This document discusses security issues in content-centric networks. It begins with an overview of the basics of named-data networking (NDN), including its key features and data structures. It then covers security aspects of NDN, including authentication, integrity, confidentiality, and comparisons to TCP/IP security. Several NDN network simulations are described, including simple, congestion, and load balancing scenarios. The document concludes with topics for future work on green NDN networks.

1. SECURITY ISSUES IN
CONTENT-CENTRIC
NETWORKS
Guided by:
Prof. Gaurang Raval
Made by:
Anushree Juthani,
Information and Network Security(CSE)
Nirma University

2. Outline
• Basics of Named-Data Networking
• Security Aspects
• Sample simulation
• References

3. Basics of Named-Data Networking
• An evolution of the conventional TCP/IP architecture
• Features:
 Fetching data by name, not IP addresses
 Optimal content distribution
 painless mobility, wireless, virtualization, ...
 same scalability & efficiency as TCP/IP
 simple, secure, robust configuration
 much better security

4. • IP Protocol
Basics of Named-Data Networking
Underlying
Communication is
destination-driven
Challenges:
 Distribute data to a large group of Users
 Increases load on the producer
 Difficult to handle mobile users whose addresses change.
 Difficult to secure data as it moves from device to device.

5. • CCN(NDN or ICN)- ask for what you want
• Retrieving Named Data through Interest packets and Data packets.
• Address space ruled out, namespace ruled in
Basics of Named-Data Networking

6. • 3 data structures in an NDN router:
• Pending Interest Table(PIT)
• Forwarding Information Base(FIB)
• Content Store(CS)
Basics of Named-Data Networking

7. Security Aspects
• NDN security is based on the public key cryptography, to
provide solutions for the 3 aspects of security:
• Confidentiality
• Integrity
• Authentication
• Building Blocks of security in NDN:
• Trust Policy:- Trust policies are defined by applications to determine
whether a packet or an identity is trustworthy or not.
• NDN Certificate:- In NDN, every entity that produces data needs to
obtain an NDN certificate to prove the ownership of its namespace
and cryptographic materials.
• NDN certificate is a Data packet that carries public key information
and can be fetched by normal Interest packets.
.

8. Security Aspects
Design Considerations of NDN Security:
• NDN security should be able to support different trust
models for different systems.
• Name and naming convention explicitly conveys desired
information and can facilitate trust and key management in
NDN.
• Security properties (data authentication, integrity, and
confidentiality) should stay with the data regardless of its
location.

9. Security Aspects
Authentication and Integrity:
• NDN requires producers to sign every individual Data packet,
enabling consumers to verify each incoming Data’s signature, hence
ensuring data authentication and integrity.
• NDN’s name semantics enables consumers to use name-based trust
policies to reason about trust by checking which piece of data is signed
by which key.
• In this way, trust policies limits the power of each signing key and
ensures each trustworthy packet is signed by a legitimate key,
providing data authentication.

10. Security Aspects
Authentication:
 To authenticate data, a trust model is needed in which:
 Trust rules are defined.
 One or more trusted keys
 Requires cryptographic properties for protection
 Trust model should be easily expressible:
 help consumer to authenticate data
 help producers to sign data

11. Security Aspects
Authentication:
 Desired Properties for Trust Policy Definition
 Clear definition of relationship rules
 Least privilege assignment
 Re-use of trust models between applications
 Define, debug, and refine common trust models
 Make security easy to use

12. Security Aspects
Authentication and Integrity:
• The authentication and integrity of incoming Data Packets including
certificates are determined by:
• validation by name-based trust policies
• signature verification
 Validation by name-based trust policies:- Structured naming
convention of Data packets and keys enabling NDN applications to
define rules that only accept packets with desired format of names and
name relationships between packet and its signing key.
 Signature Verification :- Consumers verify the signatures by the
retrieval of certificates of the producers which are identified by key
names. The certificate points to its CA and then an anchor. The data
packet is considered to be valid if all the fetched certificates have valid
signatures and can satisfy the trust policies.

13. Security Aspects
Data Confidentiality:
 For active point-to-point sessions, key exchange protocol such as
Diffie-Hellman can derive encryption keys for the session and both
sides are well aware of the key information.
 When sharing data with multiple parties, Diffie-Hellman may not be
feasible or efficient. The owner of the data needs to deliver decryption
keys to authorized entities.
 An optional feature
 Not inherent in NDN architecture.

