Authentication and Authorization for Content-Centric Routing using W3C DIDs and VCs

International audience

In Named Data Networking (NDN), there is a need for routing protocols to populate Forwarding Information Base (FIB) tables so that the Interest messages can be forwarded. To populate FIBs, clients and routers require some routing information. One method to obtain this information is that network nodes exchange routing information by each node advertising the available content objects. Bloom Filter-based Routing approaches like BFR [1], use Bloom Filters (BFs) to advertise all provided content objects, which consumes valuable bandwidth and storage resources. This strategy is inefficient as clients request only a small number of the provided content objects and they do not need the content advertisement information for all provided content objects. In this paper, we propose a novel routing algorithm for NDN called pull-based BFR in which servers only advertise the demanded file names. We compare the performance of pull-based BFR with original BFR and with a flooding-assisted routing protocol. Our experimental evaluations show that pull-based BFR outperforms original BFR in terms of communication overhead needed for content advertisements, average roundtrip delay, memory resources needed for storing content advertisements at clients and routers, and the impact of false positive reports on routing. The comparisons also show that pull-based BFR outperforms flooding-assisted routing in terms of average round-trip delay.

A blockchain-based architecture for secure vehicular Named Data Networks

Named data networking (NDN) is a promising alternative data dissemination technology of TCP/IP communication networks, which can bring out much more cost-effective and resilient communication in a highly mobile environment. However, due to the feature of NDN, content poisoning comes out as a potential threat. Hence, state-of-the-art studies introduce network layer approaches based on name-key binding, in which the producer notifies routers of the bindings of names and key values. Key values include publisher public key digest or content digest. Routers check key values to determine whether incoming data packets have been poisoned. Unfortunately, the approaches lead to more vulnerabilities in dynamic content poisoning because attackers can impersonate the producer to alter or fabricate the bindings. Thus, we introduce a consumer-oriented two-phased lightweight security scheme, which consists of an end-to-end authentication and a packet-level name-key query mechanism. Specifically, the name-key bindings are authenticated via an additional verification by the consumer. Furthermore, we also introduce a novel trust model to help routers to determine and disconnect from the malicious nodes. Finally, our extensive experimental results demonstrate that the scheme can work effectively in improving the vulnerability of existing studies on dynamic content poisoning and lowering the system overhead simultaneously.

The large expansion in network services and applications seen in the last few years requires new network architectures to satisfy an increasing number of users and enhance content delivery. Named Data Networking (NDN) has recently appeared as a new paradigm to solve many shortcomings in the current TCP/IP architecture. Its main characteristics like stateful forwarding and in-network caching made NDN networks an efficient environment for data delivery where the data is retrieved based on content names rather than IP addresses. The NDN, by its nature, defends against the well-known Distributed Denial of Service (DDoS) attacks that take place in the traditional TCP/IP architecture. However, a special kind of DoS attack called Collusive Interest Flooding Attack (CIFA) has appeared to overwhelm the resources of NDN routers by filling their Pending Interest Tables (PIT) with long-lasting malicious entries. The network throughput and consumer satisfaction rate are highly affected by CIFA. A lightweight yet efficient stateless CIFA detection algorithm is proposed in this research utilizing the non-parametric CUSUM algorithm; a change point detection approach that detects the point in time when a transition occurs in the network. The proposed algorithm is characterized by its low computational overhead, highly accurate detection, and quick response. To detect the malicious name prefixes and eliminate the CIFA effect, a mitigation algorithm that uses the average response time vales of all name prefixes is proposed in this research. Experimental results show that this approach detects CIFA after 199.5 ms from when an attack is launched in the large-scale topology. In addition, the mitigation approach effectively reduces the PIT utilization and increases the average consumer satisfaction rate.

Named Data Networking (NDN) is a future Internet architecture that replaces IP addresses with namespaces of contents that are searchable at the network layer. A challenging task for NDN routers is to manage forwarding-information bases (FIBs) that store next-hop routes to contents using their stored usually long names or name prefixes. In this paper, we propose FCTree, a compressed FIB data structure that significantly reduces the required storage space at the router and can efficiently meet the demands of having routes that are orders of magnitude larger than IP-based ones in conventional routing tables. FCTree employs a localized front-coding compression to buckets containing partitions of the routes. The top routes in these buckets are then organized in B-ary self-balancing trees. By adjusting the size of the buckets, the router can reach an optimal tradeoff between the latency of the longest prefix matching (LPM) operation and the FIB storage space. In addition, in contrast to existing hash and bloom-filter based solutions, the proposed FCTree structure can significantly reduce the latency required for range and wildcard searches (e.g., for latency sensitive streaming applications or network-layer search engines) where up to k routes are returned if they are prefixed by a requested name. Performance evaluation results demonstrate the significant space savings achieved by FCTree compared to traditional hash-based FIBs.

