A method for verifying security of a data packet in an information-centric network

Abstract

The application provides a data packet security verification method in an information center network, comprising the following steps: 1) a legal content publisher registers a password parameter to a trusted third party, and signs a data packet; 2) an access router directly connected to the content publisher periodically updates the reputation of the content publisher according to a verification result of the data packet; 3) the access router performs batch verification on the data packet and probabilistically discards the data packet; and 4) an intermediate router verifies each data packet that needs to be verified one by one according to a verification probability set by the access router for each data packet, and discards the data packet verified as false. The application is used for preventing content pollution attacks in the information center network, can verify the authenticity and integrity of the content with low cost, and avoids false content from entering the network.

Description

Technical Field

[0001] This invention relates to the field of communications, and in particular to a method for verifying the security of data packets in an information center network. Background Technology

[0002] With the explosive growth of content on the internet and the increase in mobile users, the primary need of the internet today has become content distribution. Traditional internet architectures cannot efficiently meet this demand, giving rise to information-centric networks. These networks use content-centric routing and forwarding, and equip routers with caching to accelerate transmission efficiency, making large-scale, efficient content distribution possible.

[0003] A highly damaging attack exists in information-centric networks called content poisoning attacks. This involves malicious content publishers releasing false content, which spreads throughout the network as routers cache it, severely reducing cache utilization and user experience. Traditional packet verification schemes require individual verification of each packet, resulting in high computational overhead, heavy network load, and impact on data forwarding performance, ultimately affecting network transmission efficiency in real-world scenarios. Summary of the Invention

[0004] To address the above issues, we propose a data packet security verification method for information center networks.

[0005] The technical solution adopted in this invention includes the following steps:

[0006] 1) The legitimate content publisher generates a public key pk by hashing its identity ID; a trusted third party generates password parameters, reviews and accepts the content publisher's public key pk, and generates the corresponding private key sk; the content publisher uses the private key sk to sign each data packet to be published, and attaches the signature to the data packet for verification by the routers it passes through.

[0007] 2) A trusted third party selects multiplicative cyclic groups G and G' with the same prime order q. T Where G is a generator of g, construct the sequence from G×G to G T The bilinear mapping e, the chosen hash algorithm H, from the integer group A random number is selected as the master private key msk, thereby generating the master public key mpk=g. msk Verify the identity of the content publisher. If the identity is verified, accept the submitted public key pk and further generate the corresponding private key sk=pk. msk The sk key is transmitted to the content publisher via a secure channel, and all cryptographic parameters except the master private key msk and the private key sk key are made public.

[0008] 3) For the data D in the data packet to be published, the content publisher randomly selects h from the multiplicative cyclic group G, and from the integer group... Randomly select s and calculate S1 = e(h,g). s a = H(D||S1) and S2 = sk a *h s This yields the final signature (S1, S2), which is then attached to the data packet for verification by the routers along the route.

[0009] 4) After receiving a data packet, the access router directly connected to the content publisher will determine the number of intermediate routers (n) that the interest packet corresponding to that data packet passed through during transmission, based on the previously recorded number of intermediate routers. ir The probability that the intermediate router needs to verify the data packet is calculated. This value is then filled into the verification probability field in the data packet, where γ∈[0,1] represents the maximum tolerable error probability during the intermediate router verification process.

[0010] 5) For access routers directly connected to content publishers, batch verification is performed on every N consecutive data packets. Within the initial time Δt of establishing a connection with the content publisher and forwarding data, the results of each batch verification are counted, yielding the number of batches t that are verified as true and the number of batches f that are verified as false. The prior distribution of the probability of a data packet being true is treated as a beta distribution, and Bayesian estimation is used to obtain the probability estimate of subsequent data packets being true, i.e., the credibility score:

[0011]

[0012] After time Δt, after every M batch verifications, the access router updates the values ​​of t and f based on the verification results of the preceding K (K>M) batches, and correspondingly updates the value of reputation rep.

