Distributing Key Revocation Status in Named Data Networking

Content-Centric Networking (CCN) is a communication paradigm that emphasizes content distribution. Named-Data Networking (NDN) is an instantiation of CCN, a candidate Future Internet Architecture. NDN supports human-readable content naming and router-based content caching which lends itself to efficient, secure, and scalable content distribution. Because of NDN's fundamental requirement that each content object must be signed by its producer, fragmentation has been considered incompatible with NDN since it precludes authentication of individual content fragments by routers. The alternative is to perform hop-by-hop reassembly, which incurs prohibitive delays. In this paper, we show that secure and efficient content fragmentation is both possible and even advantageous in NDN and similar content-centric network architectures that involve signed content. We design a concrete technique that facilitates efficient and secure content fragmentation in NDN, discuss its security guarantees and assess performance. We also describe a prototype implementation and compare performance of cut-through with hop-by-hop fragmentation and reassembly.

Named Data Networking (NDN), an emerging communication model in the content centric networks, has recently presented a solid framework for the future Internet. The NDN exploits content name instead of host name (IP address) and content caching. These features make NDN particularly efficient in networks with intermittent connectivity and dynamic topologies such as mobile ad hoc networks (MANETs). Due to the structure of NDN nodes, design of forwarding strategies has a vital impact on the network performance. In this paper, we propose a new forwarding strategy: redundancy elimination forwarding (REF). In REF, the NDN node structure and the operation of the data structures are modified. These modifications improve network performance in terms of throughput, overhead and resource requirements. REF strategy is simulated in different scenarios based on ndnSIM and the results demonstrate that it provides robust performance for various environments.

The current Internet infrastructure, initially conceived to provide closed group connectivity to a limited user-base, is now facing the challenges of catering to over three billion users with dynamically changing data, transport, and access requirements. Content-Centric Networking (CCN) is being explored as a possible future Internet architecture. Named-Data Networking (NDN) exemplifies CCN and with the ever-changing security landscape, it is imperative to build it with intrinsic resilience based on the security by design narrative. In this extended abstract, we explore the fake interest fiooding by adversaries to launch a Distributed Denial of Service (DDoS) attack in NDN. We propose Kiram as an intelligent anomaly recognition and alert generation mechanism serving as a collaborative countermeasure to a DDoS attack. The alert generated by Kiram is named Warding Off Evil (WOE). This poster presents results establishing the effectiveness of Kiram based on substantial simulations over a fairly realistic topology.

Radient: Scalable, memory efficient name lookup algorithm for named data networking

NDN (Named Data Networking) as one approach of the Content-Centric Networking (CCN) architecture, proposed by Jacobson, 2006, conceptually, has some advantages compares to the current Internet technology which build based on host-to-host TCP/IP protocol stack. However, technically, we have to examine the NDN approach, beside to prove the concept, also to get as much as able the opportunities of improvement the concept before implementation stage. In this work, it has been compared two kinds of cache replacement policy. The policies that compared are the Least Recency Used (LRU) and Least Recency/Frequency Used (LRFU). In the first stage both of these policies implemented and then the performance comparison has been investigated. Based on the experiment, the LRFU policy outperform LRU policy with a limited cache size. As a consequence the LRFU has a time complexity higher than LRU. Finally, based on the simulation can be concluded that LRFU should be considered as cache replacement strategy on NDN instead of basic NDN cache policy, named as caching everything everywhere (CEE)

Content-Centric Networking (CCN) is a recent network paradigm designed to address some key limitations of the current IP-based Internet. One of its main features is innetwork content caching which allows requests for content to be served by routers. Despite the benefits of improved bandwidth utilization and lower latency of retrieving popular content, innetwork caching inhibits producers from collecting information about content that is requested and later served from network caches. Such information is often needed for accounting and popularity purposes. In this paper, we address accounting in CCN by varying the degree of consumer, router, and producer involvement. We also identify and analyze inherent performance and security tradeoffs. We show that fine-grained accounting is infeasible with router caches and without explicit application support. We then recommend accounting strategies that entail a few simple requirements for CCN architectures. Finally, we show, via experimental results, that network-layer CCN accounting is viable and incurs low overhead for all parties involved. approaches.

Recently, Content-Centric Networking (CCN) has been extensively studied by networking researchers as one of the promising network architectures for realizing information-centric networks. CCN adopts a fundamentally different communication paradigm from that of the conventional Internet Protocol (IP). Therefore, advanced transport protocols developed for IP cannot be directly used in CCN. In this paper, we propose a packet loss detection mechanism called Interest ACKnowledgement (ACK). Interest ACKs provides information on the history of successful Interest packet receptions at a repository (i.e., content provider), this information is conveyed to the corresponding entity (i.e., content consumer) via the header of Data packets. Interest ACKs enable the entity to quickly and accurately detect Interest and Data packet losses in the network. We conduct simulations to investigate the effectiveness of Interest ACKs in a rather simple network topology. Our results show that Interest ACKs are effective for improving the adaptability, stability, and fairness of CCN with window-based flow control and that packet losses at the repository can be reduced by 10%–20%.

Recently, content-centric networking (CCN) has become a hot research topic for the diffusion of contents over the Internet. Most existing works on CCN focus on the improvement of network resource utilization. Consequently, the energy consumption aspect of CCN is largely ignored. In this paper, we propose a distributed energy-efficient in-network caching scheme for CCN, where each content router only needs locally available information to make caching decisions considering both caching energy consumption and transport energy consumption. We formulate the in-network caching problem as a non-cooperative game. Through rigorous mathematical analysis, we prove that pure strategy Nash equilibria exist in the proposed scheme, and it always has a strategy profile that implements the socially optimal configuration, even if the routers are self-interested in nature. Simulation results are presented to show that the distributed solution is competitive to the centralized scheme, and has superior performance compared to other popular caching schemes in CCN. Besides, it exhibits a fast convergence speed when the capacity of content routers varies.