Optimal Qos-aware network reconfiguration in software defined cloud data centers

In Vehicular (Ad-hoc) Network (VANET), besides Vehicle-to-Vehicle communications (V2V), vehicles in VANET also exchange data with Road-Side-Units (RSUs) and Cellular Base Stations (Vehicle-to-Infrastructure communications (V2I)). With the introduction of Intelligent Transport Systems (ITS), VANETs possess a great potential in enabling surveillance services. The rapid development of wireless communication technologies recently results in empowering data exchange among vehicles, RSUs and Cellular Base Stations, improving various types of applications and services such as safety driving, route planning, traffic alert, and context-aware infotainment. However, the benefits offered by VANETs and ITS cannot be fully realized unless there is a mechanism to effectively defend against fake and erroneous information exchange from malicious or dysfunctional nodes to other vehicles and RSUs for their own purposes. In this regards, trust appears as one of the solutions for VANETs to establish secure connectivity and reliable services. The conceptual idea to tackle down this challenges is that only data from trusted vehicles is taken into account. Thus, the aim is to evaluate trust of a vehicle in exchanging high quality of information. This paper presents the trust concept, key characteristics, a trust evaluation model, and a prototype for trusted data exchange activities in VANETs.

To viably identify interest flooding assault (IFA) in Named Data Networking (NDN), this paper proposes a discovery technique for interest flooding assault dependent on chi-square test and similitude test. Initially, it decides the identification window size dependent on the dissemination of data name prefixes (that is data entropy) in the current organization traffic. The assailants might annex subjective irregular suffix to a certain prefix in the organization traffic, and afterward send an enormous number of interest parcels that can't get the reaction. Focused on at this issue, the affectability of chi-square test is utilized to distinguish the difference in pre-fix of interest parcels. Premium parcels started by IFA assailants are generally joined to a genuine prefix, yet with an arbitrarily created suffix appended. Considering of this issue, the similitude of interest parcel prefixes is additionally identified. At long last, the location consequences of the two viewpoints are consolidated to hinder mine if interest flooding assault has happened. Moreover, as indicated by the symmetric steering normal for Pending Interest Table (PIT), likewise the fashioned interest parcel will be sent back to the aggressor, and afterward confine the corresponding port of the assailant, to viably smother the IFA assault. The test results show that the proposed technique cannot just identify IFA in NDN toward the start of the assault, yet in addition is more precise and powerful than different strategies.

Non-Collusive Interest Flooding Attacks (NCIFA) disrupt Named Data Networks' (NDNs) seamless communication and content distribution through QoS degradation. This work proposes 2TierEdge-Defense: a framework based on Long Short Term Memory (LSTM) to detect NCIFA in NDN at the edge content routers. The framework has been evaluated on large-scale Rocketfuel topologies for AT&T Internet Service Provider. The 2TierEdge-Defense framework consists of attack detection and mitigation modules with detection at edge router and their interfaces. During offline training and evaluation, the 2TierEdge-Defense framework can detect NCIFA with 0.92 (F1-score) and 0.84 (F1-score) at edge routers and their interfaces, respectively, with cascaded F1-score of 0.9872. Upon detection, the mitigation strategy in the 2TierEdge-Defense framework can improve the QoS metrics as quickly as in 0.45 seconds with an overall F1 score as high as 0.9872. The 2TierEdge-Defense is evaluated for scalability topology scenarios to ensure better performance when deployed on NDN content routers with a cascaded miss rate of 0.1 and a false alarm rate of 0.07.

