Dynamically Allocated Bloom Filter-Based PIT Architectures

Ahstract-Content-Centric Networking (CCN) is an emerging Internet paradigm where the content is treated as the first-class citizen and content names are used for network layer communication instead of IP addresses. Use of CCN in wireless environment can cause various issues such as re-transmissions, collisions, delay and link failure. One of the key issues that affects the performance of CCN is the management of Pending Interest Table (PIT). PIT stores each broadcasted Interest packet forwarded upstream towards the content provider and is purged either when the requested content is returned or the PIT Entry Lifetime (PEL) expires. The conventional method in CCN for PEL does not considering the network impairments such as channel error, and congestion. As a result, timeout occurs, and Interest packets are re-transmitted for the chunks that have been dropped or delayed. Due to limited size of storage in wireless CCN, all new incoming Interest packets (including retransmissions) affect the performance of network by bloating PIT. In this paper, therefore, we propose a scheme that purges the PIT entries quickly by prefetching the un-obtained content in advance. Simulation results show that proposed protocol performs better as comparing with the conventional CCN and another recent proposed protocol.

<p class="JESTECAbstract">Content Centric Networking (CCN) is a modern architecture that got wide attention in the current researches as a substitutional for the current IP-based architecture. Many studies have been investigated on this novel architecture but only little of them focused on Pending Interest Table (PIT) which is very important component in every CCN router. PIT has fundamental role in packet processing in both upstream process (Interest packets) and downstream process (Data packets). PIT must be fast enough in order to not become an obstruction in the packet processing and also it must be big enough to save a lot of incoming information. In this paper, we suggest a new PIT design and implementation named CF-PIT for CCN router. Our PIT design depends on modifying and utilizing an approximate data structure called Cuckoo filter (CF). Cuckoo filter has ideal characteristics like: high insertion/query/deletion performance, acceptable storage demands and false positive probability which make it with our modification convenient for PIT implementation. The experimental results showed that our CF-PIT design has high performance in different side of views which make it very suitable to be implemented on CCN routers.</p>

Named Data Networking (NDN) is a new network architecture derived from the success of the Internet. Specifically, NDN addresses and identifies data by naming. Source and destination host addresses are not required for data communication in the NDN because the data is uniquely named instead. In the NDN network, the Forwarding Information Base (FIB) table is responsible for data forwarding, the Pending Interest Table (PIT) is liable for holding the state of data forwarding process, and the Content Store (CS) is used to stock data chunks within the network to optimize the forwarding time to the data without contacting to the content producer. All these data structures consume the memory of devices existing in the Named Data Networking of Things (NDNoT). Accordingly, the size of the FIB, PIT and CS needs to be carefully adjusted in NDNoT environments for performance tuning and Quality of Service (QoS) provisioning. In this study, we explore the issues of FIB sizing on average and maximum occupancy, reliability and maximum delay for constant bit rate (CBR) traffic where each content producer is addressed with a prefix name in the Cooja simulator environment. The results indicate that FIB table size has an impact on the reliability and maximum delay. During the number of records in FIB outpaces the count of nodes in the network, the reliability decreases gradually. Therefore, in constrained NDNoT environment careful allocation of the memory among FIB, PIT and CS becomes an important issue. According to our knowledge so far, this work is the first study showing the effect of FIB table on the performance in an NDNoT environment.