[0013] 6) During the initial time Δt of establishing a connection with the content publisher and executing data forwarding, the access router verifies data packets with probability 1, meaning that all data packets from the content publisher must undergo verification. After time Δt, the verification probability p is calculated based on the content publisher's reputation score rep. v That is, p v Probabilistically verify all data packets from this content publisher:

[0014]

[0015] Where α∈(0,1) represents the minimum verification probability for content publishers with a reputation value exceeding a certain threshold. α can be set to 0.1 to reduce the verification overhead for content publishers with a reputation value exceeding the threshold. β∈(0,1) represents the pre-set reputation value threshold for classifying a content publisher as untrustworthy. η∈[0,1] represents the maximum tolerable error probability during the access router's verification process. η can be set to 0.01 to ensure system security. When the reputation value rep < β, the content publisher is considered untrustworthy, and all data packets from that publisher can be discarded without verification. When the reputation value rep ≥ β, p... v Probabilistic verification is performed on data packets from the content publisher; unverified data packets are directly processed through other procedures.

[0016] 7) For access routers directly connected to content publishers, the specific method for batch verification of N data packets is as follows: for each data packet containing data D... j Signature (S) j,1 ,S j,2 ), public key pk j And other cryptographic parameters {g,mpk,H}, calculate a j =H(D) j ||S j,1 ), and from the integer group Randomly select δ j Final judgment and Are they equal? ​​If they are equal, the verification result of this batch is true, indicating that these data packets are all genuine and originate from the specified content publisher; otherwise, the verification result of this batch is false, indicating that at least one of these data packets is fake.

[0017] 8) The access router directly connected to the content publisher makes the following decision based on the batch verification results and the publisher's reputation: If the verification result is true, all data packets in the batch are marked and allowed to pass; if the verification result is false, the drop probability p is calculated based on the reputation score rep. d :

[0018]

[0019] That is, for each data packet in the batch, use p d The packet is selectively discarded with a probability of success; otherwise, the packet proceeds to the normal subsequent processing.

[0020] 9) Intermediate routers through which data packets pass: tagged data packets are allowed to pass directly; for untagged data packets, the verification probability field p is extracted from the data packet, and the data packet is verified with probability p; otherwise, the data packet verification process is not executed, and each data packet that needs to be verified is verified one by one.

[0021] 10) The intermediate router verifies each data packet that needs to be verified. For the data D, signature (S1, S2), public key pk, and other cryptographic parameters {g, mpk, H} in the data packet, it calculates a = H(M||S1) and determines e(S2, g) and e(pk). a Is S1 equal to mpk? If they are equal, the verification result is true and the data packet is passed; otherwise, the verification result is false and the data packet is discarded.

[0022] Compared with the prior art, the present invention has the following advantages:

[0023] 1. By using a dynamic batch verification algorithm based on identity signature, the overhead of data packets being verified in the network is greatly reduced, the burden on routers is lessened, bandwidth waste is avoided, user experience is improved, and content poisoning attacks can be effectively resisted.

[0024] 2. For content publishers that inject different proportions of fake content, their credibility is assessed and the verification probability is adaptively adjusted, reducing the number of verifications without sacrificing security; at the same time, data packets published by content publishers with excessively malicious content are directly discarded, thus resisting potential denial-of-service attacks. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the information center network;

[0026] Figure 2 This is a flowchart of the present invention. Detailed Implementation

[0027] The present invention will now be further described with reference to the accompanying drawings and examples.

[0028] This invention relates to a data packet security verification method in an information-centric network, such as... Figure 1 As shown, the router directly connected to the content publisher is called the access router, and the other routers are called intermediate routers. In this network, a user sends an interest packet, indicating a request for certain content. When the interest packet reaches the content publisher, the publisher will publish the corresponding data packet. The data packet will be transmitted along the reverse path of the interest packet, passing through one access router and several intermediate routers, and finally reaching the user. Figure 2As shown, the data packet is first signed by the content publisher and then published. It then passes through the probabilistic pass module, the batch verification module, and the decision module in sequence on the access router. At the same time, the reputation estimation module on the access router collects the results of the batch verification module to generate the reputation of the content publisher. This reputation affects the operation of the other three modules. The data packet then enters several intermediate routers, where the same probabilistic verification process is performed. Finally, the real content reaches the user, while the fake content is discarded.

