# Implementation of a Lossless Moving Target Defense Mechanism
## 6 Implementation
### Environment Description
These connections are only for the transmission of control information, such as entries to flow tables. To simplify the understanding of the algorithm, their participation is not further detailed here. Before describing the functions performed by both types of switches, let us introduce the concept of IP address generation. (Note: In the proposed implementation of the MTD technique, only IPv4 (IP version 4) addresses  
Figure 6: V1 model architecture. are used. However, the proposed mechanism can also be applied using IPv6 (IP version 6) addresses. The limitation to IPv4 was chosen to simplify the diagrams and enhance their comprehensibility.) **Definition 1**. : _Define the generation of an IP address as a group of IP addresses that describes an entire computer network secured using MTD mechanisms. These addresses are exchanged in IP packets between border and core nodes, as well as among core nodes, in a specific state of the network._  
**Definition 2**. : _Let us define a coherent network state as a state in which all border devices use only one logically consistent set of IP addresses._  
The dynamic mutation of IP addresses in computer networks can proceed in two ways, synchronously and asynchronously. In synchronous mode, all network nodes should change the used group of IP addresses simultaneously. This necessitates the introduction of network synchronization mechanisms. An example of synchronous network parameter change can be observed in passive optical networks, where the Next-Generation Passive Optical Network 2 (NG-PON2) standard includes a mechanism for dynamically changing the wavelength used for data transmission between Optical Line Termination (OLT) and Optical Network Unit (ONU). To indicate the moment when the wavelength used by the ONU should change, a superframe counter is utilized, which is increased with each transmitted frame. Since only two devices (the OLT and one ONU) participate in synchronization, this mechanism works reliably. The structure of computer networks is much more complex than that of NG-PON2 networks, which only have point-to-multipoint connections. In computer networks, many nodes connect to many nodes, so achieving synchronization using the method used in NG-PON2 is virtually impossible. Another method of achieving synchronization is the use of synchronous ethernet, described in [56]. Synchronous ethernet does not address the issue of changing IP addresses, which would not affect established TCP connections. Synchronous ethernet only offers synchronization at the bit or byte level. A problem arises if IP address changes occur during the transmission of an ethernet frame: a node might begin transmitting an ethernet frame containing an IP packet with a specific IP address, and, if IP addresses in the network change during transmission, the IP addresses upon reception could fall outside the correct address space. While it might be feasible to introduce a protective period to complete the transmission of the started frames, determining the precise duration of this protective period would  
Figure 7: Network structure using lossless MTD mechanisms. be challenging. This duration would need to account for frame propagation times, their processing in nodes, etc., for any pair of nodes. It is possible to assume a sufficiently long protective time, but this would likely result in a deterioration in service quality (reduced network throughput, extended transmission time). Furthermore, periodic breaks in data transmission would be a signal to an observer that some change in the network structure is taking place. To avoid problems with synchronous mode, the proposed solution uses an asynchronous method. In this approach, network nodes are allowed to use two generations of IP addresses--old and new--for a certain period. To make this possible, the following requirements must be met: Before using the new generation of IP addresses, it is necessary to distribute all necessary entries related to the new generation in the flow tables in all network nodes, i.e., in both border and core nodes.