# SDN-Based Double Hopping Communication against Sniffer Attack

Authors: Zheng Zhao; Daofu Gong; Bin Lu; Fenlin Liu; Chuanhao Zhang
Journal: Mathematical Problems in Engineering
 (2016)

---

## Abstract

Sniffer attack has been a severe threat to network communication security. Traditional network usually uses static network configuration, which provides convenience to sniffer attack. In this paper, an SDN-based double hopping communication (DHC) approach is proposed to solve this problem. In DHC, ends in communication packets as well as the routing paths are changed dynamically. Therefore, the traffic will be distributed to multiple flows and transmitted along different paths. Moreover, the data from multiple users will be mixed, bringing difficulty for attackers in obtaining and recovering the communication data, so that sniffer attack will be prevented effectively. It is concluded that DHC is able to increase the overhead of sniffer attack, as well as the difficulty of communication data recovery.


---

## Body

## 1. Introduction

Sniffer attack is a serious matter for network communication security. Sniffer attack is one of the most popular ways used by attackers, which captures and analyzes network communication data. Sniffer attackers are able to eavesdrop communication data from network nodes or links, monitor network status, and steal sensitive data such as usernames and passwords. However, the static network configurations in traditional network provide convenience for sniffer attack. For instance, static ends and route configurations make it easy for attackers to obtain and analyze communication data.Communication encryption is a traditional approach to preventing sniffer attack. The communication data is encrypted during transmission, making it difficult for attackers to crack the information. However, there are still some limitations in practical applications. Firstly, encryption protocol should be supported by both communicating sides or communication would fail. Secondly, a large number of popular protocols, such as HTTP, FTP, Telnet, and SMTP, do not apply encryption, which causes serious security risk to communication based on these protocols. Thirdly, security flaws exist in some encryption protocols, by which attackers may crack communication data.Moving target defense (MTD) [1–4], a recently proposed technology, uses dynamicity to enhance communication security. The network configuration is dynamically changed to deceive attackers [5, 6], avoid attacks [7–9], and defend against attacks [10, 11]. However, potential attacks still exist even if single network configuration is changed [5]. Changes of multiple network configurations can enhance the dynamicity of the network and further improve network security.Collaborative changes of multiple network configurations put forward higher requirements on capabilities of networks management. Distributed control is adopted in traditional IP network, in which the routing table configuration relies on routing protocols. In this paradigm, serious consequences, such as service interruptions and routing inflation, can appear due to the changing network configuration [9]. And it is hard for traditional network to change multiple network configuration collaboratively. For example, it is difficult for MPLS, a high-speed networking technique used in traditional network, to implement dynamic resources changes due to the lack of a global view and flexible resource allocation [12]. Dynamic transformation of host IP configuration is attempted to be realized in traditional network in [9], but the cost is high because several new devices are introduced. So collaborative changes among multiple network configurations demand powerful management of the network. Emerging software-defined network (SDN) [13] brings new method to realize dynamic network configuration. SDN decouples the control plane and the forwarding plane (data plane) and applies logic centralized control. The powerful network management and control ability of SDN make the realization of dynamic network configuration more flexible. The programmable nature of SDN can control flowtable of forwarding devices directly and avoid service interruptions and routing inflation. The centralized control of SDN makes it possible to have a global view of network. Therefore collaborative changes of multiple network configuration can be realized.In this paper, double hopping communication (DHC) is proposed based on SDN architecture to enhance the ability to resist sniffer attack. DHC periodically changes the end information of both communication sides as well as the routing paths between them, thus realizing double hopping of end and route. In DHC, communication data is transmitted among multiple paths and data flow from multiple users will be mixed. It is difficult for attackers to obtain complete data from one communication in DHC and moreover it sets obstacles to avoid the attackers to correctly separate data of one single user among all the data they obtain. Therefore, overhead and difficulty for attackers to obtain and analyze communication data are dramatically increased due to the disability of attackers to conduct targeted sniffing. In addition, DHC is constructed based on SDN, which is transparent to the terminals and neither extra external software nor hardware is needed.The rest of the paper is organized as follows. In Section2 related works are discussed. Section 3 describes the basic principles of DHC. In Section 4 we describe the basic architecture and communication protocols of DHC. Section 5 presents the prototype deployment and simulation experiment and security of DHC are analyzed in Section 6. Section 7 concludes the paper.


## 2. Related Work

Hopping communication, based on dynamic and randomness of MTD technology, is one type of active network defense methods, aimed at breaking the hypothesis of static network configuration, and can improve network security via dynamic and randomness [11, 14]. Currently, researchers have proposed different hopping communication techniques. Atighetchi et al. [6] proposed a hopping approach based on fake address and port. Fake addresses and ports are used during data transmission to confuse attackers. Sifalakis et al. [15] proposed one network address hopping method (NAH) based on information hiding technique. Data flow is spread across multiple end-to-end connections by network address hopping during transmission. Thus point-to-point data transmission security could be improved. In [10] a random port-hopping (RPH) scheme was proposed to defend DDoS attacks by changing the communication ports. MT6D [16], proposed by Dunlop et al., taking the advantage of address space of IPv6 and robust IP hopping strategy, is achieved. Tunnel technique is used to encapsulate the packets. Source and destination IP addresses of the tunnel are changed repeatedly, making it difficult for attackers to sniff communication traffic. The approaches described above have their own advantages. However, in all of these methods, end is hopped, while routing path stays unchanged, which makes it possible for attackers to obtain complete communication data and therefore recover communication data. Moreover, in order to realize hopping communication, deploying software on terminal and adding hardware in the network are needed, which causes high cost.In traditional network, quick cooperative hopping is difficult in distributed route management. However, the emerging software-defined network has brought new methods to hopping communication. Based on SDN, Kampanakis et al. [5] proposed three kinds of MTD methods, including reconnaissance protection, service version/OS hiding, and random host/route mutation. Attack cost, benefits, and potential attackers’ countermeasures of these three methods are analyzed, respectively, in this work. These methods involve network scanning, DDoS, and worm, but DHC focuses on sniffer attack. In the SDN architecture, a flexible as well as transparent to terminal IP hopping method, called OF-RHM [7, 17], is proposed by Jafarian et al. It is true that the effectivity of sniffer attack is decreased by OF-RHM, but virtual IP should stay unchanged during one continuous communication, which enables attackers to obtain complete data of one communication from a switch. Jafarian et al. [18] proposed a technique in which hopping is implemented temporarily and spatially in order to interfere with attackers’ views of the network. This hopping communication can defeat collaborative scanning attacks effectively. However, in our work, multiple network configurations are changed dynamically to enhance the dynamism of network for resisting sniffer attack. The work in [19] achieves fast IP hopping to resist scanning and worm propagation. The method discovers hazardous network ranges and addresses adaptively and evacuates network hosts from them quickly. MacFarland and Shue [20] provide a scalable moving target system to enable key security properties and maintain acceptable performance. The method distinguishes trustworthy and untrustworthy clients to provide access control for legacy clients.There exist multiple paths between two nodes in network topology, which are used by researchers to improve communication security. An active random route mutation (RRM) method is proposed by Duan et al. [8, 21] and applied in SDN environment. Routes of multiple flows in the network are changed randomly and simultaneously. However, multiple uncrossed paths between source and destination are required, which is difficult to satisfy in common network topology. In addition, no end hopping is involved in RRM method, which enables attackers to recover communication data between hosts by sniffing multiple switches. Dolev and David [22] use multiple paths between datacenters to achieve secure communication. In order to ensure the privacy, an n
-
k secret sharing method is used to encrypt communication data. The source creates n shares of its data, then sends them along multiple paths, and makes sure that no k or more shares pass the same router. Thus the method achieves theoretically secured channel to the public cloud. However, in our work, ends and route paths are changed frequently to increase the cost of attacks while obtaining and reconstructing communication data. Gillani et al. [23] migrate virtual routers among multiple paths to invalidate the network topology probe of attacks; therefore link DDoS attacks are resisted. Gkounis et al. [24] proposed a method based on SDN architecture to detect and mitigate Crossfire attack [25] by rerouting traffic via multiple paths. The two abovementioned works aim to resist link DDoS attacks, while our work, aimed at resisting sniffer attack, increases the cost of attackers through changes of ends and routing paths.


## 3. Basic Principles of DHC

In static configuration based network communication, when two hosts communicate on one connection, all the packets in communication contain information about this connection and the transmission path of the communication packets is static. These two facts provide convenience for attackers to sniff network communication. Attackers are able to obtain communication data easily from the target by sniffing network flow based on target end on transmission path. In DHC approach, both end and route are hopped based on SDN architecture. Dynamic and randomness are introduced in communication for two dimensions: end and route. For the data plane, random hopping end and route are configured by the controller in every hopping period after one connection is established. In the meantime, both end hopping and route hopping are achieved.In DHC, ends in both communication sides hop dynamically. The data from multiple users will be mixed and end-to-end traffic is hidden in network background traffic. Frequent hopping of the end brings difficulty for attackers to select and sort the sniffed packets as well as recovering the initial data. Thus the difficulty of analyzing communication data is increased. Route hopping changes routing paths of the packets dynamically, spreading the communication traffic into multiple routing paths. In this way, overhead and difficulty of sniffing are increased since continuous communication data is difficult to obtain. To sum up, double hopping of both end and route limits the communication data that attackers can obtain and set obstacles for attackers to analyze the data.


## 4. Basic Architecture of DHC

When conducting hopping communication in DHC, end and routing path that are about to hop are selected first. Then flowtables are updated according to hopping protocol. Thus end hopping space and route hopping space as well as hopping communication protocol should be taken into consideration to realize DHC.


