Method for data identification naming in information centric network

Abstract

The application discloses a data identification naming method in an information center network, and is based on an analysis system implementation, and the method comprises the following steps: generating a data identification basic structure according to data provided by a data provider; adopting an identification mapping algorithm to map the data identification basic structure into a unique data identification, the data identification is used to provide a routing address and security authentication for the information center network; registering a mapping relationship between the data identification and a storage data entity network address in the analysis system, and simultaneously registering the data identification basic structure. The method of the application enables the data identification to have the routing address function in the ICN network, and meanwhile, the data identification has security functions such as data integrity and provider identity authentication, and provides a basic support for mixed routing of various network systems and connection with other system applications.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network technology and communication technology, and in particular to a data identification naming method in an information-centric network. BACKGROUND

[0002] With the development of new technologies and applications such as Internet of Things, mobile access, distributed information processing, and massive streaming media, the performance of current computer networks based on TCP / IP architecture has gradually tended to be limited, and the contradiction between the massive demand for information content services and the bottleneck of network bandwidth has become increasingly intensified. The network bottleneck problem caused by the IP network structure has become an important factor hindering the development of the current network application layer. The existing Internet TCP / IP architecture has many problems in terms of scalability, mobility, multi-host, and traffic engineering. The IP address used by the Internet now has dual implications of location information and identity information, which confuses the functional boundaries of location and identifier, and there is a problem of IP address semantic overload. This naming mechanism is also the crux of restricting the development of network technology.

[0003] In view of the above problems, the academic and standard organizations have strengthened the research on the future new Internet architecture. At the beginning of this century, guided by the main needs of the Internet, the information-centric network technology (Information-Centric Networking, ICN) was proposed, which decouples the relationship between information and location, increases the network storage information capability, and improves the content acquisition, mobility support, and content-oriented security mechanism capability from the network layer. Typical projects of ICN series include NDN, DONA, NetInf, PURSUIT, etc.

[0004] The naming methods in the current ICN system are mainly divided into hierarchical naming and flat naming methods, in addition to attribute-based naming and other hybrid naming methods. CCN and TRIAD use hierarchical naming methods, which have the advantages of aggregation and human readability, and match the existing URL naming method. DONA, PSIRP, and NetInf use flat naming methods, which use hash string identifiers without semantics, and the identifier contains labels and hash as the public key of the content publisher, so that there is a natural security binding relationship between the content and the publisher, which has good stability and uniqueness; and because the identifier length is fixed, the routing lookup efficiency is higher, but it is not convenient to remember and understand. SUMMARY

[0005] The purpose of the present application is to overcome the technical defects of the existing ICN naming method, and a data identification naming method in an information-centric network is proposed, which is a data identification naming method with routing efficiency, security guarantee, and readability.

[0006] In order to achieve the above object, the present application provides a data identification naming method in an information center network, based on an analysis system implementation, comprising:

[0007] generating a data identification basic structure according to data provided by a data provider;

[0008] mapping the data identification basic structure into a unique data identification by using an identification mapping algorithm, the data identification being used to provide routing and addressing and security authentication to the information center network;

[0009] registering a mapping relationship between the data identification and a storage data entity network address to the analysis system, and simultaneously registering the data identification basic structure.

[0010] As an improvement of the above method, the step of generating the data identification basic structure according to the data provided by the data provider specifically comprises:

[0011] generating the data identification basic structure according to data content, a data provider and URI information of the data, the data identification basic structure comprising a type field, a name field, a security fingerprint field, a provider field and a spare field; wherein,

[0012] the type field is used to indicate the type of the data identification, including data, device, service and user, and the field is of fixed length;

[0013] the name field is used to indicate the name of the data, and the name naming mode comprises a self-defined mode, a URI mode, an inherited application layer naming mode and a naming mode compatible with other network or system identification, and the field length is indefinite;

[0014] the security fingerprint field is used to verify the integrity of the data, and is generated by hashing or encoding calculation of the data, and the field is of fixed length;

[0015] the provider field is used to indicate the original provider of the data, and the naming mode of the provider field comprises an identification of the data provider and a public key held by the data provider; the field is an optional field and is of fixed length;

[0016] the spare field is used to extend other attributes of the data identification, including the type of the data, and the field is an optional field and is of indefinite length.

[0017] As an improvement of the above method, the identification mapping algorithm comprises using all or part of the fields of the data identification basic structure to perform hashing algorithm and encoding algorithm processing.

