The communication between the controller and switch happens using the OpenFlow protocol, where a set of defined messages can be exchanged between these entities over a secure channel. The secure channel is an interface that connects each OpenFlow switch to a controller. The Transport Layer Security (TLS) connection to the user-defined (otherwise fixed) controller is initiated by the switch with its power on. The controller's default TCP port is 6633. The switch and controller mutually authenticate by exchanging certificates signed by a site-specific private key. Each switch must be user-configurable, with one certificate for authenticating the controller (controller certificate) and the other for authenticating to the controller (switch certificate). Traffic to and from the secure channel is not checked against the flow table; therefore, the switch must identify incoming traffic as local before checking it against the flow table.
In case a switch loses contact with the controller...