### 4.1. End Hopping Space

End consists of IP address of the host and port in communication. It is an essential element of communication between two hosts in network and it uniquely defines one communication side in network. One connection in network communication contains IP addresses and ports of both source and destination hosts. Therefore,E
I
=
I
P
s
r
c
,
P
s
r
c
,
I
P
d
s
t
,
P
d
s
t is defined to represent the end of one connection. End of packets mentioned through the paper refers to this definition. In DHC, end hopping space S
E
H consists of hopping IP addresses and hopping ports. Given IP address pool A
d
d
r
=
{
I
P
1
,
I
P
2
,
…
,
I
P
m
} and hopping port pool P
o
r
t
=
{
P
1
,
P
2
,
…
,
P
n
}, end hopping space can be represented by(1)
S
EH
=
IP
src
,
P
src
,
IP
dst
,
P
dst
∣
IP
src
,
IP
dst
∈
Addr
,
IP
src
≠
IP
dst
,
P
src
,
P
dst
∈
Port
.Unoccupied hopping ends are randomly selected in S
E
H to replace the real ends in communication when the ends need hopping.


### 4.2. Route Hopping Space

One routing path between source and destination hosts is a sequence that consists of forwarding nodes (i.e., OF switch). DefineP
a
t
h
=
n
o
d
e
s
r
c
,
n
o
d
e
1
,
n
o
d
e
2
,
…
,
n
o
d
e
d
s
t, where n
o
d
e
s
r
c connects with source host and is called source forwarding node (source switch); n
o
d
e
d
s
t connects with destination host and is called destination forwarding node (destination switch). Under SDN architecture, controller has the global network view. Therefore, all paths connecting source and destination hosts that satisfy certain conditions can be calculated, constituting the route hopping space.Suppose the source hostH
1 communicates with destination host H
2; the corresponding route hopping space S
R
H
H
1
→
H
2 will be calculated as follows:(1)
Calculate all acyclic paths betweenH
1 and H
2 that are not longer than the maximum path length L according to the topology of network and constitute the path set P
a
t
h
S
e
t
H
1
→
H
2.
(2)
ForP
a
t
h
i
,
P
a
t
h
j
∈
P
a
t
h
S
e
t
H
1
→
H
2, if N
o
d
e
s
(
P
a
t
h
i
)
⊂
N
o
d
e
s
(
P
a
t
h
j
) holds, delete P
a
t
h
j from path set P
a
t
h
S
e
t
H
1
→
H
2, where N
o
d
e
s
(
P
a
t
h
i
) represents the set of nodes that path P
a
t
h
i passes. The reason for deleting P
a
t
h
j is that no node in P
a
t
h
i can be avoided when packets pass along P
a
t
h
j, which leads to a longer path.The route hopping spaceS
R
H
H
1
→
H
2 is obtained from the steps above. If S
R
H
H
1
→
H
2
>
1 holds, the paths in S
R
H
H
1
→
H
2 satisfy the following: ∀
P
a
t
h
i
,
P
a
t
h
j
∈
S
R
H
H
1
→
H
2, P
a
t
h
i
≠
P
a
t
h
j, there exists n
o
d
e
∈
N
o
d
e
s
(
P
a
t
h
i
) and n
o
d
e
∉
N
o
d
e
s
(
P
a
t
h
j
), which means that P
a
t
h
j does not pass at least one node in P
a
t
h
i.In order to guarantee the unpredictability of the hopping path, randomness in hopping path selection is essential. One simple method is random path selection which randomly selects one path inS
R
H
H
1
→
H
2 at the beginning of each period and takes it as the hopping path during the period. The probability of selection for each path in S
R
H
H
1
→
H
2 is identical. However, traffic may be forwarded unbalanced by the nodes, which means possibility of large amount of traffic forwarded by one single node exists. In this case, if attackers sniff on this specific node, large amount of communication data will be obtained easily. The reason is that paths in S
R
H
H
1
→
H
2 intersect. Fortunately, this threat can be eliminated in DHC by using weighted random path selection.For a node, we defineC
H
1
→
H
2
(
n
o
d
e
) as the number of paths in route hopping space S
R
H
H
1
→
H
2 that pass through n
o
d
e. For a node set s
e
t, we define C
H
1
→
H
2
(
s
e
t
)
=
C
H
1
→
H
2
n
o
d
e
∣
n
o
d
e
∈
s
e
t. Suppose that, for one connection between hosts H
1 and H
2, there is P
a
t
h
k
∈
S
R
H
H
1
→
H
2. d
(
P
a
t
h
k
) donates the node set that contains the nodes left after common nodes (e.g., source forwarding node and destination forwarding node) through which all paths in S
R
H
H
1
→
H
2 pass are deleted. The weight of P
a
t
h
k is defined (2)
W
e
i
g
h
t
P
a
t
h
k
=
1
/
Max
⁡
C
H
1
→
H
2
d
P
a
t
h
k
∑
P
a
t
h
i
∈
S
RH
H
1
→
H
2
1
/
Max
⁡
C
H
1
→
H
2
d
P
a
t
h
i
,where the function Max
⁡ gets the maximum value in C
H
1
→
H
2
(
s
e
t
). By using the weighting function above, lower weight is assigned to paths with nodes that more paths cross. Therefore, chances for overmuch traffic passes through one single node (except common nodes for all paths) in network due to intersection are eliminated.Weighted random path selection algorithm is shown in Algorithm1. The probability of one path to be chosen is set as the weight for the path. The inputs of the algorithm include paths P
a
t
h
1
,
…
,
P
a
t
h
u in route hopping space S
R
H
H
1
→
H
2, corresponding weights w
1
,
…
,
w
u, and a random number R
a
n
d
N
u
m
∈
[
0,1
]. In the algorithm, weights are accumulated for each path in steps 2 to 6. The path corresponding to the weight is returned when the sum of accumulated weights is bigger than or equal to the random number R
a
n
d
N
u
m.Algorithm 1:Weighted random path selection algorithm.
Input: P
a
t
h
1
,
…
,
P
a
t
h
u, w
1
,
…
,
w
u, R
a
n
d
N
u
m
Output: P
a
t
h
WeightedRandomPathSelect(P
a
t
h
1
,
…
,
P
a
t
h
u, w
1
,
…
,
w
u, R
a
n
d
N
u
m)
(1) sum = 0
(2)for  i in (1,2
,
…
,
u)
(3)new
_
sum
←
sum
+
w
i
(4)if sum < RandNum ≤ new_sum
(5)return  P
a
t
h
i
(6)else sum = new_sum


### 4.3. DHC Protocol

In DHC, for each periodT
h
o
p, one hopping end h
E
I and one path from source to destination P
a
t
h are randomly chosen. New flow entries are generated by the controller and installed in OF switches. End of packets from source host is modified to h
E
I and these packets are transmitted to destination host along P
a
t
h. Then double hopping of end and route with period T
h
o
p as granularity is realized.


#### 4.3.1. Double Hopping

The basic protocol of DHC is illustrated in Figure1. It is a network with SDN architecture, in which host H
1 communicates with H
2. Denote end hopping space as S
E
H and route hopping space of the communication as S
R
H
H
1
→
H
2. Firstly, initial end r
E
I
=
I
P
1
,
P
1
,
I
P
2
,
P
2 is generated by H
1 according to the real IP address and port of two communication sides; then the address of the communication is determined.Figure 1
An example of double hopping communication.Detailed steps of double hopping are as follows:(1)
The first packet containingr
E
I is sent to the network by H
1. OF switch S
1 receives the packet and encapsulates it as a packet-in message. Then the packet-in message is sent to the controller.
(2)
The packet-in message is deencapsulated by the controller andr
E
I is extracted. Then hopping end h
E
I
1
=
I
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ is selected randomly in S
E
H. Route hopping space S
R
H
H
1
→
H
2 is calculated by the controller and P
a
t
h
1
=
S
1
,
S
2
,
S
5 is chosen using weighted random path selection algorithm. With the knowledge of h
E
I
1 and P
a
t
h
1, controller generates flow entries encapsulated as modify-state messages and sends them to OF switches S
1, S
2, and S
5. Corresponding modification and routing of the packets are conducted.
(3)
EndsI
P
1
,
P
1
,
I
P
2
,
P
2 in the packets are modified to I
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ by source switch S
1 and the modified packets are forwarded to OF switch S
2 then to destination switch S
1.
(4)
EndsI
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ in the packets are recovered to the r
E
I and forwarded to host H
2 by destination switch S
5. Then H
2 receives the packets from H
1.In this communication, the hopping end is recalculated by the controller for a hopping periodT
h
o
p and is represented as h
E
I
2
=
I
P
1
′
′
,
P
1
′
′
,
I
P
2
′
′
,
P
2
′
′ as shown in Figure 1. A new path, denoted as P
a
t
h
2
=
S
1
,
S
3
,
S
4
,
S
5, is selected in S
R
H
H
1
→
H
2using weighted random path selection algorithm. Then the flow entries in OF switches are updated. Source switch S
1 modifies the end in the packets sent from H
1 to H
2 as h
E
I
2 and forwards the modified packets along P
a
t
h
2. In destination switch S
5, the end of these packets is recovered to the real end I
P
1
,
P
1
,
I
P
2
,
P
2.The procedure described above does not modify the real end on both hosts. Instead it modifies the end and routing path of the communication packets dynamically in network transmission. The source and destination hosts can achieve hopping communication transparently in network without interrupting the ongoing communication. Once the packets of communication betweenH
1 and H
2 enter the network, end of the packets and routing path are hopped with time. For each hopping period T
h
o
p, the hopping end and route will be reconfigured by the controller. The communication will be considered finished when the controller detects the fact that the flow entries are not hit in a hopping period via flow-removed messages sent by switches. Thus flow entries will not be updated.


#### 4.3.2. Flow Entries Update

Flow entries in OF switches need to be updated when end and route are hopped in DHC. Moreover, it should be guaranteed that the flow entries update is consistent and no packet is lost. Suppose that hopping communication is conducted in the network topology as shown in Figure2. Assume that the end is being hopped by switch S
1 currently, end changes from r
E
I to h
E
I
1, and the packets are being transmitted along path (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
). At this circumstance, to hop the end of the packets from r
E
I to h
E
I
2 and to hop the routing path from (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
) to (
S
1
,
S
2
,
S
6
,
S
7
,
S
4
,
S
5
), the steps of updating flow entries are as follows:(1)
Controller sends modify-state messages to install new flow entries in switchesS
2, S
6, S
7, S
4, S
5 for forwarding the packets with end h
E
I
2. At this time, the new flow entries will not be hit by packets, because there are no packets in the network that contain the end h
E
I
2.
(2)
Controller sends modify-state messages to modify the flow entry in switchS
1; thus the end of packets is converted from r
E
I to h
E
I
2.
(3)
Controller sends modify-state messages to delete the old flow entries in switchesS
2, S
3, S
4, S
5 after the maximum transmission delay of path (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
) is reached.Figure 2
An example of flow entries update.The method to update the flow entries described above can guarantee that the traffic is routed by the old flow entries during update, avoiding packets loss. In addition, traffic is routed by the updated flow entries after update, maintaining per-packet consistency.


