diff --git a/protocols/netconf/api/src/main/java/org/onosproject/netconf/NetconfDeviceInfo.java b/protocols/netconf/api/src/main/java/org/onosproject/netconf/NetconfDeviceInfo.java
index 2468562..eb63974 100644
--- a/protocols/netconf/api/src/main/java/org/onosproject/netconf/NetconfDeviceInfo.java
+++ b/protocols/netconf/api/src/main/java/org/onosproject/netconf/NetconfDeviceInfo.java
@@ -22,6 +22,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.io.File;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Objects;
@@ -39,6 +40,8 @@
     private IpAddress ipAddress;
     private int port;
     private char[] key;
+    //File keyFile @deprecated 1.9.0
+    private File keyFile;
     private DeviceId deviceId;
 
 
@@ -68,7 +71,12 @@
      * @param password  the password for the device
      * @param ipAddress the ip address
      * @param port      the tcp port
-     * @param keyString the string containing the key.
+     * @param keyString the string containing a DSA or RSA private key
+     *                  of the user in OpenSSH key format
+     *                  <br>
+     *                  (Pre 1.9.0 behaviour: {@code keyString} can be file path
+     *                  to a file containing DSA or RSA private key of the user
+     *                  in OpenSSH key format)
      */
     public NetconfDeviceInfo(String name, String password, IpAddress ipAddress,
                              int port, String keyString) {
@@ -80,6 +88,7 @@
         this.ipAddress = ipAddress;
         this.port = port;
         this.key = keyString.toCharArray();
+        this.keyFile = new File(keyString);
     }
 
     /**
@@ -121,18 +130,34 @@
     /**
      * Exposes the key of the controller.
      *
-     * @return int port address
+     * @return {@code char[]} containing a DSA or RSA private key of the user
+     *         in OpenSSH key format
+     *         or null if device is not configured to use public key authentication
      */
     public char[] getKey() {
         return key;
     }
 
     /**
+     * Exposes the keyFile of the controller.
+     *
+     * @return File object pointing to a file containing a DSA or RSA
+     *         private key of the user in OpenSSH key format,
+     *         or null if device is not configured to use public key authentication
+     * @deprecated 1.9.0
+     */
+    @Deprecated
+    public File getKeyFile() {
+        return keyFile;
+    }
+
+    /**
      * Return the info about the device in a string.
      * String format: "netconf:name@ip:port"
      *
      * @return String device info
      */
+    @Override
     public String toString() {
         return "netconf:" + name + "@" + ipAddress + ":" + port;
     }
diff --git a/protocols/netconf/ctl/src/main/java/org/onosproject/netconf/ctl/NetconfSessionImpl.java b/protocols/netconf/ctl/src/main/java/org/onosproject/netconf/ctl/NetconfSessionImpl.java
index 451a2a1..26ded2f 100644
--- a/protocols/netconf/ctl/src/main/java/org/onosproject/netconf/ctl/NetconfSessionImpl.java
+++ b/protocols/netconf/ctl/src/main/java/org/onosproject/netconf/ctl/NetconfSessionImpl.java
@@ -118,7 +118,13 @@
             }
             boolean isAuthenticated;
             try {
-                if (deviceInfo.getKey() != null) {
+                if (deviceInfo.getKeyFile() != null && deviceInfo.getKeyFile().canRead()) {
+                    log.debug("Authenticating with key file to device {} with username {}",
+                              deviceInfo.getDeviceId(), deviceInfo.name());
+                    isAuthenticated = netconfConnection.authenticateWithPublicKey(
+                            deviceInfo.name(), deviceInfo.getKeyFile(),
+                            deviceInfo.password().equals("") ? null : deviceInfo.password());
+                } else if (deviceInfo.getKey() != null) {
                     log.debug("Authenticating with key to device {} with username {}",
                             deviceInfo.getDeviceId(), deviceInfo.name());
                     isAuthenticated = netconfConnection.authenticateWithPublicKey(