# FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables
## 3 Aging Flow Entries with Staircase Randomized Response  
As introduced in Section 2.1, each SDN switch has an aging procedure for flow entries that involves a timer to update the current existence time and idle time of each entry. Let the timer fire every 1 millisecond, and then the flow current existence time and idle time of each flow entry should increase by 1 millisecond compared to the timeouts written into the entry. This makes the timeouts become the lifespans of the flow entries in the flow table. However, such a procedure allows the flow-entry timeout to be easily sniffed, particularly when controllers apply static timeout across flow entries, thereby, leading to a flow table overflow attack that can cause the legitimate flows to be rejected for forwarding. \begin{table}
\begin{tabular}{c l} \hline \hline
**Symbols** & **Descriptions** \\ \hline \(M\) & differential privacy method \\ \(t,t^{{}^{\prime}}\) & two different input \\ \(t^{*}\) & output of \(M\) over \(t\) and \(t^{{}^{\prime}}\) \\ \(\epsilon\) & privacy budget \\ \(Pr[\cdot]\) & the probability of \(\cdot\) \\ \hline \(p\) & the probability of give true answer \\ \(\pi\) & the true number of users with answer “yes” \\ \(n,n1\) & the total number of users and the users giving “yes” \\ \(L\) & the likelyhood function \\ \(\pi^{-}\) & the estimated maximal likelyhood of \(\pi\) \\ \(E(\cdot)\) & expectation of \(\cdot\) \\ \hline \(A\) & the set of actions \\ \(A_{j}\) & the element of \(A\) \\ \(FA_{i}\) & the aging action taken by flow entry \(i\) \\ \(T\) & the checking period \\ \hline \(O\) & flow table space occupancy \\ \(F\) & packet forwarded to controllers \\ \(AFE\) & total number of current active flow entries \\ \(FE\) & total number of flow entries stored in flow table \\ \(PP\) & the set of packets \\ \(pp_{i}\) & a packet in set \(PP\) \\ \(a_{i}\) & the parameter indicating if \(pp_{i}\) is forwarded to controllers \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Symbols and their descriptions. To protect the lifespans of flow entries, the flow-entry timeouts can be encrypted. Whether the timeouts are encrypted by controllers at creation or by switches at installation, the encrypted timeouts have to be decrypted in the flow-entry-aging process to maintain the correct lifespans of flow entries. Since the aging process is triggered by the timer, while encryption/decryption is typically computationally intensive, encryption/decryption approaches are not suitable for the aging process. Accordingly, in this paper, we consider the lifespans of flow entries as the privacy of SDN systems. We do not attempt to provide statistics surveys over perturbed flow entry lifespans. Instead, we make the real lifespans of flow entries dynamically change based on the perturbed aging method with a certain privacy budget to control the amount of perturbation. Specifically, we apply the staircase randomized response in the aging process. Suppose the flow table consists of \(n\) flow entries. Let \(A=[A_{1},A_{2},\ldots,A_{j}]\) be the set of aging actions that can be taken by a flow entry with the probability \(P=[p,(1-p)/(|A|-1),...,(1-p)/(|A|-1)]\). \(FA_{i}\) is the aging action taken by flow entry \(i\) when the timer fires, and the expectation of \(FA_{i}\), denoted by \(E(FA_{i})\), is computed by Equation (10). Since the sets \(A\) and \(P\) are given for each flow entry, \(E(FA_{i})\) is an unbiased estimate of \(FA_{i}\) for each flow entry \(i\) in the flow table. Intuitively, \(E(FA_{i})\) is an unbiased estimate of flow entry \(i\) that is aged and, therefore, correctly timed. In reality, each element of \(A\) should be an integer, and any two elements in \(A\) should be different, suggesting two different aging actions. While positive integers imply that flow entries are becoming older, negative integers imply that flow entries are becoming younger.