Network-Layer Verifier Stack for CCN Content Authenticity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content Centric Networks (CCN) face challenges in ensuring content authenticity and security due to the lack of signature verification in typical routers, which can lead to denial-of-service attacks like content poisoning, and require complex client applications to maintain trusted certificates for verification.
Innovation Solution
A verifier stack component that verifies Content Objects by using a KeyID and ContentObjectHash to ensure authenticity, allowing for transparent trust enforcement within the transport stack, enabling the use of trusted certificate authorities and trust checkers to validate the trustworthiness of Content Objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client applications enforce CCN security measures by verifying content signatures, then content authenticity is improved, but application complexity increases
Solution Approach 1:
The patent introduces a network-layer security component as an intermediary between the CCN router and the application. This component performs signature verification and trust validation on behalf of the application, shielding the application from complex security operations. The intermediary maintains trusted certificate authorities and executes verification logic, thereby improving content authenticity while keeping the application simple.
2Reliability
If CCN routers perform content signature verification, then content security is improved, but network latency increases
Solution Approach 1:
The patent segments the security verification function from the core routing function. The router's role is limited to forwarding Content Objects to a network-layer security component, which then performs verification. This segmentation allows the router to operate at high speed without verification overhead, while security is enforced separately, thus improving content security without significantly increasing network latency.
3Object-affected harmful factors
If applications verify content signatures, then content poisoning attacks are mitigated, but development and maintenance costs increase
Solution Approach 1:
The network-layer security component provides self-service security verification by automatically obtaining and managing trusted certificate authorities. Instead of requiring application developers to manually configure and maintain certificate stores, the security component autonomously performs these tasks, thereby mitigating content poisoning attacks while reducing development and maintenance costs.
4Loss of time
If routers cache content without verification, then round-trip-delay is reduced, but denial-of-service attacks increase
Solution Approach 1:
The patent implements preliminary verification at the network-layer security component before content is cached or delivered to applications. By verifying signatures and validating trust credentials in advance, the system ensures that only authentic content is cached, thereby reducing round-trip-delay through efficient caching while preventing denial-of-service attacks through pre-verification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A data verification system facilitates verifying whether a CCN Content Object is authentic or trustworthy on behalf of an application. During operation, the system can obtain a stack requirement for a custom transport stack, which specifies at least a description for a verifier stack component that verifies a Content Object using a key identifier (KeyID) associated with a publisher. The system instantiates the verifier stack component in the custom stack, and can use the custom stack to obtain a verified Content Object. While using the custom stack, the system can push, to the custom stack, an Interest that includes a name for a piece of content and includes a KeyID associated with a content producer. The system then receives, from the custom stack, a Content Object which the verifier stack component has verified is signed by the content producer associated with the KeyID.