Transparent Encryption for Content Centric Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content centric networks (CCNs) face challenges in securing user privacy and efficiency due to the exposure of sensitive data in packet names and the need for multiple round trips for authentication and key exchange, which can lead to breaches in security and increased packet travel time.
Innovation Solution
A transparent encryption system that masks packet names and encrypts content using a symmetric key derived from a hierarchically structured variable length identifier (HSVLI) and a nonce, allowing for efficient and secure communication by reducing packet travel time to one round trip time (RTT) and ensuring only entities with the original name and mapping can decrypt the payload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If packet names contain sensitive data for routing purposes, then routing efficiency is improved, but user privacy and security are compromised
Solution Approach 1:
The packet name is segmented into two distinct parts: a masked name component used for routing that contains no sensitive information, and an original name component that contains the sensitive data but is encrypted and only accessible to authorized entities. This segmentation allows routing functions to operate efficiently while user privacy is preserved.
Solution Approach 2:
A masked name acts as an intermediary between the routing system and the original sensitive name. The masked name enables intermediate nodes to perform forwarding and caching operations without exposing sensitive user information, while still allowing the system to route packets correctly to the intended destination.
2Reliability
If multiple round trips are used for authentication and key exchange, then security is improved, but packet travel time increases
Solution Approach 1:
Authentication and key exchange information are performed and established in advance before actual content transmission. The symmetric key is derived beforehand using the original name and a nonce, so that when content needs to be transmitted, the encryption and decryption can occur in a single round trip without requiring additional authentication exchanges.
3Reliability
If transparent encryption is implemented, then security is improved, but computational overhead increases
Solution Approach 1:
The encryption approach changes from asymmetric encryption (public-key cryptography) to symmetric encryption. This parameter change reduces computational overhead significantly because symmetric encryption algorithms are less computationally intensive, while still providing strong security through the use of the derived symmetric key and nonce.
Data Source
AI summary
One embodiment provides a system that facilitates efficient and transparent encryption of packets between a client computing device and a content producing device. During operation, the system receives, by a content producing device, an interest packet that includes a masked name which corresponds to an original name, wherein the original name is a hierarchically structured variable length identifier that includes contiguous name components ordered from a most general level to a most specific level. The system obtains the original name based on the masked name. The system computes a symmetric key based on the original name and a generated nonce. The system generates a content object packet that corresponds to the original name and includes the masked name, the nonce, and a payload encrypted based on the symmetric key, wherein the content object packet is received by a client computing device.