PKI Credential Exchange for OpenFlow Switches
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OpenFlow protocol lacks effective protection mechanisms against untrusted network devices joining existing networks, allowing malicious devices to easily communicate with OpenFlow network controllers and compromise network security.
Innovation Solution
A method and system for generating PKI credentials for networking appliances, involving a computer that receives a certificate signing request, generates an appliance certificate using a certificate authority, and returns it to the appliance, with extended YANG data models for netconf configuration to facilitate secure communication and authentication between OpenFlow network adapters and SDN controllers using OpenDaylight.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the OpenFlow protocol is used to allow any network device to join the network, then network adaptability and ease of connection are improved, but network security and protection against malicious devices deteriorate
Solution Approach 1:
The system performs preliminary authentication actions before allowing a network device to join the OpenFlow network. The SDN controller verifies the device's certificate against trusted CA certificates before establishing communication, preventing malicious devices from joining without prior detection or authorization
Solution Approach 2:
The patent introduces a certificate authority (CA) certificate as an intermediary trust anchor. The SDN controller uses this intermediary to verify the authenticity of device certificates, creating a secure chain of trust that mediates between the device and the network without requiring direct trust placement in each device
2Reliability
If PKI certificate authentication is implemented for network devices, then network security and protection against unauthorized access are improved, but device complexity and authentication overhead increase
Solution Approach 1:
The network device performs self-service by generating its own private key and certificate pair, and by autonomously presenting its certificate for verification. This reduces the operational complexity for administrators while maintaining strong security, as the device independently handles its authentication credentials without requiring manual certificate deployment
Data Source
AI summary
Generating PKI credentials for authenticating a networking appliance attempting to attach to a network includes: receiving a certificate signing request (CSR) from the networking appliance, wherein the CSR comprises credential data associated with an identity of the networking appliance; generating an appliance certificate based on the credential data and a certificate authority (CA) certificate associated with the computer; and returning the appliance certificate to the networking appliance.