Content-centric networking daisy-chained namespace authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing content-centric networking approaches require all network packets to be signed using public key infrastructure encryption, which is slow and impacts performance, despite providing strong security.
Innovation Solution
Implementing secure sessions where authentication is performed once at the beginning of the session, allowing individual data packets to go unencrypted, and using a daisy-chaining namespace system where each data packet's namespace is derived from the previous one, making it difficult for intercepting nodes to determine packet relationships and preventing replay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all network packets are signed using public key infrastructure encryption, then security is strengthened, but performance deteriorates due to the slowness of asymmetric encryption
Solution Approach 1:
The patent segments the authentication process from the data transmission process. Instead of signing every data packet, authentication is performed once at the session establishment phase, and subsequent packets rely on this initial authentication. This segmentation eliminates the performance bottleneck of repeated asymmetric encryption while maintaining security through the established secure session.
Solution Approach 2:
The patent applies preliminary action by performing authentication in advance during session establishment. The secure session is set up beforehand with cryptographic credentials exchanged and verified, so that individual data packets transmitted within the session do not require repeated authentication. This preliminary authentication action resolves the contradiction by ensuring security upfront while enabling fast subsequent transmissions.
2Reliability
If authentication is performed for every data packet, then security is maintained, but processing time increases
Solution Approach 1:
The patent implements periodic action by performing authentication at regular intervals rather than continuously. Specifically, authentication occurs at the beginning of each secure session and potentially at session renewal points, but not for every individual packet within the session. This periodic approach maintains security boundaries while dramatically reducing processing time for actual data transmission.
3Ease of operation
If a static namespace is used for session identification, then packet routing is simplified, but security is weakened due to predictability and replay attack vulnerability
Solution Approach 1:
The patent applies dynamics by making the namespace dynamic rather than static. The namespace is derived from cryptographic credentials and changes for each packet or session, ensuring that even if one namespace is compromised, others remain secure. This dynamic namespace generation maintains routing functionality while eliminating the security vulnerabilities of static namespaces, including replay attack susceptibility.
Solution Approach 2:
The patent implements parameter changes by transforming the namespace from a fixed value to a dynamically generated value based on cryptographic parameters. The namespace is derived from signed data including session identifiers and cryptographic credentials, causing it to change with each session or packet. This parameter transformation maintains the ease of routing (the namespace still identifies packets) while fundamentally improving security through unpredictability.
4Reliability
If continuous packet signing is implemented, then origin verification is ensured, but network overhead increases
Solution Approach 1:
The patent extracts the authentication function from the data packet itself. Instead of embedding cryptographic signatures within every data packet, the authentication is performed separately during session establishment. The signed credentials are used to establish a secure session context, and subsequent packets within that session inherit the authentication without carrying their own signatures. This extraction reduces network overhead while maintaining origin verification through the session context.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
Methods of content-centric networking, a client, a server and computer program products are disclosed. A method of establishing a secure session for transfer of a stream of data packets between a client and a server of a content-centric network comprises the steps of: exchanging a first namespace portion indication between the server and the client; deriving a first namespace portion from the first namespace portion indication; incorporating the first namespace portion into a first namespace of a first request from the client to the server for a first data packet of the stream of data packets; deriving a subsequent namespace portion, the subsequent namespace portion being based on transfer of the first data packet, the subsequent namespace portion differing from the first namespace portion; and incorporating the subsequent namespace portion into a subsequent namespace of a subsequent request from the client to the server for a subsequent data packet of the stream of data packets. In this way, the namespace of each data packet changes and is related to the previous data packets such that the namespaces daisy-chain from one to the other, without the need for any additional authentication needing to take place between the two nodes when transferring a subsequent data packet. As long as both the client and the server derives the correct namespace for each subsequent data packet, it can be assumed that the session between the client and the server is still secure, which significantly improves performance whilst maintaining security.