[0018] As an improvement of the above method, the data identification is of fixed length.

[0019] As an improvement of the above method, the resolving system is used for maintaining the mapping relationship between the data identifier and the network address of the data storage entity, and is used for completing the routing and addressing based on the data identifier in cooperation with the information center network; and is further used for maintaining the basic structure of the data identifier in the form of the attribute field of the data identifier, and supporting the carrying of the basic structure of the data identifier while the address is parsed by the data identifier, so as to perform the security authentication.

[0020] As an improvement of the above method, the routing and addressing specifically includes:

[0021] When the routing and addressing is performed in the network, the network address and the basic structure of the data identifier of the storage entity corresponding to the data identifier are obtained based on the data identifier and the resolving system, and the routing and forwarding are performed based on the network address;

[0022] When the mixed routing is performed with other network systems, the identifier of the data in the other network system is obtained based on the name field in the basic structure of the data identifier, and then the routing and addressing are performed in the other network.

[0023] As an improvement of the above method, the security authentication specifically includes:

[0024] The network address and the basic structure of the data identifier of the storage entity corresponding to the data identifier are obtained based on the data identifier and the resolving system, the integrity of the data is verified based on the security fingerprint field in the basic structure of the data identifier, and the data provider is authenticated based on the provider field in the basic structure of the data identifier

[0025] Compared with the prior art, the application has the advantages that:

[0026] The method of the application introduces the original name of the data, the security fingerprint, the provider and the like in the basic structure of the identifier, generates the data identifier with a fixed length based on the basic structure of the identifier, and maintains the mapping relationship between the identifier and the basic structure by means of the resolving system, so that the data identifier has the routing and addressing function in the ICN network, and has the security functions of the data integrity and the provider identity authentication, and since the identifier basic structure retains the identifier or name of the data in other networks, systems or applications, the mixed routing of various network systems and the connection with other systems and applications are provided with a basic support. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 is an example scenario diagram of embodiment 1 of the application;

[0028] Figure 2 is a schematic diagram of the data identifier basic structure of the application;

[0029] Fig. 3 is a schematic diagram of the generation of the data identifier and the basic structure of the application, wherein Fig. 3(a) is Figure 1The basic structure of ID1 data identifier is shown in Figure 3(b). Figure 1 The basic structure of ID2 data identifiers;

[0030] Figure 4 is a schematic diagram of the data identifier-based routing addressing of the present invention, wherein Figure 4(a) is Figure 1 The process of user A obtaining data demo1 based on data identifier ID1 is shown in Figure 4(b). Figure 1 The process by which user A obtains data demo2.mpg based on data identifier ID2;

[0031] Figure 5 This is a schematic diagram of the data identifier-based integrity authentication of the present invention;

[0032] Figure 6 This is a schematic diagram of user permission authentication based on data identification according to the present invention. Detailed Implementation

[0033] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0034] Example 1

[0035] like Figure 1 As shown, Embodiment 1 of the present invention provides a data identification and naming method in an information center network.

[0036] An identifier is a globally unique identifier that represents a network entity, independent of its network address, including but not limited to data identifiers. A network address is the routable address information of the network entity's location, including but not limited to IP addresses. In the described embodiment, the ICN network instance on the left is a network architecture based on the separation of identifier and address. After the resolution system completes the mapping between identifier and address, routing is performed based on the address. The generation of its data identifier uses the method described in this invention. The NDN network is an ICN network that directly uses identifiers for routing and addressing. In the embodiment, the ICN network instance and the NDN network are mixed-routed, with protocol conversion performed through gateway E. The example scenario described in the embodiment is as follows: Figure 1 As shown. Specifically: Data provider D provides the image data demo2.mpg, identified as NDN / videos / demo2.mpg in the NDN network and ID2 in the ICN network instance. Data provider C provides the Baidu application data demo1, named baidu.com / data / demo1 within the application and identified as ID1 in the ICN network instance.

[0037] The method for calculating the data security fingerprint in the embodiment generates a 160-bit hash value using the SHA-1 algorithm, and the identity of the provider is represented using the public key of the provider. In combination with the described embodiment, detailed processes for identity generation, identity issuance, identity-based routing addressing, and identity-based security authentication are described. As shown in Figure 2 The basic structure of the data identity is shown in the figure. According to the data content, the data provider, and the URI information of the data, the basic structure of the data identity is generated, which includes: type, name, security fingerprint, provider, and spare field; wherein,

[0038] The type field is used to indicate the type of the identity, and is of fixed length, including but not limited to: data, device, service, and user, etc.

