Encrypted Name Suffixes for Secure Named-Data Network Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure connection protocols like TLS and SSL are limited to IP-based networks and cannot establish secure connections on content-centric networks, making it difficult to maintain secure communications when devices switch between networks, especially for mobile devices with changing IP addresses.
Innovation Solution
A computer system generates and processes Interest packets with encrypted name suffixes over named-data networks, using encryption keys to secure communications between client and content producer devices, allowing secure data requests and authentication without relying on IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS/SSL protocol is used to establish secure connection, then data encryption and security are improved, but network adaptability deteriorates because it is specific to IP-based networks only
Solution Approach 1:
The patent creates a security protocol that functions across multiple network architectures by abstracting the security layer from IP-specific implementations. The Interest packet structure with encrypted name suffixes and session-based authentication enables TLS-like security guarantees to work over both traditional IP networks and content-centric networks, making the security mechanism universal rather than protocol-specific
Solution Approach 2:
The patent introduces an intermediary security layer that sits between the application layer and the network layer. This intermediary mechanism uses encrypted Interest packets and session keys to provide security without being tied to the underlying network protocol, allowing it to mediate secure communication across different network types including IP-based and content-centric networks
2Reliability
If IP address-based connection is used, then secure connection establishment is improved, but mobility and network switching capability deteriorate
Solution Approach 1:
The patent segments the connection identification into two parts: a stable session identifier that remains constant across network changes, and a volatile network address component that changes with network topology. This segmentation allows the session to be maintained through network switches while the address component adapts to new networks, resolving the contradiction between connection stability and network mobility
Solution Approach 2:
The patent implements dynamic connection management where the Interest packet structure adapts to network changes. The session key and encrypted name suffix remain stable while the network address portion dynamically updates when devices switch networks, enabling both connection persistence and network flexibility simultaneously
3Reliability
If encrypted Interest packets are used, then privacy protection is improved, but computational overhead and processing complexity increase
Solution Approach 1:
The patent applies partial encryption by encrypting only the name suffix portion of the Interest packet rather than the entire packet. This selective encryption provides sufficient privacy protection for the critical identifier information while minimizing the computational overhead compared to full packet encryption, balancing security with processing efficiency
Solution Approach 2:
The patent changes the encryption parameter from encrypting entire packets to encrypting only specific fields (name suffixes). This parameter change reduces the data volume requiring encryption/decryption operations, lowering computational complexity while maintaining the essential privacy protection function for the most sensitive information
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer system can send a secure request over a named-data network to a remote device by generating an Interest with encrypted name components. During operation, the computer system can receive or obtain a request for data, such as from a local user or from a local application. If the system cannot satisfy the request locally, the system can determine at least a routable prefix and a name suffix associated with the request. The system can generate the secure Interest for the request by determining an encryption key that corresponds to a session with the remote computer system, and encrypts the name suffix using the session encryption key. The system then generates an Interest whose name includes the routable prefix and the encrypted name suffix, and disseminates the Interest over a named-data network to send the request to the remote computer system.