# FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables
## 4 Flow Entry Aging RandOmization Layer  
FEAROL proposes to perturb the lifespan of each flow entry in the flow table locally, instead of involving a centralized differential privacy mechanism at controllers to directly protect the configured flow-entry timeouts. Since the lifespan of a flow entry is defined by the flow-entry timeout, which is typically configured by controllers, distributed to switches through the control channel and stored in flow tables in switches, flow-entry timeout information can be leaked at controllers, control channel and switches. When applying centralized differential privacy mechanisms for flow-entry timeouts, we may need to ensure that the controllers and the control channel are trusted, which is difficult to achieve in reality. Therefore, we chose the local randomized response instead of the central one to protect the flow-entry timeouts.  
As shown in Figure 2, an SDN switch involves a timer to continuously update the existing and idle time of flow entries. Whenever the timer fires, the flow-entry management function updates the current existence and idle time of each flow entry in the flow table. To perturb the flow entry update procedure, FEAROL is implemented in the flow-entry management function as shown in Figure 4. After the timer fires, FEAROL applies a staircase randomized response to determine the aging action that each flow entry should take. FEAROL defines the aging action set \(A\) and the probability set \(P\) and allows each flow entry to take action \(A_{1}\) with the probability of \(p\) and each of the other actions with the probability of \((1-p)/(|A|-1)\).  
FEAROL is a closed-loop process that also consists of a module that can periodically adjust the sets of \(A\) and \(P\) based on the maximum flow table space occupancy \(O\), the current packets forwarded to controllers \(F\) and the current privacy budget \(\epsilon\). Given an adjustment period \(T\), the current privacy budget \(\epsilon\) is computed by Equation (5). The current flow table space occupancy \(O\) is computed using the maximum total number of the currently active flow entries (\(AFE\)) over the total number of flow entries that the flow table can store (\(FE\)) (as shown in Equation (11)) and the current packets forwarded to controllers \(F\), which can be calculated using the packet count of all packets forwarded by the switch to the controller  
Figure 4: The flow chart of FEAROL.  
(as shown in Equation (12)), where \(pp_{i}\in PP\) is a packet received by the switch, and \(a_{i}\) is a binary parameter indicating whether or not \(pp_{i}\) is forwarded to the controllers. Let \(a_{i}\) be 1 if \(f_{i}\) is forwarded and 0 otherwise.  
FEAROL must effectively use the space of the flow table without forwarding too many packets to controllers and while maintaining a reasonable privacy budget. Particularly, FEAROL designs nine strategies, as listed in Table 4. If the flow table space occupancy is greater than 0.8, the switch may be subject to flow table overflow LDoS attacks. FEAROL should use strategies 2 or 5 to reduce \(p\) to reduce the privacy budget \(\epsilon\) and make more space for new incoming flow entries. If the flow table space occupancy is less than 0.5, FEAROL can choose strategies 7 and 4 or strategies 9 or 6 to increase \(p\) and \(\epsilon\), depending on the flow-entry timeouts to control the lifespan of flow entries.  
\[O=\max_{T}AFE/FE \tag{11}\]  
\[F=\sum_{i=1}^{|PP|}a_{i} \tag{12}\]