![](bg7.png)
Table 1: Performance measurements for Topology T1.
N=10 N=50 N=100
Normal Secure Normal Secure Normal Secure
Total flows 10 10 50 50 100 100
Total time to add all flows 434 655 2497 2824 4250 5392
Total network data sent to add all flows 272 912 1474 4674 3074 9474
Total packets sent to add all flows 20 20 100 100 200 200
Total messages sent 10 10 50 50 100 100
Total message propagation time 2599 2564 11852 11599 24972 23287
Average flow length 4 4 4 4 4 4
Average time to add one flow 43.4 65.5 49.94 56.48 42.5 53.92
Average network data sent to add one flow 27.2 91.2 29.48 93.48 30.74 94.74
Average packets sent to add one flow 2 2 2 2 2 2
Average message propagation time 259.9 256.4 237.04 231.98 249.72 232.87
Table 2: Performance measurements for Topology T2.
N=10 N=50 N=100
Normal Secure Normal Secure Normal Secure
Total flows 19 19 99 99 199 199
Total time to add all flows 1463 2319 27908 51183 113587 173597
Total network data sent to add all flows 1529 6233 39099 127003 165846 501750
Total packets sent to add all flows 109 109 2549 2549 10099 10099
Total messages sent 19 19 99 99 199 199
Total message propagation time 3096 3248 44476 40892 164229 154357
Average flow length 7 7 27 27 52 52
Average time to add one flow 77 122.05 281.9 517 570.79 872.347
Average network data sent to add one flow 80.47 328.05 394.94 1282.86 833.4 2521.36
Average packets sent to add one flow 5.74 5.74 25.75 25.75 50.75 50.75
Average message propagation time 162.95 170.95 449.25 413.05 825.27 775.66
Table 3: Performance measurements for Topology T3.
N=10 N=50 N=100
Normal Secure Normal Secure Normal Secure
Total flows 9 9 49 49 99 99
Total time to add all flows 345 537 1768 2491 3658 5173
Total network data sent to add all flows 118 406 717 2285 1468 4636
Total packets sent to add all flows 9 9 49 49 99 99
Total messages sent 9 9 49 49 99 99
Total message propagation time 1592 1529 8535 7482 17333 17260
Average flow length 3 3 3 3 3 3
Average time to add one flow 38.33 59.67 36.08 50.84 36.95 52.25
Average network data sent to add one flow 13.11 45.11 14.63 46.63 14.83 46.83
Average packets sent to add one flow 1 1 1 1 1 1
Average message propagation time 176.89 169.89 174.18 152.69 175.08 174.34
use the bottleneck link are sent simultaneously. The
performance of SecSDN is measured for 10, 50 and
100 messages for this scenario. Topology 2 shown
in Figure 5b corresponds to measuring performance
when the topology is ‘linear’ and there are flows of
varied lengths present in the network. In the experi-
ments with value of N = 10, 19 flows with minimum
length of 3 to maximum length of 12 are present. Sim-
ilarly for N = 50, 99 flows of length 3 to 52 and for N
= 100, 199 flows of length 3 to 102 are present in the
network. Topology 3 shown in Figure 5c corresponds
to measuring performance when the topology is ‘star’
and there is maximum load on a single switch. In this
case, all flows are of length 3 but all of them passes
through the same switch. In the experiments with N
= 10, 50 and 100 a single switch maintains connec-
tion with the controller and 10, 50 and 100 hosts and
manages 9, 49 and 99 flows respectively.
Topologies are shown in the figures 5a, 5b, 5c and
their experimental results are shown in tables 1, 2, 3.
Time is measured in microseconds (µs) unit and the
network data is measured in bytes (B).
5.1 Discussion
Figure 6 and Figure 7 show bar charts depicting com-
parison of average time to add one flow and compari-
son of average message propagation time for a single
Table 4: Overhead incurred in SecSDN vs SDN.
Topology Total switch count
Overhead Factors
Flow setup time Flow setup data Flow setup packets Message propagation time
T1
20 0.51 2.35 0 -0.01
100 0.13 2.17 0 -0.02
200 0.27 2.08 0 -0.07
T2
147 0.59 3.08 0 0.05
2747 0.83 2.25 0 -0.08
10497 0.53 2.03 0 -0.06
T3
9 0.56 2.44 0 -0.04
49 0.41 2.19 0 -0.12
99 0.41 2.16 0 0
message of 512 bytes in the topologies described ear-
lier. As seen from the results in the Table 4 and chart
shown in Figure 7, the message propagation and mes-
sage forwarding are completely independent of the
secure nature of the topology. The protocol only af-
fects the setup phase of the network when flows are
being initialized. The piggybacking used in the pro-
tocol design is highly effective as clearly seen from
the fact that number of network packets required for
initializing flows remains exactly the same for SDN
and SecSDN setups.
As the number of flows and the average length
of the individual flows increase, the number of net-
work bytes sent to initialize these flows increase in
SecSDN. This is so since every flow table modifica-
tion in a switch requires an acknowledgement with
recalculated hash sent to the controller. SHA256 is
used to generate a 32 bytes hash per flow table mod-
ification. Hence, every time a flow is added, all the
switches present in the path of the flow needs to send
an extra 32 bytes to the controller as an ack. This
means, as and when the flow length and the number
of flows increase, the network bytes sent to add these
flows would also increase with a factor of 32 bytes per
switch in all the flows. But compared to the real time
data with size of thousands of megabytes that usually
flows in the networks, this amount is negligible in a
large scale SDN topology. As a result of increase in
data bytes while initializing flows, time to initialize
flows will also increase linearly as seen from Figure
6. Every time a flow is initialized, the controller as
well as the switch need to calculate a new SHA256
hash for every switch in the flow path. The additional
hash computations, and the time taken to transmit the
32 bytes hash would result in additional time for flow
initialization.
6 CONCLUSION AND FUTURE
WORK
In this paper, we have envisaged SecSDN as an effi-
cient architecture using an enhanced OpenFlow pro-
tocol that authenticates and securely verifies consis-
tency of flow tables in switches across SDN using
repetitive hashing. It is shown that SecSDN realizes
security in SDN via a simple robust authentication,
SecSDN: A Novel Architecture for a Secure SDN
593