Named Data Network Router Malicious Content Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Named Data Networks, malicious entities can inject fraudulent data into the reverse path of content streams, leading to potential denial-of-service attacks and data corruption, as existing routers lack efficient mechanisms to authenticate and filter out malicious content objects in real-time without compromising performance.
Innovation Solution
A router employs a Pending Interest Table (PIT) to track the egress interface for each Interest, allowing it to block malicious Content Objects by verifying that they were received via the same interface used for forwarding the corresponding Interest, thereby preventing unauthorized data insertion into the reverse path.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic authentication operations are performed on every Content Object, then network security is improved, but router runtime performance deteriorates
Solution Approach 1:
The patent performs preliminary actions by establishing the reverse path and recording the egress interface in the PIT when the Interest message is initially received. This preliminary recording of interface information allows subsequent Content Objects to be validated quickly without requiring complex cryptographic operations on every packet, thus maintaining security while improving runtime performance.
Solution Approach 2:
The patent extracts the essential authentication information (egress interface identifier) from the full cryptographic authentication process. Instead of performing complete cryptographic verification on every Content Object, the system only checks whether the incoming interface matches the recorded egress interface, taking out the critical security check while eliminating the performance burden of full cryptographic operations.
2Reliability
If interface verification is performed on every Content Object, then malicious data injection is prevented, but processing overhead increases
Solution Approach 1:
The patent uses a simple, lightweight interface identifier comparison mechanism instead of complex authentication protocols. This 'cheap' verification method involves only comparing interface IDs, which is computationally inexpensive and can be performed rapidly on every Content Object without significant processing overhead, thus preventing malicious injection while minimizing time loss.
3Reliability
If the router tracks egress interfaces for all Interests, then malicious content is blocked, but device complexity increases
Solution Approach 1:
The patent makes the PIT entry serve multiple functions: it not only tracks pending Interests for proper Content Object routing but also records the egress interface for security verification. This multi-functionality allows the same data structure to support both legitimate Content Object delivery and malicious content blocking, reducing overall device complexity by avoiding separate tracking mechanisms.
Data Source
AI summary
An object-forwarding device can block a malicious Content Object from being inserted into an Interest's reverse path over a named data network. During operation, the device can receive a Content Object via a first interface, and can perform a lookup operation in a Pending Interest Table (PIT) to identify a PIT entry for an Interest associated with the Content Object. The device then determines, from the PIT entry, an egress interface used to forward the Interest. If the device determines that the egress interface of the PIT entry matches the first interface for the Content Object, the device forwards the Content Object via a return interface specified in the PIT entry. On the other hand, if the egress interface of the PIT entry does not match the first interface for the Content Object, the device can block the Content Object.