[0029] The following details the various operational processes in the invention, including the data packet signing process, the reputation estimation process on the access router, the probabilistic pass process, the batch verification process, the decision-making process, and the probabilistic verification process on the intermediate router.

[0030] Data packet signing process:

[0031] Legitimate content publishers generate a public key pk by hashing their own identity ID using an algorithm, and then send the public key pk to a trusted third party, waiting for the third party to generate the corresponding private key sk.

[0032] The trusted third party initializes the cryptographic parameters, and the specific process is as follows: Select multiplicative cyclic groups G and G' with the same prime order q. T Where G is a generator of g, construct the sequence from G×G to G T The bilinear mapping e, the chosen hash algorithm H, from the integer group Randomly select the master private key msk, and thus generate the master public key mpk=g. msk A trusted third party verifies the content publisher's identity. If the identity is verified, the third party accepts the content publisher's public key pk and generates a private key sk=pk. msk The private key sk is transmitted to the content publisher via a secure channel, along with the password parameters {G,G}. T ,q,e,g,H} is public.

[0033] Content publishers use their private key sk to sign each data packet to be published, specifically as follows: h is randomly selected from the multiplicative cyclic group G, and h is selected from the integer group G... Randomly select s and calculate S1 = e(h,g). s a = H(D||S1) and S2 = sk a *h s This yields the final signature (S1, S2), which is then attached to the data packet for verification by the routers along the route, where D represents the data packet data.

[0034] The reputation estimation process on the access router:

[0035] The access router groups N consecutive data packets into batches and performs batch verification. Within the initial time Δt of establishing a connection with the content publisher and forwarding data, it counts the results of each batch verification, obtaining the number of batches t that are verified as true and the number of batches f that are verified as false. Assuming each data packet is true with an independent probability x, then every N data packets are true with a probability y = x. N The independent probability of y is true. We consider the prior distribution of y as beta(a,b). Since the initial credibility of the content publisher is unknown, we take a=1 and b=1. Using Bayesian estimation, we obtain the probability that each data packet is true, i.e., the credibility rep:

[0036]

[0037] After time Δt, after every M batch verifications, the access router updates the values ​​of t and f based on the verification results of the preceding K (K>M) batches, and correspondingly updates the reputation value rep. In a specific implementation, N=10, M=10, and K=20 can be chosen.

[0038] The probabilistic access process on the router:

[0039] During the initial time Δt of establishing a connection with the content publisher and performing data forwarding, since the initial reputation of the content publisher is unknown, the access router chooses to verify data packets with probability 1, meaning that all data packets from that content publisher must undergo verification. After time Δt, the access router calculates the verification probability based on the reputation value rep, i.e., with probability p... v Probabilistically validate all data packets from the specified content publisher:

[0040]

[0041] Where α∈(0,1) represents the minimum verification probability for content publishers with a reputation value exceeding a certain threshold. α is usually less than 0.5 to reduce the verification overhead for content publishers with a reputation value exceeding the threshold. β∈(0,1) represents the pre-set reputation value threshold for classifying a content publisher as untrustworthy. η∈[0,1] represents the maximum tolerable error probability during the access router's verification process. η is usually close to 0 to ensure system security. When the reputation value rep < β, the content publisher is considered untrustworthy, and all data packets from that publisher are discarded without verification, thus protecting against denial-of-service attacks launched by highly malicious content publishers. When the reputation value rep ≥ β, p... vProbabilistic verification is performed on data packets from the content publisher, while unverified data packets undergo further processing. This approach allows for the verification of content from more reputable publishers with a lower probability, while ensuring that content from reputable publishers is still verified rather than all passed. Furthermore, it limits the number of false data packets that pass without verification to only η times the total number of data packets, thus guaranteeing security. Specifically, Δt = 1s, α = 0.1, η = 0.01, and β = 0.1 can be used.