[0039] The name field is used to indicate the name of the data, and is of indefinite length. The naming method includes but is not limited to: self-defined method, URI method, inherited application layer naming method, and naming method compatible with other network or system identity, etc.

[0040] The security fingerprint field is used to verify the integrity of the data, and is of fixed length. It is generated by hashing and encoding calculation of the data. The hash algorithm used includes but is not limited to: SHA-1, SHA256, or SM3, etc. The preferred algorithm is SHA-1, SHA256, or SM3.

[0041] The provider field is used to indicate the original provider of the data, and is of fixed length, and is an optional field. The naming method of the provider field includes but is not limited to: the identity of the data provider and the public key held by the data provider, etc.

[0042] The spare field is used to extend other attributes of the data identity, and is an optional field, and is of indefinite length, including but not limited to: the type of the data, etc.

[0043] (1) Identity generation process

[0044] The type, name, security fingerprint, and provider public key related field information of the data demo1 provided by the data provider C are as follows.

[0045] Type: 0X01

[0046] Name: baidu.com / data / demo1

[0047] Security fingerprint: SHA-1(demo1)

[0048] Provider public key: PK x : PK y

[0049] Based on the above raw information, data identifier ID1 and identifier basic structure Struc1 are generated, as shown in FIG. 3(a). ID1 is the unique identifier of the data in the ICN network instance, and is used in the following routing and security authentication together with the resolution system and Struc1.

[0050] The type, name, and security fingerprint related field information of the data demo.jpg provided by the data provider D are shown as follows.

[0051] Type: 0X01

[0052] Name: NDN / videos / demo2.mpg

[0053] Security fingerprint: SHA-1 (demo2.mpg)

[0054] Based on the above raw information, data identifier ID2 and identifier basic structure Struc2 are generated, as shown in FIG. 3(b). ID2 is the unique identifier of the data in the ICN network instance, and is used in the following hybrid routing together with the resolution system and Struc2.

[0055] (2) Identifier publishing process

[0056] The data provider C needs to register and publish the mapping relationship between the data identifier ID1 and the network address IP3 to the resolution system, and carries the identifier basic structure Struc1 information of ID1 in the form of attributes (tags). The registration structure of ID1 in the resolution system is shown in Table 1. The fields of the identifier basic structure Struc1 are saved in the resolution system using tags 1-5, and the related information can be carried during identifier resolution. When the network node caches data, it needs to register the mapping relationship between the data identifier ID1 and the cache node network address IP2 to the resolution system.

[0057] Table 1 Registration structure of ID1 in the resolution system

[0058]

[0059] The data provider D needs to register and publish the mapping relationship between the data identifier ID2 and the gateway network address IP4 to the resolution system through the gateway B, so that the provided data is visible in the ICN network instance. The identifier basic structure Struc2 information of ID2 is carried in the form of attributes (tags). The registration structure of ID2 in the resolution system is shown in Table 2. The fields of the identifier basic structure Struc2 are saved in the resolution system using tags 1-5, and the related information can be carried during identifier resolution.

[0060] Table 2 Registration structure of ID2 in the resolution system

[0061]

[0062] (3) Routing based on data identifier

[0063] The process of user A obtaining data demo1 based on data identifier ID1 is shown in Fig. 4(a), and the specific steps are as follows:

[0064] Step 1) User A initiates a resolution request to the resolution system based on ID1;

[0065] Step 2) The resolution system returns the network address IP3 corresponding to ID1, and the identifier basic structure information Struc1;

[0066] Step 3) User A performs routing based on IP3 to obtain image data demo1.

[0067] (4) Heterogeneous network mixed routing based on data identifier

[0068] The process of user A obtaining data demo2.mpg based on data identifier ID2 is shown in Fig. 4(b), and the specific steps are as follows:

[0069] Step 1) User A initiates a resolution request to the resolution system based on ID2;

[0070] Step 2) The resolution system returns the network address IP4 corresponding to ID2, and the identifier basic structure information Struc2;

[0071] Step 3) User A performs routing based on IP4 to reach gateway E;

[0072] Step 4) At gateway E, the name field NDN / videos / demo2.mpg in Struc2 is extracted, and routing is performed in the NDN network based on this field to obtain image data demo2.mpg.

