OpenFlow Network Controller Authentication Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OpenFlow protocol lacks a mechanism to authenticate unknown and untrusted network devices before they can join an OpenFlow network, allowing malicious devices to easily integrate and potentially disrupt the network.
Innovation Solution
An authentication process is established where the OpenFlow network controller sends a first authentication message specifying a hash algorithm, and if the response matches, a challenge message is sent; if the device correctly responds to the challenge, it is permitted to join the network, or denied if it uses a different hash algorithm or does not support authentication, with options for backward compatibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication mechanism is implemented in OpenFlow protocol, then network security is improved, but device compatibility deteriorates
Solution Approach 1:
The authentication mechanism performs verification actions before allowing a network device to join the OpenFlow network. The controller sends authentication messages and verifies responses in advance, ensuring that only authenticated devices can establish control plane connections, thus preventing unauthorized access while maintaining security.
Solution Approach 2:
The authentication mechanism uses hash algorithm parameters (such as MD5 or SHA-1) to transform device identification information into authentication tokens. By changing the parameter representation from plain text to hashed values, the system achieves both security through cryptographic transformation and compatibility through standardized algorithm support.
2Reliability
If authentication process is required for all devices, then network security is improved, but ease of operation deteriorates
Solution Approach 1:
The authentication process is designed to be self-service for network devices. When a device attempts to join the network, the controller automatically initiates the authentication sequence by sending authentication messages, and the device automatically responds with its authentication token. This automated self-service approach maintains security while simplifying operation, as devices do not require manual configuration or intervention.
3Reliability
If strict authentication is enforced, then network security is improved, but adaptability deteriorates
Solution Approach 1:
The authentication mechanism implements partial authentication for legacy devices that do not support the authentication protocol. While new devices undergo full authentication verification, legacy devices are allowed to join with reduced or no authentication requirements. This partial action approach maintains security for modern devices while preserving compatibility with older equipment.
Data Source
AI summary
An OpenFlow network controller controls an OpenFlow network. A networking connection is established between the OpenFlow network controller and an OpenFlow network device attempting to become part of the OpenFlow network. After establishing the networking connection with the OpenFlow network device, the OpenFlow network controller attempts to authenticate the OpenFlow network device. Where authentication of the OpenFlow network device is successful, the OpenFlow network controller sends a message to the OpenFlow network device to indicate that the authentication was successful and permits the OpenFlow network device to join and perform OpenFlow messaging.