14. Comparision of security in NDN vs TCP/IP
• Security Stays with Network Data: ​In NDN, security
properties are inherent with Data Packets which is not the
case in conventional TCP/IP architecture. NDN provides a
standard packet format for security purpose which is absent
in the TCP/IP.
• Reduced Cost and Dependencies of Security: Security in
conventional TCP/IP turns to be expensive as it has to be
applied explicitly. E.g.additional round trips-> compared to
pure TCP connection setup, adding TLS 1.2 session setup
involves three more round trips,thus increasing time
complexity as well as cost. Within NDN, it requires no extra
steps for applications to cryptographically secure channel.

15. Comparision of security in NDN vs TCP/IP
• Improved Privacy of Consumer:- In NDN, since normal
Interest packets fetch Data packets by name, they do not
disclose any information about consumers, while fetched
Data packets also contain nothing related to the consumers.
While in TCP/IP, IP header carries the source address,
which can reveal sensitive info about the consumers along
with sensitive meta-data
• Mitigated Denial-of-Service:-NDN’s communication pattern
naturally mitigates Denial-of-Service(DoS) attacks. While in
conventional TCP/IP architecture, it is easy to carry out
Distributed DOS attacks.

16. Sample simulation
Using NDNSIM

17. Simulation of scenario –<ndn-simple>
• Commands used:
 ./waf --run=<scenario-name>
 NS_LOG=ndn.Producer:ndn.Consumer ./waf --
run=<scenario name>
 ./waf --run=<scenario-name> --vis

18. Simulation of scenario –<ndn-grid>
• PointToPointLayout NS-3 module.
• Consumer is simulated using ConsumerCbr reference application and generates
Interests towards the producer with frequency of 100 interests per second
• Producer is simulated using Producer class, which is used to satisfy all incoming
Interests with virtual payload data (1024 bytes).

19. Simulation of scenario –<ndn-grid>
Simple file compilation

20. Simulation of scenario –<ndn-grid>
 Logging of packets sent from NDN producer to NDN
consumer

21. Simulation of scenario –<ndn-grid>
 Graphical visualisation of simulation

22. Simulation of scenario –<ndn-
congestion>
 Congestion scenario(1 bottleneck)

23. Simulation of scenario –<ndn-
congestion>
Simple file compilation

24. Simulation of scenario –<ndn-
congestion>
 Logging of packets sent from NDN producer to NDN
consumer

25. Simulation of scenario –<ndn-
congestion>
 Graphical visualisation of simulation

26. Simulation of scenario –<ndn-congestion-
alt-topo>
 Congestion scenario(2 bottleneck,11 nodes)

27. Simulation of scenario –<ndn-congestion-
alt-topo>
Simple file compilation

28. Simulation of scenario –<ndn-congestion-
alt-topo>
 Logging of packets sent from NDN producer to NDN
consumer

29. Simulation of scenario –<ndn-congestion-
alt-topo>
 Graphical visualisation of simulation

30. Simulation of scenario –<ndn-load-
balancer>
 Load balancing

31. Simulation of scenario –<ndn-load-
balancer>
Simple file compilation

32. Simulation of scenario –<ndn-load-
balancer>
 Logging of packets sent from NDN producer to NDN
consumer

33. Simulation of scenario –<ndn-load-
balancer>
 Graphical visualisation of simulation

34. FUTURE SCOPE
• Green NDN:- An environment-friendly simulation and
evolution of NDN
● Objective​:- To operate networking in a highly scalable
and energy-efficient way
● Scope and goals:-
○ Reduction of power consumption:
◆ 20% for normal days
◆ 40% for Disasters
○ Seamless services before and after a disaster
○ A framework for collaboration and sharing in order to
achieve energy-efficient video
delivery.

35. References
• Zhiyi Zhang, Haitao Zhang, Eric Newberry, Spyridon
Mastorakis, Yanbiao Li, Alexander Afanasyev, Lixia
Zhang. - Security Support in Named Data Networking
• Lixia Zhang- Named Data Networking
• Schematized Trust -Design and Application by Alex
Afanasyev, NDNcomm 2015
• NDN Routing Security- Lan Wang, Beichuan Zhang
• Content-Centric Networking- Van Jacobson,Palo Alto
Research Center (PARC)
• Routing in NDN, Lan Wang (University of Memphis) & the
NDN Team FIA PI Meeting

36. THANK YOU