[0042] Batch verification process on the access router:

[0043] For data packets deemed necessary for verification during the probabilistic pass process, perform batch verification. Group N consecutive data packets into a batch and perform batch verification. For each data packet in that batch, analyze the content D... j Signature (S) j,1 ,S j,2 ), public key pk j And other cryptographic parameters {g,mpk,H}, calculate a j =H(D) j ||S j,1 ), from the integer group Randomly select δ j ,judge and Equal to: If they are equal, the verification result is true, indicating that these data packets are genuine and originate from the specified content publisher; otherwise, the verification result is false, indicating that at least one of these data packets is fake.

[0044] Decision-making process on the access router:

[0045] For data packets with true batch verification results, they are all genuine data packets, and we mark them to avoid unnecessary overhead from re-verification. For data packets with false batch verification results, there are likely many genuine data packets among them, but it is uncertain which ones are genuine. We determine the probability of discarding data packets based on the proportion of genuine data packets in the false batch. Since the higher the credibility of the content publisher, the greater the proportion of genuine data packets in the false batch, we discard the data packets with a lower probability, calculating the discard probability p. d :

[0046]

[0047] That is, p dEach data packet in the batch is selectively discarded with probability; otherwise, the packet proceeds to the normal subsequent processing. Discarding data packets according to this formula ensures that the number of false data packets that pass verification is only η times the total number of data packets, thus guaranteeing security. In the specific implementation, the parameter values ​​are consistent with those described above, i.e., α = 0.1, η = 0.01.

[0048] Probabilistic verification process on intermediate routers:

[0049] Since the access router has already discarded the vast majority of spoofed data packets, intermediate routers only need to verify data packets with a low probability, which is set by the access router. After receiving a data packet, the access router verifies it based on the previously recorded number of intermediate routers (n) that the corresponding interest packet passed through during transmission. ir The probability that the intermediate router needs to verify the data packet is calculated. This value is then filled into the verification probability field p in the data packet, where γ∈[0,1] represents the maximum tolerable error probability during the intermediate router's verification process. The intermediate router verifies the data packet based on the verification probability field p, that is, it verifies the data packet with probability p; otherwise, it does not execute the data packet verification process and verifies each data packet that needs to be verified one by one.

[0050] The specific process of verifying each data packet is as follows: For the content D, signature (S1,S2), public key pk, and other cryptographic parameters {g,mpk,H} in the data packet, calculate a = H(D||S1), and determine e(S2,g) and e(pk). a Is S1 equal to mpk? If they are equal, the verification result is true and the data packet is passed; otherwise, the verification result is false and the data packet is discarded.

[0051] The above description is merely a specific embodiment of the present invention. Any feature disclosed in this specification may be replaced by other equivalent or similar features unless otherwise specified. All disclosed features, or steps in all methods or processes, may be combined in any way except for mutually exclusive features and / or steps.

Claims

1. A method for verifying the security of data packets in an information-centric network, characterized in that, The steps are as follows: 1) Legitimate content publishers register password parameters with a trusted third party to sign data packets; 2) The access router directly connected to the content publisher periodically updates the content publisher's credibility based on the verification results of the data packets; 3) Access routers directly connected to content publishers perform batch verification on data packets and discard data packets with a probability. 4) The intermediate router verifies each data packet that needs to be verified according to the verification probability set for each data packet by the access router, and discards data packets that are verified as false. The specific method for periodically updating the credibility of content publishers in step 2) is as follows: The access router directly connected to the content publisher sets every N consecutive data packets as a batch, performs batch verification, and performs data forwarding at the initial time of establishing a connection with the content publisher. Within the system, the results of each batch validation are counted to obtain the number of batches that are validated as true. and the number of batches verified as false Furthermore, the probability estimate of subsequent data packets being true is calculated, i.e., the credibility. for: In time After that, the access router is in each After the batch verification is completed, the preceding steps are... Batch verification results, update and The value is updated accordingly to update the reputation score. The value of , where .