Vehicular Content-Centric Networks (VCCN) has been proposed and emerged as an upcoming Internet technology for the Vehicular Ad-hoc Networks (VANETs). However, VCCN architecture faces many challenges including Consumer/Provider mobility, Flooding, Interest/Data packet forwarding, Forwarding selection and Congestion control. Consumer vehicle broadcasts (i.e., requests) the interest packet. Relay nodes vehicles receiving this interest packet and performs search (Content Storage, Pending Interest Table and Forward Interest Base) operations on it and then rebroadcasts the interest message in case of no content match. These search (Content Storage, Pending Interest Table, and Forward Interest Base) operations cause delay and duplication's of interest packets. In our paper, we propose a routing protocol scheme named Intersection Based Forwarder Selection (IBFS) to mitigate the interest broadcast storm and disconnected link within the network. In IBFS, each vehicle shares its trajectory information with its neighboring vehicles. All vehicles store/save trajectory information in its Neighbor Table (NT), which helps to select the best interest relay/forwarder vehicle on the basis of matching trajectory information with the consumer vehicle. We have also considered the other metrics i.e. velocity and hop count. IBFS protocol overcomes the end-to-end delay (low latency), ISD (Interest Satisfaction Delay), communication overheads and minimum number of interest forwarded with the reliable interest and data packet transmission.

Today’s Internet is no longer fit for the user traffic patterns that it is serving. To remedy this cognitive mismatch between the service platform and the traffic it serves, several future Internet architectures such as Content-Centric Networking (CCN) have been proposed recently with the aim of re-engineering the Internet towards supporting content-oriented communication. With the mechanisms to transform the Internet from being host-centric to becoming content-centric well spelt-out in the CCN standard, the problem of how to manage congestion and control traffic flows in CCN is still left open. Existing congestion control mechanisms for the current Internet have been shown to be ill-suited for CCN making the case for a clean-slate design of congestion control and traffic management mechanisms for CCN. In this thesis, we identify the fact that congestion in CCN can take place not only in the transmission buffer but also in the pending interest table (PIT), a data structure that keeps track of all requests received from downstream nodes and forwarded to upstream nodes. Keeping this in mind, we make three contributions in this thesis: First, we characterize the PIT occupancy distribution using a 2-dimensional continuous-time Markov chain model to study the impact of PIT entry timeout and interest retransmission on the interest blocking probability. Second, given the dependence of the PIT occupancy on the PIT entry timeout and interest retransmission, we investigate the performance of two types of routers in lossy networks: no-rtx routers that do not retransmit pending interests upon timeout, and rtx routers that do retransmit pending interests periodically. Based on this, we further introduce a novel adaptive method to estimate the PIT entry timer that relies on the data chunk response delays to replace the currently used fixed-value method introduced in CCN. Finally, identifying that content requesters should be responsible for retransmitting timeout requests and that estimates of the retransmission timeout should reflect the network load conditions, we propose a novel congestion control mechanism for CCN that takes into account both the PIT and the transmit buffer. Using the PIT occupancy as a good estimator for the data flight size to arrive to the node in the near future, we design a congestion avoidance mechanism that adjusts the request rate based on anticipated congestion.

The large expansion in network services and applications seen in the last few years requires new network architectures to satisfy an increasing number of users and enhance content delivery. Named Data Networking (NDN) has recently appeared as a new paradigm to solve many shortcomings in the current TCP/IP architecture. Its main characteristics like stateful forwarding and in-network caching made NDN networks an efficient environment for data delivery where the data is retrieved based on content names rather than IP addresses. The NDN, by its nature, defends against the well-known Distributed Denial of Service (DDoS) attacks that take place in the traditional TCP/IP architecture. However, a special kind of DoS attack called Collusive Interest Flooding Attack (CIFA) has appeared to overwhelm the resources of NDN routers by filling their Pending Interest Tables (PIT) with long-lasting malicious entries. The network throughput and consumer satisfaction rate are highly affected by CIFA. A lightweight yet efficient stateless CIFA detection algorithm is proposed in this research utilizing the non-parametric CUSUM algorithm; a change point detection approach that detects the point in time when a transition occurs in the network. The proposed algorithm is characterized by its low computational overhead, highly accurate detection, and quick response. To detect the malicious name prefixes and eliminate the CIFA effect, a mitigation algorithm that uses the average response time vales of all name prefixes is proposed in this research. Experimental results show that this approach detects CIFA after 199.5 ms from when an attack is launched in the large-scale topology. In addition, the mitigation approach effectively reduces the PIT utilization and increases the average consumer satisfaction rate.