## 4.1. End Hopping Space

End consists of IP address of the host and port in communication. It is an essential element of communication between two hosts in network and it uniquely defines one communication side in network. One connection in network communication contains IP addresses and ports of both source and destination hosts. Therefore,E
I
=
I
P
s
r
c
,
P
s
r
c
,
I
P
d
s
t
,
P
d
s
t is defined to represent the end of one connection. End of packets mentioned through the paper refers to this definition. In DHC, end hopping space S
E
H consists of hopping IP addresses and hopping ports. Given IP address pool A
d
d
r
=
{
I
P
1
,
I
P
2
,
…
,
I
P
m
} and hopping port pool P
o
r
t
=
{
P
1
,
P
2
,
…
,
P
n
}, end hopping space can be represented by(1)
S
EH
=
IP
src
,
P
src
,
IP
dst
,
P
dst
∣
IP
src
,
IP
dst
∈
Addr
,
IP
src
≠
IP
dst
,
P
src
,
P
dst
∈
Port
.Unoccupied hopping ends are randomly selected in S
E
H to replace the real ends in communication when the ends need hopping.


## 4.2. Route Hopping Space

One routing path between source and destination hosts is a sequence that consists of forwarding nodes (i.e., OF switch). DefineP
a
t
h
=
n
o
d
e
s
r
c
,
n
o
d
e
1
,
n
o
d
e
2
,
…
,
n
o
d
e
d
s
t, where n
o
d
e
s
r
c connects with source host and is called source forwarding node (source switch); n
o
d
e
d
s
t connects with destination host and is called destination forwarding node (destination switch). Under SDN architecture, controller has the global network view. Therefore, all paths connecting source and destination hosts that satisfy certain conditions can be calculated, constituting the route hopping space.Suppose the source hostH
1 communicates with destination host H
2; the corresponding route hopping space S
R
H
H
1
→
H
2 will be calculated as follows:(1)
Calculate all acyclic paths betweenH
1 and H
2 that are not longer than the maximum path length L according to the topology of network and constitute the path set P
a
t
h
S
e
t
H
1
→
H
2.
(2)
ForP
a
t
h
i
,
P
a
t
h
j
∈
P
a
t
h
S
e
t
H
1
→
H
2, if N
o
d
e
s
(
P
a
t
h
i
)
⊂
N
o
d
e
s
(
P
a
t
h
j
) holds, delete P
a
t
h
j from path set P
a
t
h
S
e
t
H
1
→
H
2, where N
o
d
e
s
(
P
a
t
h
i
) represents the set of nodes that path P
a
t
h
i passes. The reason for deleting P
a
t
h
j is that no node in P
a
t
h
i can be avoided when packets pass along P
a
t
h
j, which leads to a longer path.The route hopping spaceS
R
H
H
1
→
H
2 is obtained from the steps above. If S
R
H
H
1
→
H
2
>
1 holds, the paths in S
R
H
H
1
→
H
2 satisfy the following: ∀
P
a
t
h
i
,
P
a
t
h
j
∈
S
R
H
H
1
→
H
2, P
a
t
h
i
≠
P
a
t
h
j, there exists n
o
d
e
∈
N
o
d
e
s
(
P
a
t
h
i
) and n
o
d
e
∉
N
o
d
e
s
(
P
a
t
h
j
), which means that P
a
t
h
j does not pass at least one node in P
a
t
h
i.In order to guarantee the unpredictability of the hopping path, randomness in hopping path selection is essential. One simple method is random path selection which randomly selects one path inS
R
H
H
1
→
H
2 at the beginning of each period and takes it as the hopping path during the period. The probability of selection for each path in S
R
H
H
1
→
H
2 is identical. However, traffic may be forwarded unbalanced by the nodes, which means possibility of large amount of traffic forwarded by one single node exists. In this case, if attackers sniff on this specific node, large amount of communication data will be obtained easily. The reason is that paths in S
R
H
H
1
→
H
2 intersect. Fortunately, this threat can be eliminated in DHC by using weighted random path selection.For a node, we defineC
H
1
→
H
2
(
n
o
d
e
) as the number of paths in route hopping space S
R
H
H
1
→
H
2 that pass through n
o
d
e. For a node set s
e
t, we define C
H
1
→
H
2
(
s
e
t
)
=
C
H
1
→
H
2
n
o
d
e
∣
n
o
d
e
∈
s
e
t. Suppose that, for one connection between hosts H
1 and H
2, there is P
a
t
h
k
∈
S
R
H
H
1
→
H
2. d
(
P
a
t
h
k
) donates the node set that contains the nodes left after common nodes (e.g., source forwarding node and destination forwarding node) through which all paths in S
R
H
H
1
→
H
2 pass are deleted. The weight of P
a
t
h
k is defined (2)
W
e
i
g
h
t
P
a
t
h
k
=
1
/
Max
⁡
C
H
1
→
H
2
d
P
a
t
h
k
∑
P
a
t
h
i
∈
S
RH
H
1
→
H
2
1
/
Max
⁡
C
H
1
→
H
2
d
P
a
t
h
i
,where the function Max
⁡ gets the maximum value in C
H
1
→
H
2
(
s
e
t
). By using the weighting function above, lower weight is assigned to paths with nodes that more paths cross. Therefore, chances for overmuch traffic passes through one single node (except common nodes for all paths) in network due to intersection are eliminated.Weighted random path selection algorithm is shown in Algorithm1. The probability of one path to be chosen is set as the weight for the path. The inputs of the algorithm include paths P
a
t
h
1
,
…
,
P
a
t
h
u in route hopping space S
R
H
H
1
→
H
2, corresponding weights w
1
,
…
,
w
u, and a random number R
a
n
d
N
u
m
∈
[
0,1
]. In the algorithm, weights are accumulated for each path in steps 2 to 6. The path corresponding to the weight is returned when the sum of accumulated weights is bigger than or equal to the random number R
a
n
d
N
u
m.Algorithm 1:Weighted random path selection algorithm.
Input: P
a
t
h
1
,
…
,
P
a
t
h
u, w
1
,
…
,
w
u, R
a
n
d
N
u
m
Output: P
a
t
h
WeightedRandomPathSelect(P
a
t
h
1
,
…
,
P
a
t
h
u, w
1
,
…
,
w
u, R
a
n
d
N
u
m)
(1) sum = 0
(2)for  i in (1,2
,
…
,
u)
(3)new
_
sum
←
sum
+
w
i
(4)if sum < RandNum ≤ new_sum
(5)return  P
a
t
h
i
(6)else sum = new_sum


## 4.3. DHC Protocol

In DHC, for each periodT
h
o
p, one hopping end h
E
I and one path from source to destination P
a
t
h are randomly chosen. New flow entries are generated by the controller and installed in OF switches. End of packets from source host is modified to h
E
I and these packets are transmitted to destination host along P
a
t
h. Then double hopping of end and route with period T
h
o
p as granularity is realized.


### 4.3.1. Double Hopping

The basic protocol of DHC is illustrated in Figure1. It is a network with SDN architecture, in which host H
1 communicates with H
2. Denote end hopping space as S
E
H and route hopping space of the communication as S
R
H
H
1
→
H
2. Firstly, initial end r
E
I
=
I
P
1
,
P
1
,
I
P
2
,
P
2 is generated by H
1 according to the real IP address and port of two communication sides; then the address of the communication is determined.Figure 1
An example of double hopping communication.Detailed steps of double hopping are as follows:(1)
The first packet containingr
E
I is sent to the network by H
1. OF switch S
1 receives the packet and encapsulates it as a packet-in message. Then the packet-in message is sent to the controller.
(2)
The packet-in message is deencapsulated by the controller andr
E
I is extracted. Then hopping end h
E
I
1
=
I
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ is selected randomly in S
E
H. Route hopping space S
R
H
H
1
→
H
2 is calculated by the controller and P
a
t
h
1
=
S
1
,
S
2
,
S
5 is chosen using weighted random path selection algorithm. With the knowledge of h
E
I
1 and P
a
t
h
1, controller generates flow entries encapsulated as modify-state messages and sends them to OF switches S
1, S
2, and S
5. Corresponding modification and routing of the packets are conducted.
(3)
EndsI
P
1
,
P
1
,
I
P
2
,
P
2 in the packets are modified to I
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ by source switch S
1 and the modified packets are forwarded to OF switch S
2 then to destination switch S
1.
(4)
EndsI
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ in the packets are recovered to the r
E
I and forwarded to host H
2 by destination switch S
5. Then H
2 receives the packets from H
1.In this communication, the hopping end is recalculated by the controller for a hopping periodT
h
o
p and is represented as h
E
I
2
=
I
P
1
′
′
,
P
1
′
′
,
I
P
2
′
′
,
P
2
′
′ as shown in Figure 1. A new path, denoted as P
a
t
h
2
=
S
1
,
S
3
,
S
4
,
S
5, is selected in S
R
H
H
1
→
H
2using weighted random path selection algorithm. Then the flow entries in OF switches are updated. Source switch S
1 modifies the end in the packets sent from H
1 to H
2 as h
E
I
2 and forwards the modified packets along P
a
t
h
2. In destination switch S
5, the end of these packets is recovered to the real end I
P
1
,
P
1
,
I
P
2
,
P
2.The procedure described above does not modify the real end on both hosts. Instead it modifies the end and routing path of the communication packets dynamically in network transmission. The source and destination hosts can achieve hopping communication transparently in network without interrupting the ongoing communication. Once the packets of communication betweenH
1 and H
2 enter the network, end of the packets and routing path are hopped with time. For each hopping period T
h
o
p, the hopping end and route will be reconfigured by the controller. The communication will be considered finished when the controller detects the fact that the flow entries are not hit in a hopping period via flow-removed messages sent by switches. Thus flow entries will not be updated.


