# US 11,451,531 B2 · Certificate obtaining method, authentication method, and network device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,531 B2 - Document ID: US11451531B2 - Status: Granted - Kind: B2 - Application number: 16/456,706 - Filed: 2019-06-28 - Published: 2019-10-24 - Granted: 2022-09-20 - Earliest claimed: 2016-12-28 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Dacheng Zhang; Tianfu Fu; Chong Zhou - Web page: https://patentgrep.com/patent/US11451531B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/101: {Access control lists [ACL]} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A certificate obtaining method, an authentication method, and a network device, where a certificate is used for permission authentication when an application APP accesses an application programming interface (API) of a controller. The certificate includes one or more of: (a) information about operation permission of the APP on N application programming interfaces APIs of the controller, (b) identifiers of L APIs that are of the N APIs and that the APP has permission to operate, or (c) identifiers of R APIs that are of the N APIs and that the APP does not have permission to operate. ## Claims ### Claim 1 A certificate obtaining method, comprising: sending, by a network device comprising an application (APP), certificate application information to a certificate issuing device, wherein the certificate application information comprises information of the APP; receiving, by the network device, a certificate that is of the APP and that is from the certificate issuing device, wherein the certificate is generated according to the APP, wherein the certificate provides permission authentication when the APP accesses an application programming interface (API) of a controller, wherein the certificate comprises information about operation permission of the APP on N APIs of the controller, identifiers of L APIs that are of the N APIs and that the APP has permission to operate, and identifiers of R APIs that are of the N APIs and that the APP does not have permission to operate, wherein N is a natural number greater than or equal to 1, wherein L is a natural number greater than or equal to 1 and less than or equal to N, wherein R is a natural number greater than or equal to 1 and less than or equal to N, and wherein the controller comprises: a data-control interface configured to send a forwarding table to one or more network elements such that the one or more network elements forward data according to the forwarding table; and an application-control interface in communication with one or more APPs including the APP, wherein the one or more APPs are configured to perform operations by accessing one or more of the N APIs on the controller. ### Claim 2 (depends on 1) The certificate obtaining method according to claim 1, wherein the information about operation permission comprises identifiers of the N APIs and operation permission of the APP on each of the N APIs. ### Claim 3 (depends on 1) The certificate obtaining method according to claim 1, wherein the information about operation permission comprises identifiers of M API identifier sets, wherein an identifier of each of the M API identifier sets identifies operation permission on K APIs in a respective M API identifier set, wherein M is a natural number greater than or equal to 1, and wherein K is an integer greater than or equal to 0 and less than or equal to N. ### Claim 4 (depends on 1) The certificate obtaining method according to claim 1, wherein the certificate comprises the information about operation permission of the APP on the N APIs of the controller, wherein the operation permission is represented using a bitmap, wherein each of the L APIs that the APP has permission to operate is identified in the bitmap using a first binary bit, and wherein each of the R APIs that the APP does not have permission to operate is identified in the bitmap using a second binary bit. ### Claim 5 (depends on 1) The certificate obtaining method according to claim 1, wherein one or more of the information, the identifiers of L APIs, or the identifiers of R APIs are carried in extended information of the certificate, and wherein the extended information includes a type field, a default field, and a value field. ### Claim 6 An authentication method, comprising: receiving, by an authentication device, an access request message of an application (APP), wherein the access request message comprises a digital certificate, wherein the digital certificate comprises information about operation permission of the APP on N application programming interfaces (APIs) of a controller; identifiers of L APIs that are of the N APIs and that the APP has permission to operate, or identifiers of R APIs that are of the N APIs and that the APP does not have permission to operate, wherein N is a natural number greater than or equal to 2, wherein L is a natural number greater than or equal to 1 and less than or equal to N, and wherein R is a natural number greater than or equal to 1 less than or equal to N; and determining, by the authentication device, operation permission of the APP on the one or more APIs based on the digital certificate, wherein the controller comprises: a data-control interface configured to send a forwarding table to one or more network elements such that the one or more network elements forward data according to the forwarding table; and an application-control interface in communication with one or more APPs including the APP, wherein the one or more APPs are configured to perform operations by accessing one or more of the N APIs on the controller. ### Claim 7 (depends on 6) The authentication method according to claim 6, wherein the information about operation permission comprises identifiers of the N APIs and operation permission of the APP on each of the N APIs. ### Claim 8 (depends on 6) The authentication method according to claim 6, wherein the information about operation permission comprises identifiers of M API identifier sets, wherein an identifier of each of the M API identifier sets identifies operation permission on K APIs in a respective M API identifier set, wherein M is a natural number greater than or equal to 1, and wherein K is an integer greater than or equal to 0 and less than or equal to N. ### Claim 9 (depends