SUMMARY Software-defined networking (SDN) is recognized as the next-generation networking paradigm. The software-defined architecture for underwater acoustic sensor networks (SDUASNs) has become a hot topic. However, the current researches on SDUASNs is still in its infancy, which mainly focuses on network architecture, data transmission and routing. There exists some shortcomings that the scale of the SDUASNs is difficult to expand, and the security maintenance is seldom dabble. Therefore, a scalable software-definition architecture for underwater acoustic sensor networks (SSDUASNs) is introduced in this paper. It realizes an organic combination of the knowledge level, control level, and data level. The new nodes can easily access the network, which could be conducive to large-scale deployment. Then, the basic security authentication mechanism called BSAM is designed based on our architecture. In order to reflect the advantages of flexible and programmable in SSDUASNs, security authentication mechanism with pre-push (SAM-PP) is proposed in the further. In the current UASNs, nodes authentication protocol is inefficient as high consumption and long delay. In addition, it is difficult to adapt to the dynamic environment. The two mechanisms can effectively solve these problems. Compared to some existing schemes, BSAM and SAM-PP can effectively distinguish between legal nodes and malicious nodes, save the storage space of nodes greatly, and improve the efficiency of network operation. Moreover, SAM-PP has a further advantage in reducing the authentication delay.