Skip to content

Commit

Permalink
docs(framework) Expand how-to-authenticate-supernodes page (#4909)
Browse files Browse the repository at this point in the history
Co-authored-by: Heng Pan <[email protected]>
  • Loading branch information
jafermarq and panh99 authored Feb 5, 2025
1 parent 7f14165 commit 202d2b0
Showing 1 changed file with 16 additions and 6 deletions.
22 changes: 16 additions & 6 deletions framework/docs/source/how-to-authenticate-supernodes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,22 @@
Authenticate SuperNodes
=======================

Flower has built-in support for authenticated SuperNodes, allowing you to verify the
identity of each SuperNode connecting to a SuperLink. To enhance security, node
authentication is only available when encrypted connections (SSL/TLS) are enabled.

Flower's node authentication leverages a signature-based mechanism to verify each node's
identity:
When running a Flower Federation (see :doc:`ref-flower-network-communication`) it is
fundamental that an authentication mechanism is available between the SuperLink and the
SuperNodes that connect to it. Flower comes with two different mechanisms to
authenticate SuperNodes that connect to a running SuperLink:

- **Automatic authentication**: In this mode, the SuperLink checks the timestamp-based
signature in each request from SuperNodes to prevent impersonation and replay attacks.
- **CSV-based authentication**: This mode functions similarly to automatic
authentication but requires the SuperLink to be provided with a list of authorized
public keys, allowing only those SuperNodes to connect.

The automatic authentication mode works out of the box and therefore requires no
configuration. On the other hand, CSV-based authentication mode is more sophisticated
and how it works and how it can be used is presented reminder of this guide. Flower's
CSV-based node authentication leverages a signature-based mechanism to verify each
node's identity and is only available when encrypted connections (SSL/TLS) are enabled:

- Each SuperNode must already possess a unique Elliptic Curve (EC) public/private key
pair.
Expand Down

0 comments on commit 202d2b0

Please sign in to comment.