[0073] (5) Security authentication based on data identifier

[0074] The process of user A requesting to obtain data demo1 based on data identifier ID1 includes security authentication, which is divided into integrity verification and data provider verification. The process of user A verifying the integrity of data is shown in Fig. 5(a), and the specific steps are as follows: Figure 5

[0075] Step 1) User A obtains the corresponding address IP2 and Struc2 from the resolution system based on ID1;

[0076] Step 2) User A performs routing based on IP2 to obtain data demo1'; ​

[0077] Step 3) User A calculates Hash' = SHA-1 (demo1');

[0078] Step 4) Compare Hash' with Struc2 security fingerprint field SHA-1 (demo1'), if Hash' = SHA-1 (demo1), then the integrity verification is passed; otherwise, the verification fails.

[0079] Network device B is the entity storing data demo1, and data provider C is the provider of the original data. When user A requests to obtain data demo1 based on data identifier ID1, network device B needs to verify whether user A has the right to obtain the corresponding data. In this embodiment, it is specified that the data requester is the data provider or the authorized user of the provider, and the requester has the right to obtain the corresponding data. Based on the above scenario, the user's right needs to be verified based on the data provider, such as Figure 6 As shown in the figure, the specific steps are as follows:

[0080] Step 1) User A requests data corresponding to ID1 to network entity B;

[0081] Step 2) Network entity B initiates a resolution request to the resolution system based on ID1 to obtain the basic structure information Struc1 of identifier ID1, and extracts the provider field PK x :PK y ;

[0082] Step 3) Network entity B verifies whether the authentication certificate provided by user A is the certificate signed by provider C through the public key of data provider C. If the verification is passed, user A is an authorized user, and the data is provided to user A. If the verification is not passed, user A is a non-authorized user, and the related data is not provided. Finally, it should be pointed out that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application is described in detail with reference to the embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A data identification naming method in an information-centric network, based on a resolution system, the method comprising: generating a data identification basic structure according to data provided by a data provider; mapping the data identification basic structure into a unique data identification using an identification mapping algorithm, the data identification being used to provide routing and address and security authentication to the information-centric network; registering a mapping relationship between the data identification and a network address of an entity storing the data, and simultaneously registering the data identification basic structure, with the resolution system; generating the data identification basic structure according to data provided by a data provider; specifically comprising: generating the data identification basic structure according to data content, a data provider and URI information of the data, the data identification basic structure comprising: a type field, a name field, a security fingerprint field, a provider field and a backup field; wherein, the type field is used to indicate the type of the data identification, including data, device, service and user, and the field is of fixed length; the name field is used to indicate the name of the data, and the name naming mode includes: a custom mode, a URI mode, an application layer naming mode inherited and a naming mode compatible with other network or system identification, and the field length is indefinite; the security fingerprint field is used to verify the integrity of the data, and is generated by hashing or encoding calculation of the data, and the field is of fixed length; the provider field is used to indicate the original provider of the data, and the naming mode of the provider field includes: an identification of the data provider and a public key held by the data provider; the field is an optional field and is of fixed length; the backup field is used to extend other attributes of the data identification, including the type of the data, and the field is an optional field and is of indefinite length; the resolution system is used to maintain a mapping relationship between the data identification and a network address of a data storage entity, and to complete routing and address based on the data identification in cooperation with the information-centric network; and is also used to maintain the data identification basic structure in the form of an attribute field of the data identification, to support carrying the data identification basic structure while resolving the address based on the data identification, for security authentication; the security authentication specifically comprises: querying the resolution system based on the data identification to obtain a network address of a storage entity corresponding to the data identification and the data identification basic structure, verifying the integrity of the data based on the security fingerprint field in the data identification basic structure, and authenticating the data provider based on the provider field in the data identification basic structure. 2.The method of claim 1, wherein, the identification mapping algorithm comprises: using all or part of the fields of the data identification basic structure to perform hashing algorithm and encoding algorithm processing. 3.The method of claim 1, wherein, the data identification is of fixed length. 4.The method of claim 1, wherein, the routing and address specifically comprises: in network internal routing and address, querying the resolution system based on the data identification to obtain a network address of a storage entity corresponding to the data identification and the data identification basic structure, and performing routing and forwarding based on the network address; in mixed routing with other network systems, obtaining the identification of the data in other network systems based on the name field in the data identification basic structure, and then performing routing and address in the other network.

Images