of this duration affects the main performance indicators and resource consumption of SDN networks.

Images