Path hopping based SDN network defense technology

Abstract

In order to enhance the ability of software defined network (SDN) proactive security protection, this paper puts forward a path hopping based SDN network defense (PH-SND) technology. PH-SND technology models the path hopping problem as a constraint solving problem, and utilizes satisfiability modulo theory solver to obtain multiple paths, which satisfy overlap and capacity constraints. According to the path hopping strategy and specific hopping slot, SDN controller installs corresponding flow entries into all OpenFlow switches along every path, and these switches can then use these flow entries to properly forward the corresponding protected flow, and randomly change the address and port information of this flow, which can not only realize random path hopping, and can also effectively hide original address and port information of both communication sides. Theoretical analysis and experimental results show that this proposed PH-SND technology can not only achieve transmission path hopping and address and port random hopping along every transmission path with a comparatively small communication delay and can also improve proactive security protection capability to resist network interception and analysis attack.