Using Interests (requests that elicit content) and maintaining per-Interest forwarding state in Pending Interest Tables (PIT) are integral to the design of the Named Data Networking (NDN) and Content-Centric Networking (CCNx) architectures. However, using PITs makes the network vulnerable to Interest-flooding attacks, and PITs can become very large. It is shown that in-network caching eliminates the need for Interest aggregation and obviates the use of PITs. A new approach to content-centric networking (CCN-GRAM) is introduced that provides all the benefits of NDN and CCNx, eliminates the use of PITs by means of anonymous datagrams, and is immune to Interest-flooding attacks. Routers maintain routes to the anonymous origins of Interests using an on-demand routing approach in the data plane that can also be used to provide native support for multicasting in the dat a plane. Simulation experiments show that the number of forwarding entries required in CCN-GRAM is orders of magnitude smaller than the number of PIT entries.

Named data networking (NDN) supports receiver-driven content retrieval with stateful forwarding (pending interest table (PIT)/forwarding information base) and in-network caching, yet many deployments still rely on classical cryptography that may be undermined by quantum-capable adversaries. Despite NDN’s built-in data authenticity via producer signatures, quantum-enabled attacks become plausible once RSA/ECC-based trust anchors are weakened by Shor-type attacks. Existing quantum-security efforts for NDN largely focus on post-quantum replacements of signatures or key exchange, but do not address the tension between confidentiality-preserving payload protection and NDN’s in-network processing (forwarding/caching decisions) in a quantum setting. This paper presents a quantum-enhanced NDN architecture that preserves NDN’s content-centric semantics—naming, PIT-driven forwarding, and cache-assisted dissemination of verifiable control objects—while delivering privacy-sensitive payloads as quantum homomorphic encryption (QHE)-encrypted quantum states over an underlying quantum network. QHE provides end-to-end confidentiality and enables authorized operations on encrypted quantum payloads without exposing plaintext. To make the design compatible with NDN forwarding, the proposed protocol encrypts the payload while keeping name-based forwarding semantics intact, and supports ciphertext-domain processing for selected policy functions. To protect provenance and integrity of NDN metadata, routing instructions, and session state, we incorporate quantum digital signatures (QDS) bound to NDN names and session identifiers. The main contributions are: (i) a QHE+QDS layered protection model tailored to NDN’s Interest and Data exchange; (ii) a session workflow that couples proactive entanglement distribution with NDN-style stateful signaling for efficient establishment and recovery; and (iii) a security analysis clarifying the achieved guarantees and the remaining trust assumptions. Security analysis indicates robustness against quantum man-in-the-middle and tampering attacks, with modest overhead on NDN control traffic.

Bloom filters are probabilistic data structures that are popular in networking for set representation; however, they show an inherent inaccuracy due to false positives. One of the potential attacks on Bloom filters is to pollute them with elements that cause the filter to have a larger false positive probability than under normal operation; Pollution is simple when an attacker knows the details of the filter implementation. Recent research has shown that also black-box adversaries can pollute a counting Bloom filter (a common variant of the filter that also supports removals) with no knowledge of its implementation. As over time, many variants and improvements of Bloom filters have been proposed, it is of interest to study whether they can also be polluted and if so also the increase in their false positive probability. This paper first proposes and then evaluates pollution attacks for some of the most common variants including the Block Bloom filters (BBFs), the Variable Increment and Fingerprint Counting Bloom filters (VI-CBFs and FP-CBFs). The results show that with or without knowledge of the implementation, these variants of the Bloom filter are significantly more vulnerable to pollution attacks than the traditional Bloom filter. In particular, BBFs are extremely vulnerable, so providing an insight on their impact and use in practical systems when the number of memory accesses per lookup must be reduced.