### 4.3.2. Flow Entries Update

Flow entries in OF switches need to be updated when end and route are hopped in DHC. Moreover, it should be guaranteed that the flow entries update is consistent and no packet is lost. Suppose that hopping communication is conducted in the network topology as shown in Figure2. Assume that the end is being hopped by switch S
1 currently, end changes from r
E
I to h
E
I
1, and the packets are being transmitted along path (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
). At this circumstance, to hop the end of the packets from r
E
I to h
E
I
2 and to hop the routing path from (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
) to (
S
1
,
S
2
,
S
6
,
S
7
,
S
4
,
S
5
), the steps of updating flow entries are as follows:(1)
Controller sends modify-state messages to install new flow entries in switchesS
2, S
6, S
7, S
4, S
5 for forwarding the packets with end h
E
I
2. At this time, the new flow entries will not be hit by packets, because there are no packets in the network that contain the end h
E
I
2.
(2)
Controller sends modify-state messages to modify the flow entry in switchS
1; thus the end of packets is converted from r
E
I to h
E
I
2.
(3)
Controller sends modify-state messages to delete the old flow entries in switchesS
2, S
3, S
4, S
5 after the maximum transmission delay of path (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
) is reached.Figure 2
An example of flow entries update.The method to update the flow entries described above can guarantee that the traffic is routed by the old flow entries during update, avoiding packets loss. In addition, traffic is routed by the updated flow entries after update, maintaining per-packet consistency.


## 4.3.1. Double Hopping

The basic protocol of DHC is illustrated in Figure1. It is a network with SDN architecture, in which host H
1 communicates with H
2. Denote end hopping space as S
E
H and route hopping space of the communication as S
R
H
H
1
→
H
2. Firstly, initial end r
E
I
=
I
P
1
,
P
1
,
I
P
2
,
P
2 is generated by H
1 according to the real IP address and port of two communication sides; then the address of the communication is determined.Figure 1
An example of double hopping communication.Detailed steps of double hopping are as follows:(1)
The first packet containingr
E
I is sent to the network by H
1. OF switch S
1 receives the packet and encapsulates it as a packet-in message. Then the packet-in message is sent to the controller.
(2)
The packet-in message is deencapsulated by the controller andr
E
I is extracted. Then hopping end h
E
I
1
=
I
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ is selected randomly in S
E
H. Route hopping space S
R
H
H
1
→
H
2 is calculated by the controller and P
a
t
h
1
=
S
1
,
S
2
,
S
5 is chosen using weighted random path selection algorithm. With the knowledge of h
E
I
1 and P
a
t
h
1, controller generates flow entries encapsulated as modify-state messages and sends them to OF switches S
1, S
2, and S
5. Corresponding modification and routing of the packets are conducted.
(3)
EndsI
P
1
,
P
1
,
I
P
2
,
P
2 in the packets are modified to I
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ by source switch S
1 and the modified packets are forwarded to OF switch S
2 then to destination switch S
1.
(4)
EndsI
P
1
′
,
P
1
′
,
I
P
2
′
,
P
2
′ in the packets are recovered to the r
E
I and forwarded to host H
2 by destination switch S
5. Then H
2 receives the packets from H
1.In this communication, the hopping end is recalculated by the controller for a hopping periodT
h
o
p and is represented as h
E
I
2
=
I
P
1
′
′
,
P
1
′
′
,
I
P
2
′
′
,
P
2
′
′ as shown in Figure 1. A new path, denoted as P
a
t
h
2
=
S
1
,
S
3
,
S
4
,
S
5, is selected in S
R
H
H
1
→
H
2using weighted random path selection algorithm. Then the flow entries in OF switches are updated. Source switch S
1 modifies the end in the packets sent from H
1 to H
2 as h
E
I
2 and forwards the modified packets along P
a
t
h
2. In destination switch S
5, the end of these packets is recovered to the real end I
P
1
,
P
1
,
I
P
2
,
P
2.The procedure described above does not modify the real end on both hosts. Instead it modifies the end and routing path of the communication packets dynamically in network transmission. The source and destination hosts can achieve hopping communication transparently in network without interrupting the ongoing communication. Once the packets of communication betweenH
1 and H
2 enter the network, end of the packets and routing path are hopped with time. For each hopping period T
h
o
p, the hopping end and route will be reconfigured by the controller. The communication will be considered finished when the controller detects the fact that the flow entries are not hit in a hopping period via flow-removed messages sent by switches. Thus flow entries will not be updated.


## 4.3.2. Flow Entries Update

Flow entries in OF switches need to be updated when end and route are hopped in DHC. Moreover, it should be guaranteed that the flow entries update is consistent and no packet is lost. Suppose that hopping communication is conducted in the network topology as shown in Figure2. Assume that the end is being hopped by switch S
1 currently, end changes from r
E
I to h
E
I
1, and the packets are being transmitted along path (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
). At this circumstance, to hop the end of the packets from r
E
I to h
E
I
2 and to hop the routing path from (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
) to (
S
1
,
S
2
,
S
6
,
S
7
,
S
4
,
S
5
), the steps of updating flow entries are as follows:(1)
Controller sends modify-state messages to install new flow entries in switchesS
2, S
6, S
7, S
4, S
5 for forwarding the packets with end h
E
I
2. At this time, the new flow entries will not be hit by packets, because there are no packets in the network that contain the end h
E
I
2.
(2)
Controller sends modify-state messages to modify the flow entry in switchS
1; thus the end of packets is converted from r
E
I to h
E
I
2.
(3)
Controller sends modify-state messages to delete the old flow entries in switchesS
2, S
3, S
4, S
5 after the maximum transmission delay of path (
S
1
,
S
2
,
S
3
,
S
4
,
S
5
) is reached.Figure 2
An example of flow entries update.The method to update the flow entries described above can guarantee that the traffic is routed by the old flow entries during update, avoiding packets loss. In addition, traffic is routed by the updated flow entries after update, maintaining per-packet consistency.


## 5. Prototype Deployment and Simulation Experiment

### 5.1. Prototype Deployment

To verify the performance and security of DHC, DhcFlower, a prototype based on SDN controller is implemented. As shown in Figure3, DhcFlower runs on the top of SDN controller which manages switches through OpenFlow.Figure 3
DHC prototype deployment.In the prototype deployment of DHC, TopologyDiscovery reports the changes of network topology and updates view of network. FlowMonitor monitors the flow state of network to find initiation and termination of connections. Based on the view and flow state of network, DhcFlower chooses the ends and routing paths to convert network configurations.Detailed structure of DhcFlower is shown in Figure4. TopologyDiscovery updates topology database TopologyInfo with the changes of network topology. Using the network topology information, hopping path calculator calculates multiple paths of each pair of nodes and stores hopping path information in the hopping path pool. Hopping ends are stored in Hopping end pool. With hopping end pool and hopping path pool, double hopping engine, as the core module, chooses the hopping end and path based on flow state information. Afterwards, strategies of hopping are generated. Flow updater generates flow entries based on hopping strategies and updates the flowtables in a specific order.Figure 4
Makeup of DhcFlower.


### 5.2. Simulation Experiment

To evaluate DHC, we have operated our implement prototype over the Mininet [26]. OpenFlow 1.0 [27] is applied and POX [28] is used as controller. A class B address block is chosen as hopping IP address pool and hopping port pool denoted as 0,1
,
…
,
65535. Network topology proposed by [29] is applied, which has 16 nodes (forwarding nodes) as illustrated in Figure 5. The maximum path length L is set to 32.Figure 5
Network topology applied in the experiment.


#### 5.2.1. Validation of the Effectiveness of End Hopping

UDP packets from terminal on node 1 are sent to terminal on node 16 for 500 s. Packets are sniffed on the forwarding nodes and the number of ends received on each node is counted. The sniffing results in DHC and traditional network are shown in Figure6.Figure 6
Number of ends sniffed from single flow.As demonstrated in Figure6, on some forwarding nodes in traditional network, such as nodes 4, 7, 8, and 12, only one end is able to be sniffed. However, in DHC, apart from source and destination forwarding nodes, multiple ends can be sniffed on other forwarding nodes. Due to the invariant of packets’ end in traditional networks, end that is sniffed stays unchangeable, which brings convenience for attackers. Attackers can launch a targeted sniffer to any connection and obtain the complete communication data of the connection. In DHC, end changes randomly and periodically. The ends sniffed on forwarding nodes between source and destination hosts are various. It is difficult for attackers to determine the ends from the same connection, increasing the difficulty in reconstructing the communication data. Moreover, the more frequently ends hop, the more ends will be sniffed on forwarding nodes. It can be seen in Figure 6 that more ends are sniffed when T
h
o
p
=
5 s compared with T
h
o
p
=
10 s. In addition, fewer ends can be sniffed on forwarding node 9 than other nodes as can be seen in the figure. The reason is that fewer paths pass through forwarding node 9 than other nodes; thus the probability of being hit by weighted random selection is lower.


#### 5.2.2. Validation of the Effectiveness of Route Hopping

In the experiment, 106 packets are transmitted from node 5 to node 6 with the speed of 104 packets per second. The hopping period T
h
o
p is set to 5 s. Packets are sniffed on the forwarding nodes and the number of packets sniffed is counted. In DHC network, random path selection and weighted random path selection are applied to conduct hopping communication. Sniffing results are compared with traditional network communication, as shown in Figure 7.Figure 7
Percentage of packets sniffed from single flow.In Figure7, the vertical coordinate stands for the fraction of all the packets transmitted from node 5 to node 6. As we can see, in traditional network, complete communication data from source host to destination host can be sniffed on some nodes (e.g., nodes 6, 11, and 12), which means that attackers can sniff complete data on any of the nodes and further data analysis is possible. Since shortest-path routing is applied in traditional network and the path stays unchanged during communication, the complete communication data can be obtained on any node that the shortest path goes through. In DHC, packets of a connection are distributed to several paths by route hopping. It is difficult for attackers to sniff complete data on single forwarding node. Possibility for sniffing large amount of data on a certain nodes exists if random path selection is applied. As shown in Figure 7, more than 50% of the data can be sniffed on forwarding nodes 4, 8, and 12. Applying weighed random path selection can avoid excessive traffic passing through certain nodes. The reason is that lower weight is assigned to paths with nodes that more paths cross.


