Session Key Generation for Named-Data Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure connection protocols like TLS and SSL are specific to IP-based networks and cannot be used on content-centric networks, making it difficult to establish secure connections when devices switch between networks, such as smartphones changing IP addresses.
Innovation Solution
A content-producing computer system generates a session key to communicate with client devices over named-data networks, using Interest and Content Object packets with encrypted names, allowing secure key exchange and authentication without relying on IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS or SSL protocol is used to establish secure connection, then data encryption and security are improved, but the protocol cannot be used on content-centric networks where IP addresses change
Solution Approach 1:
The patent introduces session identifiers and encrypted name suffixes as intermediaries between the client and content producer. Instead of relying on IP addresses directly, the system uses these cryptographic intermediaries to establish secure connections that work across changing network conditions and content-centric architectures.
Solution Approach 2:
The patent changes the fundamental parameters of connection establishment by replacing IP address-based identification with name-based identification using encrypted suffixes. This allows the connection mechanism to adapt from traditional IP networks to content-centric networks where addresses are dynamic.
2Reliability
If session keys are generated and encrypted names are used for each communication, then security and privacy are improved, but the complexity of key management and authentication increases
Solution Approach 1:
The patent performs preliminary key establishment and session initialization before actual data transmission. Session identifiers and encrypted name suffixes are set up in advance, allowing the system to maintain security without requiring complex real-time key management during communication.
Solution Approach 2:
The patent uses encrypted name suffixes as cryptographic copies that represent the actual content identifiers. These encrypted copies allow the system to maintain security while simplifying key management, as the encrypted suffixes can be independently handled without exposing the underlying content names or requiring continuous decryption/encryption cycles.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A content-producing computer system can use a locally generated key or a client-generated key to communicate with a client device during a session over a named-data network. During operation, the computer system can receive an Interest packet that includes a name for a piece of data or a service. The Interest's name can include a routable prefix, a session identifier, and an encrypted suffix. In some embodiments, the system can generating a session key based on the session identifier and a secret value, and decrypts the encrypted suffix using the session key to obtain a plaintext suffix. The system processes the plaintext suffix to obtain data requested by the Interest, and encrypts the data using the session key. In some other embodiments, the system can use a local private key to decrypt the encrypted suffix, and uses an encryption key obtained from the Interest to encrypt the Content Object.