Radient: Scalable, memory efficient name lookup algorithm for named data networking

One of the most common threats to internet security is the Denial of Service attack. There are numerous methods and protocol changes in an effort to detect them. The most common DoS attack detection method relies on the number of the TCP control packet in the network flow. The Bloom filter represents a space efficient data structure that is commonly utilized to detect matching pairs. There are multiple algorithms for the DoS attack detection based on the Bloom filter. The SACK <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> algorithm uses the SYN/ACK - ACK matching pair detection with the Bloom filter data structure. The false positive error introduced by the Bloom filter influences on the matching pair detection in the algorithm. The improved SACK <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> algorithm significantly reduces the false positive error by replacing the Counting Bloom Filter (CBF) data structure with the Dual Counting Bloom Filter (DCBF) data structure. This improvement significantly improves the matching pair detection. It is expected that the false positive error should influence on the detection of the DoS attack. In this paper, the experimental study is performed to analyse this influence. This study confirms the correlation between the false positive error and the DoS attack detection.

Named Data Networking (NDN) is a newly proposed next-generation Internet architecture that uses the name of data to forward and route packets. As a potential candidate for future Internet architecture, it is crucial to address the security and privacy issues in NDN. NDN is vulnerable to a new type of Distributed Denial of Service (DDoS) attacks called Interest Flooding Attacks (IFAs). The attackers can send a massive amount of Interest requests to overwhelm the Pending Interest Table (PIT) at routers resulting in network disruption for legitimate users. In this paper, we propose a Binary Tree-Based Interest Flooding Attack Detection and Mitigation Scheme (BTIFADMS) to protect NDNs. The proposed scheme allows each NDN router to use binary trees to detect IFAs and mitigates IFAs by limiting the number of Interest requests forwarded from the contaminated routers. The simulation evaluation shows that BTIFADMS can quickly and accurately identify and respond to the IFAs in the NDNs.

The Counting Bloom Filter (CBF) is a kind of space-efficient data structure that extends a Bloom filter so as to allow approximate multiplicity queries on a dynamic multi-set. This paper evaluates the performance of multiplicity queries of three simple CBF schemes-the Naive Counting Bloom Filter (NCBF), the Space-Code Bloom Filter (SCBF) and the d-left Counting Bloom Filter (dlCBF)—using metrics of space complexity and counting error under both uniform and zipfian multiplicity distributions. We compare their counting error under same space complexity, and their space complexity when similar counting errors are achieved respectively. Our results show that dlCBF is the best while SCBF is the worst in terms of both space-efficiency and accuracy. Furthermore, the performance gap between dlCBF and the others has a trend of being enlarged with the increment of space occupation or counting accuracy.

Named Data Networking (NDN) is one of the most promising future Internet architectures, which supports communications based on content names but not the content locations. Clients can retrieve content only by sending an Interest packet, which includes the content name. However, independent Interest packets will cause heavy loads on the routers, particularly in the Internet of Things (IoT) scenarios which will induce huge number of small-sized content exchanges. The proposed scheme enables clients to retrieve many different contents by sending an aggregated Interest packet. In addition, the Data packet can also be aggregated by the intermediate routers to improve the efficiency of NDN communications.

Bloom filters are widely used in many network applications but the high computation cost limits the system performance. In this paper, we introduce a new variation of Bloom filter named One-Hashing Bloom Filter (OHBF) to solve the problem. OHBF requires only one base hash function plus a few simple operations to implement a Bloom filter. While keeping nearly the same theoretical false positive ratio as an ideal Bloom filter, OHBF significantly reduces the hash computation overhead. We show that the false positive performance of a standard Bloom filter implementation strongly relies on the selection of hash functions, even if these hash functions are considered good. In contrast, OHBF presents consistently better performance with a proven mathematical foundation. OHBF is ideal for high throughput and low latency applications. As OHBF is a fundamental technique in Bloom filter theory, it can be applied to many other Bloom filter variations, such as Counting Bloom Filter and Space-Code Bloom Filter.