Abstract:To address the challenges of high verification overhead and coarse-grained identity management in software-defined networking (SDN) user authentication, an authentication method for data plane based on attribute identification is proposed. User attribute information is utilized to generate attribute identifiers through an improved Schnorr algorithm, which are then embedded into user data packets. P4-programmable switches are employed to parse these packets and validate the attribute identifiers, thereby achieving user authentication. After successful authentication, the controller matches user attributes with specific access policies and deploys these policies to the switches for enforcement. By performing attribute-based authentication in the data plane, the controller’s workload is reduced, enabling rapid user authentication and fine-grained access control in SDN. Experimental results demonstrate that the proposed method achieves lower network latency and communication overhead compared to existing approaches.