2. The data packet security verification method in an information center network according to claim 1, characterized in that, The specific method for signing the data packet in step 1) is as follows: Legitimate content publishers will identify themselves A public key is generated after hashing using a hash algorithm. ; A trusted third party generates the password parameters, verifies them, and accepts the content publisher's public key. Generate the corresponding private key The specific implementation method is to select prime numbers with the same order. Multiplication cyclic group and ,in The generator is , construct from arrive bilinear mapping Choose a hash algorithm From the group of integers Randomly select the master private key This generates the master public key. Based on the public key provided by the content publisher This can be used to generate the corresponding private key. , private key The password parameters are transmitted to the content publisher via a secure channel. public; The content publisher is from a multiplication cycle group Random selection From the group of integers Random selection ,calculate , and Thus, the final signature is obtained. The signature is attached to the data packet for verification by the routers it passes through. It is data from a data packet.

3. The data packet security verification method in an information center network according to claim 2, characterized in that, The specific implementation steps for step 3) are as follows: First, in the initial stage, data packets accessing the router pass through with a certain probability, specifically: At the initial time of establishing a connection with the content publisher and executing data forwarding Within a given timeframe, the access router selects to verify data packets with probability 1, meaning that all data packets from this content publisher must undergo verification; within a given timeframe... Then, based on credit rating Calculate the verification probability using the value , that is to Probabilistically validate all data packets from the specified content publisher: in, This represents the minimum verification probability for content publishers whose reputation score exceeds a certain threshold. A value of 0.1 can be used to reduce the verification overhead for content publishers whose reputation score exceeds a certain threshold. This represents a pre-set credibility threshold used to determine whether a content publisher is untrustworthy. This represents the maximum tolerable error probability during the access router verification process. A value of 0.01 can be used to ensure system security, when the reputation level... If a content publisher is deemed untrustworthy, all data packets from that publisher can be discarded without verification. This applies when the credibility level... At that time, with Probabilistic verification is performed on data packets from the content publisher; unverified data packets are directly processed in subsequent steps. Secondly, perform batch verification of data packets, specifically as follows: Batch verification is performed on N consecutive data packets. ,sign Public key Other password parameters ,calculate From the group of integers Random selection ,judge and Are they equal? ​​If they are equal, the verification result is true, indicating that these data packets are all genuine and originate from the specified content publisher; otherwise, the verification result is false, indicating that at least one of these data packets is fake. Finally, the access router makes the final decision to discard the data, and the specific method is as follows: The access router directly connected to the content publisher makes the following decision based on the batch verification results and the content publisher's reputation: if the verification result is true, all data packets in the batch are marked as true and all pass; if the verification result is false, the decision is made based on the reputation... Calculate the probability of rejection : That is, for each data packet in the batch, with The packet is selectively discarded with a probability of success; otherwise, the packet proceeds to the normal subsequent processing.

4. The data packet security verification method in an information center network according to claim 1, characterized in that, Step 4) The specific steps are as follows: When the access router directly connected to the content publisher receives a data packet, it will determine the number of intermediate routers that the interest packet corresponding to that data packet passed through during transmission, based on previously recorded data. The probability that the intermediate router needs to verify the data packet is calculated. And fill this value into the verification probability field in the data packet. ,in, This represents the maximum tolerable error probability during the intermediate router verification process. The intermediate router allows tagged data packets to pass directly, and extracts the verification probability field from untagged data packets. ,by The data packets are verified probabilistically; otherwise, the data packet verification process is not executed. Each data packet that needs to be verified is verified one by one. Data in the data packet ,sign Public key Other password parameters ,calculate ,judge and Equal to: If they are equal, the verification result is true and the data packet is passed; otherwise, the verification result is false and the data packet is discarded.

Images