Guangjia Song

The media access control (MAC) address is the basis of frame forwarding in data‐link layer. When MAC missing occurs in the software‐defined network (SDN), the processing method is the same as that of Ethernet, which is also broadcast. The broadcast will spread and cover part or even the entire network, result in a large number of frames, which leads to a sharp increase in network traffic, even cause congestion. To suppress the layer‐2 flooding, a new frame forwarding method is proposed, namely, multidevice search and path generation (MSPG). New approach will search multiple devices when MAC missing occurs and calculate a forwarding path; a set of flow table is generated to restrain the switch from broadcasting. Experiments and analysis show that in comparison with the existing frame forwarding methods in SDN, MSPG can effectively suppress flooding, greatly reduce the network load, minimize the traffic between data plane and control plane when MAC missing occurs, and reduce energy consumption significantly. The MSPG’s path calculation and flow dispatch method also decrease the forwarding delay and are more suitable for large‐scale network.

MAC address spoofing has plagued LAN communication for a long time. Many attacks use it as a springboard to carry out subsequent attacks. The main reason for this kind of attack is the exposure of MAC address. If the source MAC address of the node can be hidden during frame forwarding, this kind of attack can be effectively prevented. This study proposes virtual MAC switching (VMS) as a solution to this problem. VMS uses multi-address hopping technology to make the MAC address of the frame change continuously in the forwarding process. Its unique address generation format makes other nodes unable to record or speculate the real MAC address of the node, so it cannot launch an attack. Experiments show that VMS is close to typical SDN switches in terms of delay, throughput, and overhead and has a higher security level.

The <?tex id="Q1" staff-cmt="It is very important for the corresponding author to have a linked ORCID (Open Researcher and Contributor ID) account on MTS. To register a linked ORCID account, please go to the Account Update page (http://mts.hindawi.com/update/) in our Manuscript Tracking System and after you have logged in click on the ORCID link at the top of the page. This link will take you to the ORCID website where you will be able to create an account for yourself. Once you have done so, your new ORCID will be saved in our Manuscript Tracking System automatically."?>SEND uses CGA as its address configuration method. CGA binds the IPv6 address with multiple auxiliary parameters, thereby making the dependency relationship between IPv6 address and host provable, which prevents address embezzlement. Owing to the considerable overhead in CGA parameter verification, the malicious host can use this point to carry out DoS attacks. To prevent DoS, the paper proposes a new duplicate address detection method in an SDN environment called FDAD. Two additional mechanisms are added to the FDAD, namely, query and feedback; messages used by the new mechanisms are also designed. Through these two mechanisms, on the one hand, the host can query the MAC address of the suspect host to the controller. On the other hand, if the CGA parameter verification fails, the controller will use feedback information to suppress malicious host from its source port in order to prevent subsequent attacks. Experiments show that the CPU overhead of FDAD is much lower than the normal CGA when suffering Denial of Service attack. The increased CPU consumption and memory overhead of the controller are also within acceptable range, and the network communication overhead is greatly reduced.

The Neighbour Discovery Protocol and the Address Resolution Protocol are important protocols in the data link layer. Their functions include Internet Protocol (IP) address configuration, resolving the correspondence between an IP address and a medium access control address, and duplicate address detection (DAD). In DAD, the new address that the node is going to use is public, and thus, it is vulnerable to malicious node attacks. Moreover, address configuration is inefficient because only one address is generated and detected each time. In this study, the authors propose a multi‐address generation and DAD scheme called MAGD. MAGD generates a set of addresses each time, but only discloses a part of the set during DAD, thereby reducing the risk of being attacked. DAD will only fail when all the addresses are in conflict, and thus, the efficiency of node's address configuration is enhanced. Experiments show that the additional overhead in the CPU and memory caused by MAGD's multiple address configuration is within an acceptable range. When subjected to denial‐of‐service (DoS) attacks, MAGD performs better than traditional encryption schemes.