Browse > Article
http://dx.doi.org/10.3837/tiis.2020.07.010

An Overview of Content Poisoning in NDN: Attacks, Countermeasures, and Direction  

Im, Hyeonseung (Department of Computer Science and Engineering, Kangwon National University)
Kim, Dohyung (Department of Computer Science and Engineering, Kangwon National University)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.14, no.7, 2020 , pp. 2904-2918 More about this Journal
Abstract
With a huge demand for replicated content on the Internet, a new networking paradigm called information-centric networking (ICN) has been introduced for efficient content dissemination. In ICN, named content is distributed over the network cache and it is accessed by name instead of a location identifier. These aspects allow users to retrieve content from any of the nodes having replicas, and consequently 1) network resources are more efficiently utilized by avoiding redundant transmission and 2) more scalable services are provided by distributing server loads. However, in-network caching in ICN brings about a new type of security issues, called content poisoning attacks, where fabricated content is located in the network cache and interferes with the normal behavior of the system. In this paper, we look into the problems of content poisoning in ICN and discuss security architectures against them. In particular, we reconsider the state-of-the-art schemes from the perspective of feasibility, and propose a practical security architecture.
Keywords
Information-centric networking; Network cache; Content poisoning attacks; Content verification; Verification overhead;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Koponen, Teemu, Mohit Chawla, Byung-Gon Chun, Andrey Ermolinskiy, Kye Hyun Kim, Scott Shenker, and Ion Stoica, "A data-oriented (and beyond) network architecture," in Proc. of the 2007 conference on Applications, technologies, architectures, and protocols for computer communications, pp. 181-192, 2007.
2 Jacobson, Van, Diana K. Smetters, James D. Thornton, Michael F. Plass, Nicholas H. Briggs, and Rebecca L. Braynard, "Networking named content," in Proc. of the 5th international conference on Emerging networking experiments and technologies, pp. 1-12, 2009.
3 Tarkoma, Sasu, Mark Ain, and Kari Visala, "The Publish/Subscribe Internet Routing Paradigm (PSIRP): Designing the Future Internet Architecture," IOS Press, pp. 102-111, 2009.
4 Dannewitz, Christian, "Netinf: An information-centric design for the future internet," in Proc. of 3rd GI/ITG KuVS Workshop on The Future Internet, pp. 1-3, 2009.
5 Garcia, Gerardo, Andrzej Beben, Francisco J. Ramon, Adrian Maeso, Ioannis Psaras, George Pavlou, Ning Wang et al, "COMET: Content mediator architecture for content-aware networks," in Proc. of 2011 Future Network & Mobile Summit, pp. 1-8, 2011.
6 Lagutin, Dmitrij, Kari Visala, and Sasu Tarkoma, "Publish/Subscribe for Internet: PSIRP Perspective," IOS Press, 75-84, 2010.
7 Vasilakos, Athanasios V., Zhe Li, Gwendal Simon, and Wei You, "Information centric network: Research challenges and opportunities," Journal of network and computer applications, 52, 1-10, 2015.   DOI
8 White, Greg, and Greg Rutz, "Content delivery with content-centric networking," CableLabs, Strategy & Innovation, 1-26, 2016.
9 Ghali, Cesar, Gene Tsudik, and Ersin Uzun, "Network-layer trust in named-data networking," ACM SIGCOMM Computer Communication Review, 44, no. 5, 12-19, 2014.   DOI
10 Cui, Wenjing, Yang Li, Yan Zhang, Chang Liu, and Mengqi Zhan, "An Ant Colony Algorithm Based Content Poisoning Mitigation in Named Data Networking," in Proc. of 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), pp. 176-183, 2019.
11 Ghali, Cesar, Gene Tsudik, and Ersin Uzun, "Needle in a haystack: Mitigating content poisoning in named-data networking," in Proc. of NDSS Workshop on Security of Emerging Networking Technologies (SENT), 2014.
12 Bianchi, Giuseppe, Andrea Detti, Alberto Caponi, and Nicola Blefari Melazzi, "Check before storing: What is the performance price of content integrity verification in LRU caching?," ACM SIGCOMM Computer Communication Review, 43, no. 3, 59-67, 2013.   DOI
13 Ahlgren, Bengt, Christian Dannewitz, Claudio Imbrenda, Dirk Kutscher, and Borje Ohlman, "A survey of information-centric networking," IEEE Communications Magazine, 50(7), 26-36, 2012.   DOI
14 Cui, Wenjing, et al, "Feedback-based content poisoning mitigation in named data networking," in Proc. of 2018 IEEE Symposium on Computers and Communications (ISCC). IEEE, 2018.
15 Wu, Danye, Zhiwei Xu, Bo Chen, and Yujun Zhang, "What if routers are malicious? mitigating content poisoning attack in ndn," in Proc. of 2016 IEEE Trustcom/BigDataSE/ISPA, pp. 481-488, 2016.
16 Jacobson, Van, Jeffrey Burke, Deborah Estrin, Lixia Zhang, Beichuan Zhang, Gene Tsudik, Kimberly Claffy et al., "Named data networking (NDN) project 2012-2013 annual report," Named Data Networking (NDN), 2013.
17 Gasti, Paolo, Gene Tsudik, Ersin Uzun, and Lixia Zhang, "DoS and DDoS in named data networking," in Proc. of 2013 22nd International Conference on Computer Communication and Networks (ICCCN), pp. 1-7, 2013.
18 Dohyung Kim, Sunwook Nam, Jun Bi, and Ikjun Yeom, "Efficient content verification in named data networking," in Proc. of the 2nd ACM Conference on Information-Centric Networking, pp. 109-116, 2015.
19 Dohyung, Kim, Jun Bi, Athanasios V. Vasilakos, and Ikjun Yeom, "Security of cached content in NDN," IEEE Transactions on Information Forensics and Security, 12, no. 12, 2933-2944, 2017.   DOI
20 DiBenedetto, Stephanie, and Christos Papadopoulos, "Mitigating poisoned content with forwarding strategy," in Proc. of 2016 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pp. 164-169, 2016.
21 Hamdane, B., Serhrouchni, A., Fadlallah, A., & El Fatmi, S. G., "Named-data security scheme for named data networking," in Proc. of 2012 Third International Conference on The Network of the Future (NOF), pp. 1-6, 2012.
22 "NDN Packet Format Specification 0.3 document," 2020. [Online]. Available: https://named-data.net/doc/NDN-packet-spec/current/
23 R. L. Rivest and B. Lampson, "SDSI-a simple distributed security infrastructure," Crypto, 1996.
24 Wang, Yi, Zhuyun Qi, Kai Lei, Bin Liu, and Chen Tian, "Preventing" bad" content dispersal in named data networking," in Proc. of the ACM Turing 50th Celebration Conference-China, pp. 1-8, 2017.
25 "Youtube traces from the campus network," 2008. [Online]. Available: http://traces.cs.umass.edu/index.php/Network