#### 5.2.3. Validation of Effectiveness of Antisniffer Attack

In the experiment, 100 MB data had been transmitted from node 1 to node 16 for 500 s. The hopping periodT
h
o
p is set to 5 s. Data is sniffed on node sets A
1
=
8, A
2
=
8,9, A
3
=
8,9
,
10, and A
4
=
8,9
,
10,11, respectively. The shortest path from node 1 to node 16 is 1
→
4
→
7
→
8
→
12
→
16. The percentage of data sniffed on node sets A
1, A
2, A
3, and A
4 is presented in Figure 8.Figure 8
Percentage of data that can be sniffed by attackers.As illustrated in Figure8, complete communication data can be sniffed on all sniffed node sets, A
1, A
2, A
3, and A
4, in traditional network since they all contain node 8 on the shortest path, on which complete data can be sniffed. However, in DHC, complete data cannot be obtained from node sets A
1, A
2, and A
3 since route hopping is applied. The percentage of data sniffed on A
1 and A
2 is the same because traffic passes through A
2 and also passes through A
1. Only A
4 can sniff the complete communication data in DHC. However ends of the data are diverse because of end hopping. We consider that packets with the same end are static data that attackers can obtain. The static data that attackers can obtain in hopping communication is far less than that in traditional network.


#### 5.2.4. Performance of DHC

In the experiment, bandwidth of all connections in network topology is set to 10 Mb/s. Data is transmitted from terminal on node 1 to terminal on node 16 using File Transfer Protocol (FTP). Time for data transmission in both DHC and traditional network is recorded. Results are shown in Figure9.Figure 9
Performance of forwarding in DHC.As can be seen in Figure9, time consumption of data transmission in DHC increased in comparison with traditional network. The reason is that multiple paths from source to destination are selected, including longer paths. On the contrary, the data is routed by the shortest path in traditional network. Therefore, transmission time in DHC is longer than that in traditional network. But the increase is less than 7% when T
h
o
p
=
5 s in the experiment. Routing path hopping of a connection results in a small amount of disordered packets at receiving end when new period starts. Then retransmission is caused. Therefore the more frequently the entries update flow, the more likely the retransmission happens. We can also see from Figure 9 that longer time will be consumed to transmit data when T
h
o
p
=
5 s compared with T
h
o
p
=
10 s.


## 5.1. Prototype Deployment

To verify the performance and security of DHC, DhcFlower, a prototype based on SDN controller is implemented. As shown in Figure3, DhcFlower runs on the top of SDN controller which manages switches through OpenFlow.Figure 3
DHC prototype deployment.In the prototype deployment of DHC, TopologyDiscovery reports the changes of network topology and updates view of network. FlowMonitor monitors the flow state of network to find initiation and termination of connections. Based on the view and flow state of network, DhcFlower chooses the ends and routing paths to convert network configurations.Detailed structure of DhcFlower is shown in Figure4. TopologyDiscovery updates topology database TopologyInfo with the changes of network topology. Using the network topology information, hopping path calculator calculates multiple paths of each pair of nodes and stores hopping path information in the hopping path pool. Hopping ends are stored in Hopping end pool. With hopping end pool and hopping path pool, double hopping engine, as the core module, chooses the hopping end and path based on flow state information. Afterwards, strategies of hopping are generated. Flow updater generates flow entries based on hopping strategies and updates the flowtables in a specific order.Figure 4
Makeup of DhcFlower.


## 5.2. Simulation Experiment

To evaluate DHC, we have operated our implement prototype over the Mininet [26]. OpenFlow 1.0 [27] is applied and POX [28] is used as controller. A class B address block is chosen as hopping IP address pool and hopping port pool denoted as 0,1
,
…
,
65535. Network topology proposed by [29] is applied, which has 16 nodes (forwarding nodes) as illustrated in Figure 5. The maximum path length L is set to 32.Figure 5
Network topology applied in the experiment.


### 5.2.1. Validation of the Effectiveness of End Hopping

UDP packets from terminal on node 1 are sent to terminal on node 16 for 500 s. Packets are sniffed on the forwarding nodes and the number of ends received on each node is counted. The sniffing results in DHC and traditional network are shown in Figure6.Figure 6
Number of ends sniffed from single flow.As demonstrated in Figure6, on some forwarding nodes in traditional network, such as nodes 4, 7, 8, and 12, only one end is able to be sniffed. However, in DHC, apart from source and destination forwarding nodes, multiple ends can be sniffed on other forwarding nodes. Due to the invariant of packets’ end in traditional networks, end that is sniffed stays unchangeable, which brings convenience for attackers. Attackers can launch a targeted sniffer to any connection and obtain the complete communication data of the connection. In DHC, end changes randomly and periodically. The ends sniffed on forwarding nodes between source and destination hosts are various. It is difficult for attackers to determine the ends from the same connection, increasing the difficulty in reconstructing the communication data. Moreover, the more frequently ends hop, the more ends will be sniffed on forwarding nodes. It can be seen in Figure 6 that more ends are sniffed when T
h
o
p
=
5 s compared with T
h
o
p
=
10 s. In addition, fewer ends can be sniffed on forwarding node 9 than other nodes as can be seen in the figure. The reason is that fewer paths pass through forwarding node 9 than other nodes; thus the probability of being hit by weighted random selection is lower.


### 5.2.2. Validation of the Effectiveness of Route Hopping

In the experiment, 106 packets are transmitted from node 5 to node 6 with the speed of 104 packets per second. The hopping period T
h
o
p is set to 5 s. Packets are sniffed on the forwarding nodes and the number of packets sniffed is counted. In DHC network, random path selection and weighted random path selection are applied to conduct hopping communication. Sniffing results are compared with traditional network communication, as shown in Figure 7.Figure 7
Percentage of packets sniffed from single flow.In Figure7, the vertical coordinate stands for the fraction of all the packets transmitted from node 5 to node 6. As we can see, in traditional network, complete communication data from source host to destination host can be sniffed on some nodes (e.g., nodes 6, 11, and 12), which means that attackers can sniff complete data on any of the nodes and further data analysis is possible. Since shortest-path routing is applied in traditional network and the path stays unchanged during communication, the complete communication data can be obtained on any node that the shortest path goes through. In DHC, packets of a connection are distributed to several paths by route hopping. It is difficult for attackers to sniff complete data on single forwarding node. Possibility for sniffing large amount of data on a certain nodes exists if random path selection is applied. As shown in Figure 7, more than 50% of the data can be sniffed on forwarding nodes 4, 8, and 12. Applying weighed random path selection can avoid excessive traffic passing through certain nodes. The reason is that lower weight is assigned to paths with nodes that more paths cross.


### 5.2.3. Validation of Effectiveness of Antisniffer Attack

In the experiment, 100 MB data had been transmitted from node 1 to node 16 for 500 s. The hopping periodT
h
o
p is set to 5 s. Data is sniffed on node sets A
1
=
8, A
2
=
8,9, A
3
=
8,9
,
10, and A
4
=
8,9
,
10,11, respectively. The shortest path from node 1 to node 16 is 1
→
4
→
7
→
8
→
12
→
16. The percentage of data sniffed on node sets A
1, A
2, A
3, and A
4 is presented in Figure 8.Figure 8
Percentage of data that can be sniffed by attackers.As illustrated in Figure8, complete communication data can be sniffed on all sniffed node sets, A
1, A
2, A
3, and A
4, in traditional network since they all contain node 8 on the shortest path, on which complete data can be sniffed. However, in DHC, complete data cannot be obtained from node sets A
1, A
2, and A
3 since route hopping is applied. The percentage of data sniffed on A
1 and A
2 is the same because traffic passes through A
2 and also passes through A
1. Only A
4 can sniff the complete communication data in DHC. However ends of the data are diverse because of end hopping. We consider that packets with the same end are static data that attackers can obtain. The static data that attackers can obtain in hopping communication is far less than that in traditional network.


### 5.2.4. Performance of DHC

In the experiment, bandwidth of all connections in network topology is set to 10 Mb/s. Data is transmitted from terminal on node 1 to terminal on node 16 using File Transfer Protocol (FTP). Time for data transmission in both DHC and traditional network is recorded. Results are shown in Figure9.Figure 9
Performance of forwarding in DHC.As can be seen in Figure9, time consumption of data transmission in DHC increased in comparison with traditional network. The reason is that multiple paths from source to destination are selected, including longer paths. On the contrary, the data is routed by the shortest path in traditional network. Therefore, transmission time in DHC is longer than that in traditional network. But the increase is less than 7% when T
h
o
p
=
5 s in the experiment. Routing path hopping of a connection results in a small amount of disordered packets at receiving end when new period starts. Then retransmission is caused. Therefore the more frequently the entries update flow, the more likely the retransmission happens. We can also see from Figure 9 that longer time will be consumed to transmit data when T
h
o
p
=
5 s compared with T
h
o
p
=
10 s.


## 5.2.1. Validation of the Effectiveness of End Hopping

UDP packets from terminal on node 1 are sent to terminal on node 16 for 500 s. Packets are sniffed on the forwarding nodes and the number of ends received on each node is counted. The sniffing results in DHC and traditional network are shown in Figure6.Figure 6
Number of ends sniffed from single flow.As demonstrated in Figure6, on some forwarding nodes in traditional network, such as nodes 4, 7, 8, and 12, only one end is able to be sniffed. However, in DHC, apart from source and destination forwarding nodes, multiple ends can be sniffed on other forwarding nodes. Due to the invariant of packets’ end in traditional networks, end that is sniffed stays unchangeable, which brings convenience for attackers. Attackers can launch a targeted sniffer to any connection and obtain the complete communication data of the connection. In DHC, end changes randomly and periodically. The ends sniffed on forwarding nodes between source and destination hosts are various. It is difficult for attackers to determine the ends from the same connection, increasing the difficulty in reconstructing the communication data. Moreover, the more frequently ends hop, the more ends will be sniffed on forwarding nodes. It can be seen in Figure 6 that more ends are sniffed when T
h
o
p
=
5 s compared with T
h
o
p
=
10 s. In addition, fewer ends can be sniffed on forwarding node 9 than other nodes as can be seen in the figure. The reason is that fewer paths pass through forwarding node 9 than other nodes; thus the probability of being hit by weighted random selection is lower.