on 6) The authentication method according to claim 6, wherein the operation permission is represented using a bitmap when the digital certificate comprises the operation permission of the APP on the N APIs of the controller, wherein the operation permission of the APP is represented using a binary bit in the bitmap, wherein the binary bit is set to a first value or a second value, wherein each of the L APIs that the APP has permission to operate is represented in the bitmap using the first value, and wherein each of the R APIs that the APP does not have permission to operate is represented in the bitmap using the second value. ### Claim 10 (depends on 6) The authentication method according to claim 6, wherein one or more of the information, the identifiers of L APIs, or the identifiers of R APIs are carried in extended information of the certificate. ### Claim 11 A certificate generation device, comprising: a communications interface configured to receive certificate application information and send the certificate application information, wherein the certificate application information comprises an application (APP); and a certificate generation module configured to receive the certificate application information from the communications interface and generate a certificate according to the APP in the certificate application information, wherein the certificate comprises information about operation permission of the APP on N application programming interfaces (APIs) of a controller, identifiers of L APIs that are of the N APIs and that the APP has permission to operate, or identifiers of R APIs that are of the N APIs and that the APP has no permission to operate, wherein N is a natural number greater than or equal to 2, wherein L is a natural number greater than or equal to 1 and less than or equal to N, wherein R is a natural number greater than or equal to 1 and less than or equal to N, and wherein the controller comprises: a data-control interface configured to send a forwarding table to one or more network elements such that the one or more network elements forward data according to the forwarding table; and an application-control interface in communication with one or more APPs including the APP, wherein the one or more APPs are configured to perform operations by accessing one or more of the N APIs on the controller. ### Claim 12 (depends on 11) The certificate generation device according to claim 11, wherein the information about operation permission comprises identifiers of the N APIs and operation permission of the APP on each of the N APIs. ### Claim 13 (depends on 11) The certificate generation device according to claim 11, wherein the information about operation permission comprises identifiers of M API identifier sets, wherein an identifier of each of the M API identifier sets identifies operation permission on K APIs in a respective M API identifier set, wherein M is a natural number greater than or equal to 1, and wherein K is a natural number greater than or equal to 1 and less than or equal to N. ### Claim 14 (depends on 11) The certificate generation device according to claim 11, wherein the operation permission is represented using a bitmap when the certificate comprises the operation permission of the APP on the N APIs of the controller, wherein each of the L APIs that the APP has permission to operate is identified using a first binary bit in the bitmap, and wherein each of the R APIs that the APP does not have permission to operate is identified using a second binary bit in the bitmap. ### Claim 15 (depends on 11) The certificate generation device according to claim 11, wherein one or more of the information, the identifiers of L APIs, or the identifiers of R APIs are carried in extended information of the certificate. ### Claim 16 A controller, comprising: N application programming interfaces (APIs), wherein N is a natural number greater than or equal to 2; an application-control interface configured to receive an access request message of an application (APP) in communication with the controller, wherein the access request message comprises a digital certificate, wherein the digital certificate comprises information about operation permission of the APP on the N APIs of the controller, identifiers of L APIs that are of the N APIs and that the APP has permission to operate, or identifiers of R APIs that are of the N APIs and that the APP has no permission to operate, wherein L is a natural number greater than or equal to 1 and less than or equal to N, and wherein R is a natural number greater than or equal to 1 less than or equal to N; an authenticator coupled to the communications interface and configured to determine operation permission of the APP on the N APIs based on the digital certificate; and a data-control interface configured to send a forwarding table to one or more network elements such that the one or more network elements forward data according to the forwarding table. ### Claim 17 (depends on 16) The controller according to claim 16, wherein the information about operation permission comprises identifiers of the N APIs and operation permission of the APP on each of the N APIs. ### Claim 18 (depends on 16) The controller according to claim 16, wherein the information about operation permission comprises identifiers of M API identifier sets, wherein an identifier of each of the M API identifier sets identifies operation permission on K APIs in a respective M API identifier set, wherein M is a natural number greater than or equal to 1, and wherein K is a natural number greater than or equal to 1 and less than or equal to N. ### Claim 19 (depends on 16) The controller according to claim 16, wherein the operation permission is represented using a bitmap when the digital certificate comprises the operation permission of the APP on the N APIs of the controller, wherein each of the L APIs that the APP has permission to operate is identified in the bitmap using a first binary bit, and wherein each of the R APIs that the APP does not have permission to operate is identified in the bitmap using a second binary bit. ### Claim 20 (depends on 16) The controller according to claim 16, wherein one or more of the information, the identifiers of L APIs, or the identifiers of R APIs are carried in extended information of the digital certificate.