Selective Encryption of CCN Name Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Content Centric Network (CCN) packet formats lack the ability to selectively encrypt portions of messages, such as name components, and do not provide session-based encryption between entities, compromising data privacy and security.
Innovation Solution
A system that selectively encrypts bit groups within CCN messages using multiple symmetric keys, employing an authenticated encryption protocol to protect sensitive information while maintaining authentication integrity, allowing for encryption of specific name components and decrypting them upon verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current CCN packet formats are used with authentication as primary objective, then authentication integrity is maintained, but selective encryption of name components is not possible
Solution Approach 1:
The packet structure is segmented into distinct regions: authenticated regions (unchanged name components) and encrypted regions (sensitive name components). This segmentation allows the packet to simultaneously maintain authentication integrity for routing purposes while enabling selective encryption for privacy protection of specific name components.
Solution Approach 2:
Different quality properties are applied to different parts of the packet: authentication is applied globally to ensure integrity, while encryption is applied locally only to specific name components that require privacy protection. This allows simultaneous achievement of both authentication integrity and selective encryption capability.
2Reliability
If encryption is applied to protect sensitive data, then data privacy is improved, but the ability to perform routing and caching based on name components is compromised
Solution Approach 1:
The name is segmented into routed components (kept in plaintext for routing/caching) and sensitive components (encrypted for privacy). Intermediate nodes can perform routing and caching operations on the plaintext portions while the encrypted portions remain protected, resolving the contradiction between privacy and routing functionality.
Solution Approach 2:
Encryption is applied locally only to specific sensitive name components rather than the entire name. This allows intermediate nodes to access and process the non-encrypted portions for routing decisions while the sensitive portions remain encrypted, maintaining both data privacy and routing ease of operation.
3Reliability
If previous CCN packet formats encrypt only the payload, then payload confidentiality is achieved, but authentication for the entire packet is not sufficient for session-based encryption
Solution Approach 1:
The authenticated encryption protocol provides multi-functionality by simultaneously ensuring payload confidentiality, authentication of the entire packet, and enabling session-based encryption. This universal approach replaces the need for separate mechanisms and enables versatile encryption modes including selective name component encryption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
One embodiment provides a system that facilitates selective encryption of bit groups of a message. During operation, the system determines, by a content requesting device or content producing device, a message that includes a plurality of bit groups, each corresponding to a type, a length, and a set of values, wherein one or more bit groups are marked for encryption, and wherein the message indicates a name that is a hierarchically structured variable-length identifier comprising contiguous name components ordered from a most general level to a most specific level. The system computes a plurality of cipher blocks for the message based on an authenticated encryption protocol. The system encrypts the one or more bit groups marked for encryption based on one or more symmetric keys, wherein the marked bit groups include one or more name components. Subsequently, the system indicates the encrypted bit groups as encrypted.