## 5.2.2. Validation of the Effectiveness of Route Hopping

In the experiment, 106 packets are transmitted from node 5 to node 6 with the speed of 104 packets per second. The hopping period T
h
o
p is set to 5 s. Packets are sniffed on the forwarding nodes and the number of packets sniffed is counted. In DHC network, random path selection and weighted random path selection are applied to conduct hopping communication. Sniffing results are compared with traditional network communication, as shown in Figure 7.Figure 7
Percentage of packets sniffed from single flow.In Figure7, the vertical coordinate stands for the fraction of all the packets transmitted from node 5 to node 6. As we can see, in traditional network, complete communication data from source host to destination host can be sniffed on some nodes (e.g., nodes 6, 11, and 12), which means that attackers can sniff complete data on any of the nodes and further data analysis is possible. Since shortest-path routing is applied in traditional network and the path stays unchanged during communication, the complete communication data can be obtained on any node that the shortest path goes through. In DHC, packets of a connection are distributed to several paths by route hopping. It is difficult for attackers to sniff complete data on single forwarding node. Possibility for sniffing large amount of data on a certain nodes exists if random path selection is applied. As shown in Figure 7, more than 50% of the data can be sniffed on forwarding nodes 4, 8, and 12. Applying weighed random path selection can avoid excessive traffic passing through certain nodes. The reason is that lower weight is assigned to paths with nodes that more paths cross.


## 5.2.3. Validation of Effectiveness of Antisniffer Attack

In the experiment, 100 MB data had been transmitted from node 1 to node 16 for 500 s. The hopping periodT
h
o
p is set to 5 s. Data is sniffed on node sets A
1
=
8, A
2
=
8,9, A
3
=
8,9
,
10, and A
4
=
8,9
,
10,11, respectively. The shortest path from node 1 to node 16 is 1
→
4
→
7
→
8
→
12
→
16. The percentage of data sniffed on node sets A
1, A
2, A
3, and A
4 is presented in Figure 8.Figure 8
Percentage of data that can be sniffed by attackers.As illustrated in Figure8, complete communication data can be sniffed on all sniffed node sets, A
1, A
2, A
3, and A
4, in traditional network since they all contain node 8 on the shortest path, on which complete data can be sniffed. However, in DHC, complete data cannot be obtained from node sets A
1, A
2, and A
3 since route hopping is applied. The percentage of data sniffed on A
1 and A
2 is the same because traffic passes through A
2 and also passes through A
1. Only A
4 can sniff the complete communication data in DHC. However ends of the data are diverse because of end hopping. We consider that packets with the same end are static data that attackers can obtain. The static data that attackers can obtain in hopping communication is far less than that in traditional network.


## 5.2.4. Performance of DHC

In the experiment, bandwidth of all connections in network topology is set to 10 Mb/s. Data is transmitted from terminal on node 1 to terminal on node 16 using File Transfer Protocol (FTP). Time for data transmission in both DHC and traditional network is recorded. Results are shown in Figure9.Figure 9
Performance of forwarding in DHC.As can be seen in Figure9, time consumption of data transmission in DHC increased in comparison with traditional network. The reason is that multiple paths from source to destination are selected, including longer paths. On the contrary, the data is routed by the shortest path in traditional network. Therefore, transmission time in DHC is longer than that in traditional network. But the increase is less than 7% when T
h
o
p
=
5 s in the experiment. Routing path hopping of a connection results in a small amount of disordered packets at receiving end when new period starts. Then retransmission is caused. Therefore the more frequently the entries update flow, the more likely the retransmission happens. We can also see from Figure 9 that longer time will be consumed to transmit data when T
h
o
p
=
5 s compared with T
h
o
p
=
10 s.


## 6. Analysis

In DHC, each hopping connection needs to occupy hopping ends in every period. In Section6.1, the number of hopping connections that can be supported in DHC network, that is, hopping network capacity, is analyzed. DHC brings difficulty for attackers to obtain complete data and to reconstruct data. Therefore, communication security is improved. The obtaining and reconstruction of communication data are discussed in Sections 6.2 and 6.3. The unpredictability and the cost of DHC are analyzed in Sections 6.4 and 6.5, respectively.


### 6.1. Capacity of Hopping Network

Suppose the sizes of hopping IP address pool and port pool are|
A
d
d
r
| and |
P
o
r
t
|, respectively. The number of all the ends I
P
s
r
c
,
P
s
r
c
,
I
P
d
s
t
,
P
d
s
t is |
A
d
d
r
|
2
×
|
P
o
r
t
|
2, and the number of the ends is |
A
d
d
r
|
×
|
P
o
r
t
|
2 when I
P
s
r
c
=
I
P
d
s
t. According to the definition of end, valid ends require I
P
s
r
c
≠
I
P
d
s
t, so the size of valid end hopping space S
E
H can be calculated by (3)
S
EH
=
Addr
2
×
Port
2
-
Addr
×
Port
2
.In DHC, end hopping is performed in both directions of one connection, which means that, at any moment, one connection needs two ends. Assuming t hopping connections exist simultaneously in network, 2
t ends will be needed, so |
S
E
H
|
-
2
t ends are left. To ensure high randomness in hopping end selection, enough unoccupied hopping ends in S
E
H are necessary. Suppose the maximum occupancy rate in end hopping space S
E
H is α; that is, there are at least (
1
-
α
)
|
S
E
H
| ends unoccupied. Then inequality (4) holds:(4)
1
-
α
S
EH
≤
S
EH
-
2
t
t
≤
1
2
α
S
EH
.Therefore, the maximum number of hopping connections allowed in DHC is (
1
/
2
)
α
S
E
H; that is, the capacity of hopping network is (
1
/
2
)
α
S
E
H.Combining (3) and inequality (4), the following inequality can be obtained:(5)
t
≤
1
2
α
Addr
2
×
Port
2
-
Addr
×
Port
2
.Assume |
P
o
r
t
|
=
2
16,  |
A
d
d
r
|
=
2
16 (hopping IP address pool is a class B address block), and α
=
0.8; DHC can support 7.37
×
1
0
18 connections hopping simultaneously.


### 6.2. Analysis of Complete Communication Data Obtaining by Attackers

We hypothesize that attackers can sniff part of the forwarding nodes in network randomly. Suppose network topologyG
=
V
,
E is an undirected connected graph, where V is a set of forwarding nodes and E is a set of links. V contains m forwarding nodes and attackers can randomly sniff n of them simultaneously (n
≤
m). Sniffed node set consisting of these sniffed forwarding nodes is denoted as V
s
n
i
f
f
n. V
s
n
i
f
f
n
⊆
V and V
s
n
i
f
f
n
=
n.Source hosth
o
s
t
s
r
c communicates with destination host h
o
s
t
d
s
t. Source and destination forwarding nodes are denoted as n
o
d
e
s
r
c and n
o
d
e
d
s
t, respectively. Assume there are s nodes on the shortest path between h
o
s
t
s
r
c and h
o
s
t
d
s
t (1
≤
s
≤
m), which constitute node set U
s. In traditional network, if V
l
i
s
t
e
n
n
∩
U
s
≠
⌀, complete communication data between h
o
s
t
s
r
c and h
o
s
t
d
s
t can be obtained by attackers. If V
l
i
s
t
e
n
n
∩
U
s
=
⌀, no communication data can be sniffed. The probability of attackers obtaining complete communication data in traditional network can be calculated by (6), where C
m
n is number of all V
s
n
i
f
f
n and C
m
-
s
n is the number of V
s
n
i
f
f
n when V
l
i
s
t
e
n
n
∩
U
s
=
⌀. So C
m
n
-
C
m
-
s
n represents the number of V
s
n
i
f
f
n when V
l
i
s
t
e
n
n
∩
U
s
≠
⌀:(6)
P
t
r
a
d
i
t
i
o
n
a
l
=
C
m
n
-
C
m
-
s
n
C
m
n
.In DHC, attackers can sniff complete data betweenh
o
s
t
s
r
c and h
o
s
t
d
s
t if n
o
d
e
s
r
c
∈
V
s
n
i
f
f
n or n
o
d
e
d
s
t
∈
V
s
n
i
f
f
n. The number of such V
s
n
i
f
f
n is C
2
1
C
m
-
2
n
-
1
+
C
2
2
C
m
-
2
n
-
2. In other cases, if n
o
d
e
s
r
c
∉
V
l
i
s
t
e
n
n and n
o
d
e
d
s
t
∉
V
l
i
s
t
e
n
n, to sniff complete data, one vertex cut-set V
c
u
t should be contained in V
s
n
i
f
f
n, and n
o
d
e
s
r
c and n
o
d
e
d
s
t should be cut by V
c
u
t into different connected subgraphs; that is, V
s
n
i
f
f
n
⊇
V
c
u
t exists, where G is cut by V
c
u
t into k connected subgraphs G
1
,
G
2
,
…
,
G
k, and n
o
d
e
s
r
c
∈
G
i and n
o
d
e
d
s
t
∈
G
j, 1
≤
i, j
≤
k, and i
≠
j, hold. Suppose there exists Q
s
r
c
,
d
s
t
n sniffed node set V
s
n
i
f
f
n, where V
s
n
i
f
f
n contains such V
c
u
t in this case. Then the probability of attackers obtaining complete data between h
o
s
t
s
r
c and h
o
s
t
d
s
t can be calculated by(7)
P
hop
=
C
2
1
C
m
-
2
n
-
1
+
C
2
2
C
m
-
2
n
-
2
+
Q
src,dst
n
C
m
n
.Proposition 1.
The probability of attackers obtaining complete data in traditional network on one communication is not less than that in DHC; that is,P
t
r
a
d
i
t
i
o
n
a
l
≥
P
h
o
p.The proof process of this proposition is shown in the Appendix. In the network topology shown in Figure5, suppose a host on node 1 communicates with a host on node 16. The shortest path from node 1 to node 16 contains 6 nodes. Attackers can sniff n nodes randomly (1
≤
n
≤
16). Probabilities of attackers obtaining complete data in traditional network and DHC network are shown in Figure 10.Figure 10
Probability of obtaining complete data.As can be seen from Figure10, probability of attackers obtaining complete data increases when number of sniffed nodes increases, both in traditional and DHC network. But P
h
o
p
≤
P
t
r
a
d
i
t
i
o
n
a
l always holds. Probability of attackers obtaining complete data is 1 in both traditional and DHC network when the number of sniffed nodes is more than 10. Although probability of attackers sniffing complete data increases in DHC network when large number of forwarding nodes are sniffed, attackers obtain more irrelevant data. Since end hops constantly during a communication, attackers cannot pick out the traffic that belongs to the target from the sniffed data easily, which increases the difficulty for attackers to reconstruct and recover communication data.