Recently, Content-Centric Networking (CCN) has been paid more and more attention. The modeling of CCN as an important research point is the foundation of the architecture. The past work of cache network modeling always assumes the virtual round trip time (VRTT) is zero for simplicity. However, this assumption isn't practical and results in model error especially in CCN. CCN's router can aggregate the content requests during the VRTT to avoid content delivery repeatedly. Thus, to modeling CCN data transfer, as well as understanding how it should be managed, the VRTT shouldn't be ignored. In this paper, we model the data transfer in CCN, and propose a multi-cache with aggregation approximation (MCAA) algorithm to get the content miss rate and VRTT at each router. Simulation results show the validity of our MCAA algorithm.

Content-Centric Networking (CCN), an instance of information-centric networking, is a candidate next-generation Internet architecture that emphasizes on content distribution by making it directly addressable and routable. By opportunistically caching content within the network, CCN appears to be well-suited for a large-scale content distribution and for meeting the needs of increasingly mobile and bandwidth-hungry applications that dominate today’s Internet. To provide content authentication, CCN dictates that each content object must be digitally signed by its respective producer. All entities (consumers and routers) must, in principle, verify the content signature before processing it. However, in practice, this poses two challenges for routers: (1) overhead due to signature verification, key retrieval, and potential certificate chain traversal; and (2) lack of trust context, i.e., determining which public keys are trusted to verify the content signature. This renders signature verification impractical in routers, opening the door for the so-called content poisoning attacks. We study the root causes of the content poisoning attacks and reach the conclusion that meaningful mitigation of content poisoning is contingent upon a network-layer trust management architecture. We propose two approaches: deterministic and probabilistic, that allow routers to detect fake (aka “poisoned”) content objects. The usages of each approach depend on the location and role of routers in the network, as well as their computational capabilities.

Using Interests (requests that elicit content) and maintaining per-Interest forwarding state in Pending Interest Tables (PIT) are integral to the design of the Named Data Networking (NDN) and Content-Centric Networking (CCNx) architectures. However, using PITs makes the network vulnerable to Interest-flooding attacks, and PITs can become very large. It is shown that in-network caching eliminates the need for Interest aggregation and obviates the use of PITs. A new approach to content-centric networking (CCN-GRAM) is introduced that provides all the benefits of NDN and CCNx, eliminates the use of PITs by means of anonymous datagrams, and is immune to Interest-flooding attacks. Routers maintain routes to the anonymous origins of Interests using an on-demand routing approach in the data plane that can also be used to provide native support for multicasting in the dat a plane. Simulation experiments show that the number of forwarding entries required in CCN-GRAM is orders of magnitude smaller than the number of PIT entries.

Caching is the key feature of Content Centric Networking (CCN) that allows the Internet Service Provider (ISP) to reduce network traffic crossing its network, and save bandwidth usage cost. On the other hand, it is also on benefit of the Content Providers (CPs) to cache the contents within the ISP network near the consumers. However, caching paid contents (the contents that only paying consumers can access), which are the main source of income for CP, in the ISP network complicates the CP's task of controlling content access and payment. Thus, ISP manages content placement inside its cache-enabled routers and serves content based on user demands, without any coordination with CP. There is no profit sharing mechanism between both ISP and CPs. Therefore, a payment mechanism between ISP and CPs that considers paid content caching and distribution inside the ISP network is needed. To address this challenge, we propose a new incentive mechanism for paid content caching that satisfies both ISP and CPs through the use of reverse auction. The ISP monetizes its cache storage through caching contents from multiple CPs and selling them to its customers. The reverse auction helps the ISP to get prices from multiple CPs, and to select the price that minimize its total payment. The simulation results show that our proposal satisfies all network players involved in in- network caching through increasing their utilities.

With the advent of content-centric networking (CCN) where contents can be cached on each CCN router, cache robustness will soon emerge as a serious concern for CCN deployment. Previous studies on cache pollution attacks only focus on a single cache server. The question of how caching will behave over a general caching network such as CCN under cache pollution attacks has never been answered. In this paper, we propose a novel scheme called CacheShield for enhancing cache robustness. CacheShield is simple, easy-to-deploy, and applicable to any popular cache replacement policy. CacheShield can effectively improve cache performance under normal circumstances, and more importantly, shield CCN routers from cache pollution attacks. Extensive simulations including trace-driven simulations demonstrate that CacheShield is effective for both CCN and today's cache servers. We also study the impact of cache pollution attacks on CCN and reveal several new observations on how different attack scenarios can affect cache hit ratios unexpectedly.

Named Data Networking (NDN) is a newly proposed next-generation Internet architecture that uses the name of data to forward and route packets. As a potential candidate for future Internet architecture, it is crucial to address the security and privacy issues in NDN. NDN is vulnerable to a new type of Distributed Denial of Service (DDoS) attacks called Interest Flooding Attacks (IFAs). The attackers can send a massive amount of Interest requests to overwhelm the Pending Interest Table (PIT) at routers resulting in network disruption for legitimate users. In this paper, we propose a Binary Tree-Based Interest Flooding Attack Detection and Mitigation Scheme (BTIFADMS) to protect NDNs. The proposed scheme allows each NDN router to use binary trees to detect IFAs and mitigates IFAs by limiting the number of Interest requests forwarded from the contaminated routers. The simulation evaluation shows that BTIFADMS can quickly and accurately identify and respond to the IFAs in the NDNs.

Enabling opportunistic search and placement in cache networks