In contrast to today's IP-based host-oriented Internet architecture, Information-Centric Networking (ICN) emphasizes content by making it directly addressable and routable. Named Data Networking (NDN) architecture is an instance of ICN that is being developed as a candidate next-generation Internet architecture. By opportunistically caching content within the network, NDN appears to be well-suited for large-scale content distribution and for meeting the needs of increasingly mobile and bandwidth-hungry applications that dominate today's Internet. One key feature of NDN is the requirement for each content object to be digitally signed by its producer. Thus, NDN should be, in principle, immune to distributing fake (aka "poisoned") content. However, in practice, this poses two challenges for detecting fake content in NDN routers: (1) overhead due to signature verification and certificate chain traversal, and (2) lack of trust context, i.e., determining which public keys are trusted to verify which content. Because of these issues, NDN does not force routers to verify content signatures, which makes the architecture susceptible to content poisoning attacks. This paper explores root causes of, and some cures for, content poisoning attacks in NDN. In the process, it becomes apparent that meaningful mitigation of content poisoning is contingent upon a network-layer trust management architecture, elements of which we construct, while carefully justifying specific design choices. This work represents the initial effort towards comprehensive trust management for NDN.
Some prior research efforts discussed naming in content-oriented networks and its relationship to security. Notably, @cite_31 proposes establishing bindings between three ICN entities : (1) real-world identity coupled with the the producer of each content object, (2) name, and (3) public key used to verify the object signature. Only two of the three possible bindings (real-world identity--name, name--key and real-world identify--key) are required, while the third can be transitively inherited. However, it is unclear how these bindings can be practically applied in the specific NDN settings.
@cite_31
2514042371 2170075839 2514172418 2590898937
As a novel network architecture, Information-Centric Networking(ICN) has a good performance in security, mobility and scalability. Although in-network cache used in ICN can effectively solve the problem of network congestion. Meanwhile, it also brings a lot of challenges such as copyright protection. How to prevent unauthorized user access to the large-sized contents of the route has become the focus of the research. Some of the current solutions are based on the traditional encryption technology. But these solutions don't applay to ICN. Current approaches that rely on a common encryption key among authorized users cannot protect copyright well since if authorized user leaks the private key out, we cannot tell who has leaked the key out. In this paper, we use a novel scheme to solve the problem of copyright protection. In this scheme, we take the method of the network encoding. The first, we have splitted the large-sized content into N blocks. Then through linear network coding(LNC) encrypted the content, if the user can not obtain the decrypted matrix, the user will not be able to decrypt the content. Therefore, the scheme can achieve the protection of the content. Our analysis of this program shows that the scheme has a good performance in copyright protection. Identification is central to information or content centric networking, in order to enable referencing and access to the information objects. In this work we focus on identifiers and the identification system as a target of a design process, because without careful attention to the identifiers themselves and the approaches to selecting, assigning and using them, they may not meet their design goals. The paper begins with an examination of key issues central to the design of an identification system. With those in mind, we discuss the objectives of pervasiveness and persistence as requirements for identification in an information centric networking (ICN) approach. These lead to a set of design four goals: longevity, scalability, evolvability and security. We apply two key design principles, layering and modularity, to derive our design for the Pervasive Persistent Identification System or PPInS for information centric networking. The contributions of this work include (1) the design issues for identification systems, (2) analysis of goals and key design criteria for identification in an ICN approach, and (3) a principled design of PPInS. User, content, and device names as a security primitive have been an attractive approach especially in the context of Information-Centric Networking (ICN) architectures. We leverage Hierarchical Identity Based Encryption (HIBE) to build (content) name-based security mechanisms used for securely distributing content. In contrast to similar approaches, in our system each user maintains his own Private Key Generator used for generating the master secret key and the public system parameters required by the HIBE algorithm. This way our system does not suffer from the key escrow problem, which is inherent in many similar solutions. In order to disseminate the system parameters of a content owner in a fully distributed way, we use blockchains, a distributed, community managed, global list of transactions. The fast-growing Internet traffic is increasingly becoming content-based and driven by mobile users, with users more interested in data rather than its source. This has precipitated the need for an information-centric Internet architecture. Research in information-centric networks (ICNs) have resulted in novel architectures, e.g., CCN NDN, DONA, and PSIRP PURSUIT; all agree on named data based addressing and pervasive caching as integral design components. With network-wide content caching, enforcement of content access control policies become non-trivial. Each caching node in the network needs to enforce access control policies with the help of the content provider. This becomes inefficient and prone to unbounded latencies especially during provider outages. In this paper, we propose an efficient access control framework for ICN, which allows legitimate users to access and use the cached content directly, and does not require verification authentication by an online provider authentication server or the content serving router. This framework would help reduce the impact of system down-time from server outages and reduce delivery latency by leveraging caching while guaranteeing access only to legitimate users. Experimental simulation results demonstrate the suitability of this scheme for all users, but particularly for mobile users, especially in terms of the security and latency overheads.