### 6.3. Analysis of Communication Data Reconstruction for Attackers

Reconstruction of communication data requires complete data in this communication. Assume attackers can sniff complete data in communication between source and destination hosts in this section. In traditional network, attackers can deduce the positions of both communication sides and upper layer protocol according to IP and port of the sniffed packets. Useless packets can be eliminated based on the end and the target communication data can be obtained. However, in DHC network no real end from source and destination hosts can be sniffed by attackers if source and host forwarding nodes are not sniffed. Data in communication is distributed to various flows that attackers are not able to distinguish. Suppose that there aref
s
n
i
f
f flows in the sniffed data, among which f
r
e
a
l flows contain the data of target connections (f
r
e
a
l
≤
f
s
n
i
f
f) and different ends are applied in different connections. There are C
f
s
n
i
f
f
h combinations since attackers randomly choose h flows from f
s
n
i
f
f flows. Attackers can reconstruct communication data properly with only one combination; that is, C
f
r
e
a
l
f
r
e
a
l
=
1. Given that attackers select several flows randomly for a single time to reconstruct communication data, probability of reconstructing data properly can be calculated with (8)
P
once
=
C
f
real
f
real
C
f
sniff
1
+
C
f
sniff
2
+
⋯
+
C
f
sniff
f
sniff
=
1
2
f
sniff
-
1
.As shown in (8), probability of attackers reconstructing data successfully with a single time decreases exponentially with the increase of number of flows sniffed. The more data sniffed, the more difficulties for successful data reconstruction. Since attackers cannot determine the timing of target communication easily due to end hopping, longer sniffing time is needed to obtain complete communication data. Therefore large amount of irrelevant data is obtained, increasing the difficulty for data reconstruction. Given f
s
n
i
f
f
=
100 and f
r
e
a
l
=
10, the probability of attackers reconstructing data correctly by selecting several flows randomly for one time would be 7.89
×
10
-
31.


### 6.4. Analysis of Unpredictability

Since the end and route hop randomly in DHC (detailed information is illustrated in Section4.3), the end and route used in next period can not be predicted precisely. Under the condition of exposing DHC protocol, end hopping space, and route hopping space, DHC can still increase the cost of sniffer attackers and resist sniffer attacks. Suppose that an attacker with all the information above sniffs the DHC network for a target communication, then she will face the following difficulties in launching sniffer attack. Firstly, even though DHC protocol is transparent to the attacker, a targeted sniffer attack can not be launched thanks to the randomness of end and route hopping. Secondly, it is hard for the attacker to get complete communication data during sniffing due to periodical hopping of route. Thirdly, the attacker will get a large number of ends because of frequent end hopping, which prevents the attacker from extracting the right packets belonging to the target communication when she/he attempts to recover communication data. So the unpredictability of DHC guarantees that it can resist sniffer attack under the condition of exposing DHC protocol and network information.


### 6.5. Analysis of Cost

Under traditional routing schemes, the packets are routed along the shortest path. However, in DHC network, packets may be routed along longer paths due to dynamic changing of the route. Therefore the cost of packet transmission time is higher in DHC. Letl
s denote length (the length of a routing path is estimated by hops) of the shortest path between source and destination, l
a the average length of paths in route hopping space (l
s
≤
l
a), and T
h
o
p the hopping period, then the cost of packet transmission time is shown in Table 1. Moreover, random selection of routing is periodically conducted by routing path hop of a communication, which results in a small number of disordered packets at receiving end when a new period starts, leaving no obstacles to normal communication.Table 1
Comparison of packet transmission time between traditional network and DHC network.
Approach
Average cost of packet transmission time
Period of flow update
Routing path
Traditional
t
×
l
s
Infinite
The shortest path from source to destination
DHC
t
×
l
a
T
hop
Multiple paths from source to destinationEnds and routing paths will be selected in DHC when flow entries are generated, which is more complicated than that in traditional network. Therefore time cost of generating flow entries is higher in DHC. Since average path is longer in DHC, more flow entries are installed for one communication compared with traditional network. Thus the time cost for flow entries setup is higher in DHC as well. In Figure11, the average time cost for installing flow entries between different node pairs in topology (shown in Figure 5) of DHC and traditional network is compared. As illustrated in Figure 11, the average time for flow entries generation and setup in DHC is longer than that in traditional network.Figure 11
Comparison average time cost of flow entries installation in DHC and traditional network.In the network without DHC, flow entries are installed only once at the beginning of communication, while in DHC flow entries of data plane are updated periodically and hopping ends and paths have to be allocated for any connection of two communication sides, which brings more loads for the controller. In experiment topology, 50 pairs of source and destination hosts are chosen randomly and communication between any pairs is stared. The CPU utilization of DHC and traditional network is compared in Figure12. If controller does not run DHC, the load is low because the flow entry is not periodically updated. Therefore, the CPU utilization is under 10% as shown in Figure 12. If a controller runs DHC, the load increases due to periodical updating of flow entries. It can be found in the figure that CPU utilization is much higher when controller runs DHC. When T
h
o
p
=
5 s, the CPU utilization is between 20% and 40% and when T
h
o
p
=
10 s the CPU utilization is between 10% and 30%. The shorter hopping period enables more controller operations. So when T
h
o
p
=
5 s, CPU utilization of a controller is higher than when T
h
o
p
=
10 s. Controller will be the bottleneck when DHC is used in large scale network. Fortunately, distributed SDN controller [30] is a solution to the problem.Figure 12
CPU utilization of controller.In traditional network, flows are matched only by destination addresses. So the length of routing tables is an order ofO
(
m
) given the network of m nodes. However, flows are matched by ends (including source/destination address and ports) in DHC, meaning that two flows must be specified for every connection (TCP or UDP) between two communication sides. Let λ denote the average speed of connection establishment and let w denote the lasting time of each connection; then the mean length of flowtables is an order of O
(
m
λ
w
) [7]. Moreover, to avoid packets loss, DHC requires both old and new flow entries in flowtable simultaneously for a brief period of time, during which the cost of flowtable space increases. Therefore the cost of flowtable space is higher in DHC.


## 6.1. Capacity of Hopping Network

Suppose the sizes of hopping IP address pool and port pool are|
A
d
d
r
| and |
P
o
r
t
|, respectively. The number of all the ends I
P
s
r
c
,
P
s
r
c
,
I
P
d
s
t
,
P
d
s
t is |
A
d
d
r
|
2
×
|
P
o
r
t
|
2, and the number of the ends is |
A
d
d
r
|
×
|
P
o
r
t
|
2 when I
P
s
r
c
=
I
P
d
s
t. According to the definition of end, valid ends require I
P
s
r
c
≠
I
P
d
s
t, so the size of valid end hopping space S
E
H can be calculated by (3)
S
EH
=
Addr
2
×
Port
2
-
Addr
×
Port
2
.In DHC, end hopping is performed in both directions of one connection, which means that, at any moment, one connection needs two ends. Assuming t hopping connections exist simultaneously in network, 2
t ends will be needed, so |
S
E
H
|
-
2
t ends are left. To ensure high randomness in hopping end selection, enough unoccupied hopping ends in S
E
H are necessary. Suppose the maximum occupancy rate in end hopping space S
E
H is α; that is, there are at least (
1
-
α
)
|
S
E
H
| ends unoccupied. Then inequality (4) holds:(4)
1
-
α
S
EH
≤
S
EH
-
2
t
t
≤
1
2
α
S
EH
.Therefore, the maximum number of hopping connections allowed in DHC is (
1
/
2
)
α
S
E
H; that is, the capacity of hopping network is (
1
/
2
)
α
S
E
H.Combining (3) and inequality (4), the following inequality can be obtained:(5)
t
≤
1
2
α
Addr
2
×
Port
2
-
Addr
×
Port
2
.Assume |
P
o
r
t
|
=
2
16,  |
A
d
d
r
|
=
2
16 (hopping IP address pool is a class B address block), and α
=
0.8; DHC can support 7.37
×
1
0
18 connections hopping simultaneously.


