Software-defined networking (SDN) decouples the control plane from the data plane, offering flexible network configuration and management. Because of this architecture, some security features are missing. On the one hand, because the data plane only has the packet forwarding function, it is impossible to effectively authenticate the data validity. On the other hand, OpenFlow can only match based on network characteristics, and it is impossible to achieve fine-grained access control. In this paper, we aim to develop solutions to guarantee the validity of flow in SDN and present Attribute-Guard, a fine-grained access control and authentication scheme for flow in SDN. We design an attribute-based flow authentication protocol to verify the legitimacy of the validity flow. The attribute identifier is used as a matching field to define a forwarding control. The flow matching based on the attribute identifier and the flow authentication protocol jointly implement fine-grained access control. We conduct theoretical analysis and simulation-based evaluation of Attribute-Guard. The results show that Attribute-Guard can efficiently identify and reject fake flow.

In wireless networks, the Contention Window (CW) is a crucial parameter for wireless channel sharing among numerous stations, directly influencing overall network performance. With the rapid growth and increasing diversity of traffic in wireless networks, differentiating and serving various types of traffic to enhance network performance has become a pressing issue that needs to be addressed. Deep Reinforcement Learning (DRL) optimizes decision-making through the interaction between an agent and its environment, enabling it to handle complex state spaces and high-dimensional data, making it particularly suitable for dynamically adjusting the contention window and adapting to environmental changes in real time. Access Category (AC) is used to differentiate various types of traffic to support different quality of service (QoS) requirements. Therefore, this paper proposes the integration of DRL techniques into the EDCA mechanism, utilizing AC to differentiate network traffic, while the DRL technology adjusts the contention window to adequately ensure QoS for different types of traffic and enhance overall network performance. This paper proposes a CW back off scheme based on DRL for differentiating ACs. The scheme uses DRL technology to observe the channel collision rate and sense the current network conditions, thereby adaptively adjusting the CW size for ACs. In addition, it dynamically adjusts the back off strategy according to the perceived current network conditions to optimize the data transmission process. In the range of 20–120 stations, the scheme was tested in both single AC and multiple AC traffic scenarios, demonstrating excellent performance. The collision rate consistently remained below 18%, while the normalized throughput was maintained above 76%. Additionally, there is a significant improvement compared to existing deep reinforcement learning-based optimization schemes. Experimental results show that this scheme effectively discriminates between different ACs, resulting in lower latency and higher throughput for high-priority traffic. Furthermore, adaptively adjusting the CW size and improving the back off strategy maintains a low collision rate and stable throughput even under heavy load conditions, significantly improving the overall network performance.

The emerging software-defined networking (SDN) technology lacks tools to proactively ensure that policies will be followed or to inspect the behavior of the network. The network is vulnerable to sophisticated attacks against packets, such as alteration, injection, dropping, and hijacking attacks. Accurate and efficient network packet forwarding verification is a critical issue to ensure the correctness of packet forwarding when confronting with malicious attacks, while most of the existing packet forwarding verification solutions were implemented by inserting linear-scale cryptographic tags that increased with path length, which introduced significant communication overhead. In this paper, we propose a constant-size credential based packet forwarding verification mechanism in SDN. In the scheme, the ingress switch of a flow embeds a tag credential of constant-size which is independent of the packet forwarding path, each downstream switch verifies packets basing on the constant-size credential, and the controller periodically acquires node forwarding statistics along the path and localizes anomaly. The header space communication overhead of the proposed scheme is less than existing linear-scale mechanisms. We further prototype and evaluate the proposed scheme. Experiments demonstrate that the scheme achieves efficient forwarding and effective anomaly localization with less than 11% of additional forwarding delays and no more than 10% of throughput degradation.