Certificate obtaining method, authentication method, and network device

An authentication method, comprising:

• receiving, by an authentication device, an access request message of an application (APP), wherein the access request message comprises a digital certificate, wherein the digital certificate comprises information about operation permission of the APP on N application programming interfaces (APIs) of a controller;
• identifiers of L APIs that are of the N APIs and that the APP has permission to operate, or identifiers of R APIs that are of the N APIs and that the APP does not have permission to operate, wherein N is a natural number greater than or equal to 2, wherein L is a natural number greater than or equal to 1 and less than or equal to N, and wherein R is a natural number greater than or equal to 1 less than or equal to N;
• and
• determining, by the authentication device, operation permission of the APP on the one or more APIs based on the digital certificate,
• wherein the controller comprises:
• a data-control interface configured to send a forwarding table to one or more network elements such that the one or more network elements forward data according to the forwarding table;
• and an application-control interface in communication with one or more APPs including the APP, wherein the one or more APPs are configured to perform operations by accessing one or more of the N APIs on the controller.

A certificate generation device, comprising:

• a communications interface configured to receive certificate application information and send the certificate application information, wherein the certificate application information comprises an application (APP);
• and
• a certificate generation module configured to receive the certificate application information from the communications interface and generate a certificate according to the APP in the certificate application information,
• wherein the certificate comprises information about operation permission of the APP on N application programming interfaces (APIs) of a controller, identifiers of L APIs that are of the N APIs and that the APP has permission to operate, or identifiers of R APIs that are of the N APIs and that the APP has no permission to operate,
• wherein N is a natural number greater than or equal to 2,
• wherein L is a natural number greater than or equal to 1 and less than or equal to N,
• wherein R is a natural number greater than or equal to 1 and less than or equal to N, and
• wherein the controller comprises:
• a data-control interface configured to send a forwarding table to one or more network elements such that the one or more network elements forward data according to the forwarding table;
• and an application-control interface in communication with one or more APPs including the APP, wherein the one or more APPs are configured to perform operations by accessing one or more of the N APIs on the controller.

A controller, comprising:

• N application programming interfaces (APIs), wherein N is a natural number greater than or equal to 2;
• an application-control interface configured to receive an access request message of an application (APP) in communication with the controller, wherein the access request message comprises a digital certificate, wherein the digital certificate comprises information about operation permission of the APP on the N APIs of the controller, identifiers of L APIs that are of the N APIs and that the APP has permission to operate, or identifiers of R APIs that are of the N APIs and that the APP has no permission to operate, wherein L is a natural number greater than or equal to 1 and less than or equal to N, and wherein R is a natural number greater than or equal to 1 less than or equal to N;
• an authenticator coupled to the communications interface and configured to determine operation permission of the APP on the N APIs based on the digital certificate;
• and
• a data-control interface configured to send a forwarding table to one or more network elements such that the one or more network elements forward data according to the forwarding table.