## 6.2. Analysis of Complete Communication Data Obtaining by Attackers

We hypothesize that attackers can sniff part of the forwarding nodes in network randomly. Suppose network topologyG
=
V
,
E is an undirected connected graph, where V is a set of forwarding nodes and E is a set of links. V contains m forwarding nodes and attackers can randomly sniff n of them simultaneously (n
≤
m). Sniffed node set consisting of these sniffed forwarding nodes is denoted as V
s
n
i
f
f
n. V
s
n
i
f
f
n
⊆
V and V
s
n
i
f
f
n
=
n.Source hosth
o
s
t
s
r
c communicates with destination host h
o
s
t
d
s
t. Source and destination forwarding nodes are denoted as n
o
d
e
s
r
c and n
o
d
e
d
s
t, respectively. Assume there are s nodes on the shortest path between h
o
s
t
s
r
c and h
o
s
t
d
s
t (1
≤
s
≤
m), which constitute node set U
s. In traditional network, if V
l
i
s
t
e
n
n
∩
U
s
≠
⌀, complete communication data between h
o
s
t
s
r
c and h
o
s
t
d
s
t can be obtained by attackers. If V
l
i
s
t
e
n
n
∩
U
s
=
⌀, no communication data can be sniffed. The probability of attackers obtaining complete communication data in traditional network can be calculated by (6), where C
m
n is number of all V
s
n
i
f
f
n and C
m
-
s
n is the number of V
s
n
i
f
f
n when V
l
i
s
t
e
n
n
∩
U
s
=
⌀. So C
m
n
-
C
m
-
s
n represents the number of V
s
n
i
f
f
n when V
l
i
s
t
e
n
n
∩
U
s
≠
⌀:(6)
P
t
r
a
d
i
t
i
o
n
a
l
=
C
m
n
-
C
m
-
s
n
C
m
n
.In DHC, attackers can sniff complete data betweenh
o
s
t
s
r
c and h
o
s
t
d
s
t if n
o
d
e
s
r
c
∈
V
s
n
i
f
f
n or n
o
d
e
d
s
t
∈
V
s
n
i
f
f
n. The number of such V
s
n
i
f
f
n is C
2
1
C
m
-
2
n
-
1
+
C
2
2
C
m
-
2
n
-
2. In other cases, if n
o
d
e
s
r
c
∉
V
l
i
s
t
e
n
n and n
o
d
e
d
s
t
∉
V
l
i
s
t
e
n
n, to sniff complete data, one vertex cut-set V
c
u
t should be contained in V
s
n
i
f
f
n, and n
o
d
e
s
r
c and n
o
d
e
d
s
t should be cut by V
c
u
t into different connected subgraphs; that is, V
s
n
i
f
f
n
⊇
V
c
u
t exists, where G is cut by V
c
u
t into k connected subgraphs G
1
,
G
2
,
…
,
G
k, and n
o
d
e
s
r
c
∈
G
i and n
o
d
e
d
s
t
∈
G
j, 1
≤
i, j
≤
k, and i
≠
j, hold. Suppose there exists Q
s
r
c
,
d
s
t
n sniffed node set V
s
n
i
f
f
n, where V
s
n
i
f
f
n contains such V
c
u
t in this case. Then the probability of attackers obtaining complete data between h
o
s
t
s
r
c and h
o
s
t
d
s
t can be calculated by(7)
P
hop
=
C
2
1
C
m
-
2
n
-
1
+
C
2
2
C
m
-
2
n
-
2
+
Q
src,dst
n
C
m
n
.Proposition 1.
The probability of attackers obtaining complete data in traditional network on one communication is not less than that in DHC; that is,P
t
r
a
d
i
t
i
o
n
a
l
≥
P
h
o
p.The proof process of this proposition is shown in the Appendix. In the network topology shown in Figure5, suppose a host on node 1 communicates with a host on node 16. The shortest path from node 1 to node 16 contains 6 nodes. Attackers can sniff n nodes randomly (1
≤
n
≤
16). Probabilities of attackers obtaining complete data in traditional network and DHC network are shown in Figure 10.Figure 10
Probability of obtaining complete data.As can be seen from Figure10, probability of attackers obtaining complete data increases when number of sniffed nodes increases, both in traditional and DHC network. But P
h
o
p
≤
P
t
r
a
d
i
t
i
o
n
a
l always holds. Probability of attackers obtaining complete data is 1 in both traditional and DHC network when the number of sniffed nodes is more than 10. Although probability of attackers sniffing complete data increases in DHC network when large number of forwarding nodes are sniffed, attackers obtain more irrelevant data. Since end hops constantly during a communication, attackers cannot pick out the traffic that belongs to the target from the sniffed data easily, which increases the difficulty for attackers to reconstruct and recover communication data.


## 6.3. Analysis of Communication Data Reconstruction for Attackers

Reconstruction of communication data requires complete data in this communication. Assume attackers can sniff complete data in communication between source and destination hosts in this section. In traditional network, attackers can deduce the positions of both communication sides and upper layer protocol according to IP and port of the sniffed packets. Useless packets can be eliminated based on the end and the target communication data can be obtained. However, in DHC network no real end from source and destination hosts can be sniffed by attackers if source and host forwarding nodes are not sniffed. Data in communication is distributed to various flows that attackers are not able to distinguish. Suppose that there aref
s
n
i
f
f flows in the sniffed data, among which f
r
e
a
l flows contain the data of target connections (f
r
e
a
l
≤
f
s
n
i
f
f) and different ends are applied in different connections. There are C
f
s
n
i
f
f
h combinations since attackers randomly choose h flows from f
s
n
i
f
f flows. Attackers can reconstruct communication data properly with only one combination; that is, C
f
r
e
a
l
f
r
e
a
l
=
1. Given that attackers select several flows randomly for a single time to reconstruct communication data, probability of reconstructing data properly can be calculated with (8)
P
once
=
C
f
real
f
real
C
f
sniff
1
+
C
f
sniff
2
+
⋯
+
C
f
sniff
f
sniff
=
1
2
f
sniff
-
1
.As shown in (8), probability of attackers reconstructing data successfully with a single time decreases exponentially with the increase of number of flows sniffed. The more data sniffed, the more difficulties for successful data reconstruction. Since attackers cannot determine the timing of target communication easily due to end hopping, longer sniffing time is needed to obtain complete communication data. Therefore large amount of irrelevant data is obtained, increasing the difficulty for data reconstruction. Given f
s
n
i
f
f
=
100 and f
r
e
a
l
=
10, the probability of attackers reconstructing data correctly by selecting several flows randomly for one time would be 7.89
×
10
-
31.


## 6.4. Analysis of Unpredictability

Since the end and route hop randomly in DHC (detailed information is illustrated in Section4.3), the end and route used in next period can not be predicted precisely. Under the condition of exposing DHC protocol, end hopping space, and route hopping space, DHC can still increase the cost of sniffer attackers and resist sniffer attacks. Suppose that an attacker with all the information above sniffs the DHC network for a target communication, then she will face the following difficulties in launching sniffer attack. Firstly, even though DHC protocol is transparent to the attacker, a targeted sniffer attack can not be launched thanks to the randomness of end and route hopping. Secondly, it is hard for the attacker to get complete communication data during sniffing due to periodical hopping of route. Thirdly, the attacker will get a large number of ends because of frequent end hopping, which prevents the attacker from extracting the right packets belonging to the target communication when she/he attempts to recover communication data. So the unpredictability of DHC guarantees that it can resist sniffer attack under the condition of exposing DHC protocol and network information.


## 6.5. Analysis of Cost

Under traditional routing schemes, the packets are routed along the shortest path. However, in DHC network, packets may be routed along longer paths due to dynamic changing of the route. Therefore the cost of packet transmission time is higher in DHC. Letl
s denote length (the length of a routing path is estimated by hops) of the shortest path between source and destination, l
a the average length of paths in route hopping space (l
s
≤
l
a), and T
h
o
p the hopping period, then the cost of packet transmission time is shown in Table 1. Moreover, random selection of routing is periodically conducted by routing path hop of a communication, which results in a small number of disordered packets at receiving end when a new period starts, leaving no obstacles to normal communication.Table 1
Comparison of packet transmission time between traditional network and DHC network.
Approach
Average cost of packet transmission time
Period of flow update
Routing path
Traditional
t
×
l
s
Infinite
The shortest path from source to destination
DHC
t
×
l
a
T
hop
Multiple paths from source to destinationEnds and routing paths will be selected in DHC when flow entries are generated, which is more complicated than that in traditional network. Therefore time cost of generating flow entries is higher in DHC. Since average path is longer in DHC, more flow entries are installed for one communication compared with traditional network. Thus the time cost for flow entries setup is higher in DHC as well. In Figure11, the average time cost for installing flow entries between different node pairs in topology (shown in Figure 5) of DHC and traditional network is compared. As illustrated in Figure 11, the average time for flow entries generation and setup in DHC is longer than that in traditional network.Figure 11
Comparison average time cost of flow entries installation in DHC and traditional network.In the network without DHC, flow entries are installed only once at the beginning of communication, while in DHC flow entries of data plane are updated periodically and hopping ends and paths have to be allocated for any connection of two communication sides, which brings more loads for the controller. In experiment topology, 50 pairs of source and destination hosts are chosen randomly and communication between any pairs is stared. The CPU utilization of DHC and traditional network is compared in Figure12. If controller does not run DHC, the load is low because the flow entry is not periodically updated. Therefore, the CPU utilization is under 10% as shown in Figure 12. If a controller runs DHC, the load increases due to periodical updating of flow entries. It can be found in the figure that CPU utilization is much higher when controller runs DHC. When T
h
o
p
=
5 s, the CPU utilization is between 20% and 40% and when T
h
o
p
=
10 s the CPU utilization is between 10% and 30%. The shorter hopping period enables more controller operations. So when T
h
o
p
=
5 s, CPU utilization of a controller is higher than when T
h
o
p
=
10 s. Controller will be the bottleneck when DHC is used in large scale network. Fortunately, distributed SDN controller [30] is a solution to the problem.Figure 12
CPU utilization of controller.In traditional network, flows are matched only by destination addresses. So the length of routing tables is an order ofO
(
m
) given the network of m nodes. However, flows are matched by ends (including source/destination address and ports) in DHC, meaning that two flows must be specified for every connection (TCP or UDP) between two communication sides. Let λ denote the average speed of connection establishment and let w denote the lasting time of each connection; then the mean length of flowtables is an order of O
(
m
λ
w
) [7]. Moreover, to avoid packets loss, DHC requires both old and new flow entries in flowtable simultaneously for a brief period of time, during which the cost of flowtable space increases. Therefore the cost of flowtable space is higher in DHC.


## 7. Conclusion

The centralized control and programmability of SDN make hopping communication easier to realize and deploy. In this paper, end hopping and route hopping are combined and double hopping communication based on SDN is proposed. End is changed dynamically in DHC so that the data from multiple users is mixed and communication traffic can be hidden in background traffic. So traffic cannot be distinguished easily and the difficulty for attackers to reconstruct and recover data increases. In addition, the data is transmitted along multiple paths by changing routing path dynamically. The difficulty for attackers to obtain complete communication data is increased. Results show that the approach proposed in this paper effectively enables antisniffer. Moreover, DHC is realized completely based on software and also transparent to terminals. Controller bottleneck usually occurs in large scale network of DHC. In the future work, a distributed controller model will be applied to deal with the problem and feasible communication solution of DHC will be tested in real network.



---

*Source: 8927169-2016-01-17.xml*