Middleboxes have become an integral part of modern enterprise and data center networks. They are used for realizing various performance and security objectives. Most middlboxes (e.g., firewalls, Intrusion Detection Systems (IDSs), Network Address Translators (NATs), etc.) are dedicated hardware appliances. However, recent advancements in cloud and virtualization technologies have fueled the concept of Virtual Middleboxes or Virtual Network Functions (VNFs) along with a new research field known as Network Function Virtualization (NFV). This area of research has gained a lot of traction from both industry and academia. Although much progress has been made in NFV technology, a crucial component for realizing the primary objective of NFV is still missing – a management and orchestration [7] system that conforms to the principles of NFV: open source, open API and standardized software solutions. Without this feature, network operators may end-up with the same situation of vendor lock-in as with proprietary hardware middleboxes. A number of recent proposals like Stratos [8], OpenNF [9], and Split/Merge [10], strive to fulfill the requirements for VNF management and orchestration. However, they propose incompatible northbound APIs. What is really needed is a standardized API that is flexible enough to express a wide range of NFV management and orchestration operations. History shows that standardization efforts usually take a long time and often are futile. Hence, we take a different approach, and propose to use an existing, well known, standardized interface for NFV management and orchestration: the Linux file system interface.

In this thesis, Vehicular Named-Data Networking (VNDN) refers to the use of the Named-Data Networking communication model over Vehicular Ad-hoc Networks. With the aim of addressing the problems caused by mobility to efficiently support VNDN communications in highly mobile traffic scenarios, various contributions were proposed in the scope of this thesis. These contributions include a routing protocol, able to address VNDN problems such as broadcast storms and message redundancy, as well as solutions to enable content advertisements and for addressing the problems caused by reverse path partitioning, network partitioning, and source mobility. Finally, all the proposed solutions are integrated into a single framework called MobiVNDN. The evaluation results show that the proposed solutions are efficient and scalable, providing high VNDN application performance even in complex traffic scenarios

Mobile adhoc networks (MANETs) consist of mobile nodes with no fixed infrastructure. Dynamic Source Routing (DSR) which is on-demand routing protocol is a widely accepted mobile adhoc network routing protocol used to provide connectivity to mobile nodes. However, DSR and other on-demand routing protocols are vulnerable to different types of security attacks and black hole attack is one of them. In black hole attack, malicious node sends a fake route reply in response of route request to source node claiming for an optimal route to the destination. Thus, node which starts route discovery process establishes a path through malicious node and starts sending data packet on this route. Malicious node drops the data packet which reduces packet delivery ratio. To secure DSR, we propose a scheme which confirms the authenticity of route with the help of verification packet. This packet is generated by first intermediate hop in the route of route reply. Simulation results show improvement in packet delivery ratio and throughput.

One unique architectural benefit of Named Data Networking (NDN) is adaptive forwarding, i.e., the forwarding plane is able to observe data retrieval performance of past Interests and use it to adjust forwarding decisions for future Interests. To be effective, adaptive forwarding assumes Interest Routing Locality, meaning that Interests sharing the same prefix are likely to follow a similar forwarding path within a short period of time. Therefore, past observations can provide insight into how forwarding will likely perform for the same prefix in the near future. Since Interests can have multiple common prefixes with different lengths, the real challenge is determining which prefix length should be used in adaptive forwarding to record path measurements - we refer to this as the Prefix Granularity Problem. The longer the common prefix is, the better Interest Routing Locality. However, finer grained-prefixes cover fewer Interests each and require a larger forwarding table. Existing adaptive forwarding designs use a static prefix length, which is known to encounter issues in the event of partial network failures. In this work, we propose to dynamically aggregate and de-aggregate name prefixes in the forwarding table in order to use the prefixes that are the most appropriate given current network situation. In addition, to reduce the overhead of adaptive forwarding, we propose mechanisms to minimize the use of longest prefix matching during the processing of Data packets. Simulations demonstrate that the proposed techniques can result in better forwarding decisions in the event of partial network failures with significantly reduced overhead.

Information-centric Networking (ICN) is a future Internet architecture design, where application-level names are directly used to route interests to fetch a copy of the desired content/data from any location. Following the conventions of the Internet Protocol to store the pre-computed routing/forwarding state for all prefixes at the network nodes raises scalability concerns in ICN (where content name prefixes need to be stored), especially at the inter-domain level. Instead, we consider the other extreme; that is, On-Demand Routing (ODR) computation for content name prefixes as interests arrive. ODR makes use of domain-level, per-prefix routing instructions usable by all the forwarders in a domain, named Routing Information Objects (RIO). Forwarders discover and retrieve RIOs in a similar way as content and can be cached in a new data structure called Route Information Store (RIS). RIOs are handed to a routing strategy module to perform a routing decision before relaying the packets. We demonstrate through extensive simulations that ODR scales the storage of routing/forwarding information through caching and information discovery-two mechanisms inherent to the ICN design. We propose our design as an extension of the Named Data Networking (NDN) architecture and discuss all the proposed enhancements in detail.