Methods and devices for access control of data flows in software defined networking system

A controller device for access control of a data flow in a software defined networking system, wherein the controller device comprises:

• a processor;
• and
• memory storing instructions that, when executed by the processor, cause the controller device to:
• receive, from an intermediate node, a first packet associated with a first data flow between a client node and a server node,
• verify, based on flow attributes of the first packet, authentication of the first packet,
• repeat the receiving and verifying for a number of subsequent packets of the first data flow, wherein the number of subsequent packets is set based on type of protocol used for the first data flow and/or a policy set in the controller device, and
• send, to the intermediate node and/or to another intermediate node along a path of the first data flow, a respective verification message for each successfully verified authentication of the first packet and the number of subsequent packets, allowing the first packet and the number of subsequent packets of the first data flow for forwarding.

A method for authenticating a data flow in a software defined networking system, the method being performed in an intermediate node and comprising:

• receiving from a first endpoint node, a first data flow addressed to a second endpoint node,
• diverting, to a controller device, a first packet for an authentication verification, the first packet being associated with the first data flow,
• receiving, from the controller device, a first verification message in case of successfully verifying authentication of the first packet,
• receiving, from the second endpoint node, a second packet sent in response to the first packet,
• diverting, to the controller device, the second packet for an authentication verification,
• receiving, from the controller device, a second verification message verifying authentication of the second packet, and
• repeating the receiving and diverting for a number of subsequent packets of the first data flow, wherein the number of subsequent packets is set based on type of protocol used for the first data flow and/or a policy set in the controller device.

An intermediate node for authenticating a data flow in a software defined networking system, wherein the intermediate node comprises:

• a processor;
• and
• memory storing instructions that, when executed by the processor, cause the controller device to:
• receive from a first endpoint node, a first data flow addressed to a second endpoint node,
• divert, to a controller device, a first packet for an authentication verification, the first packet being associated with the first data flow,
• receive, from the controller device, a first verification message in case of successfully verifying authentication of the first packet,
• receive, from the second endpoint node, a second packet sent in response to the first packet,
• divert, to the controller device, the second packet for an authentication verification,
• receive, from the controller device, a second verification message verifying authentication of the second packet, and
• repeat the receiving and diverting for a number of subsequent packets of the first data flow, wherein the number of subsequent packets is set based on type of protocol used for the first data flow and/or a policy set in the controller device.