A SDN Proactive Defense Mechanism Based on IP Transformation

Abstract

In order to improve the security of SDN, a proactive defense mechanism based on encrypted IP address transformation is proposed in this paper. The IP address protection method based on cryptographic transformation is designed to ensure the confusion of the source addresses of both senders and receivers. An effective key update method is designed to improve the randomness of the encryption transformation process. Based on the long prefix of IPv6, a new method of constructing IPv6 data packet with encrypted IPv4 address is proposed. Finally, P4 language is used to simulate the function of address protection and data forwarding in data layer. The evaluation results of the prototype system based on P4 language show that the proposed scheme can proactively defense the DoS attack, without significant performance degradation.