ONES Security
Last updated
Last updated
Copyright © Aviz Networks, Inc.
ONES is a support application for SONiC stack. It is designed for customer's engineering team such as SRE’s, HW and SW engineering teams for their daily network diagnosis and troubleshooting needs. In addition to that ONES exposes the API to integrate with external tools or customer homegrown applications.
Role Based Access
ONES provide RBAC support for creating dedicated user accounts. it has a superadmin account which can manage these user accounts for control and permissions
Secure Access to Application
ONES Application provides HTTPS over standard port 443 supporting both self-signed and CA-signed certificates
Secure Access to switches
Auto-discovery communication between Agent and collector using a secure channel(SSL/TLS) with certificates (self-signed and CA-signed certificates
API Access
ONES Application provides HTTPS over standard port 443 supporting both self-signed and CA-signed certificates, the API is available via time-bound authentication tokens.
ONES application provides HTTPs over standard port 443 supporting both self-signed and CA signed certificates.
HTTPS Support CA Signed
HTTPS Self Signed
ONES utilizes gRPC infrastructure to communicate with switch agents. TLS (Transport Layer Security) is the primary security protocol used by gRPC to secure communication between the client and the server. TLS provides authentication, confidentiality, and integrity of data. Authentication is achieved using digital certificates, which verify the identity of the client and the server.
With an added extra layer of security, ONESv3.0 support Certificate based communication between switches and ONES Controller, and all the metrics will be streamed using the certificate-based encryption
ONESv3.0 allows a user to use password based authentication between Controller and Switches, all the communication can be done by the implementation of password based agent.
Transport Layer Security (TLS) is a crucial protocol that ensures secure communication between ONES Controller and Agent, Whenever Agent will register to ONES server and further it will start sending the update it will encapsulate all the metrics and will do the encryption based on certificate provided at the time of installation, by using this all the communication will be encrypted between ONES agent and ONES controller TLS relies on digital certificates issued by trusted Certificate Authorities (CAs) to authenticate servers and sometimes clients. These certificates validate the identity of the entities involved in the communication and establish trust in the encrypted connection.
Password-based authentication can be implemented between the agent and controller, allowing all devices to register using a shared password. This method relies on OpenSSL for encrypting the communication, ensuring secure transmission of credentials and data. OpenSSL employs robust encryption algorithms to safeguard the authentication process and prevent unauthorized access.
