CONTROLLING THE SPREAD OF INTERESTS AND CONTENT IN A CONTENT CENTRIC NETWORK

• US 20090288163A1
• Filed: 12/18/2008
• Published: 11/19/2009
• Est. Priority Date: 05/16/2008
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Smetters, Diana K., Jacobson, Van L.
• Granted Patent: US 9,456,054 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: H04L 45/08 Learning-based routing, e.g. using neural networks or artificial intelligence
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

One embodiment of the present invention provides a system for controlling the spread of interests and content in a content centric network (CCN). During operation, the system maintains a routing policy for content data. The system also receives a packet associated with a piece of content or an interest for the content. Next, the system determines that the structured name included in the packet is within the namespace specified in the routing policy. The system further determines that the packet satisfies the condition in the routing policy. Subsequently, the system routes the packet based on in part the action corresponding to the condition as specified in the routing policy.

Claims

1. A computer-executed method for controlling the spread of interests and content in a content centric network (CCN), comprising:

maintaining a routing policy for content data,

wherein the routing policy specifies a namespace, a condition, and a routing action corresponding to the condition;

wherein the namespace corresponds to one or more structured names and includes at least part of a content name which can be used to match content with a more specific name that falls logically within the scope of the name space;

wherein a respective structured name is unique and persistent with respect to certain content; and

wherein the condition specifies when the routing action can be taken upon receipt of data packets associated with the namespace;

receiving a packet associated with a piece of content or an interest for the content,

wherein the content is identified by a structured name; and

wherein the structured name in the packet includes authentication information for the content;

determining that the structured name included in the packet is within the namespace specified in the routing policy;

determining that the packet satisfies the condition in the routing policy; and

routing the packet based on in part the action corresponding to the condition as specified in the routing policy.

2. The method of claim 1, wherein determining that the structured name included in the packet is within the namespace specified in the routing policy comprises using a longest name match policy to match the structured name against the namespace.

3. The method of claim 1, wherein routing the packet comprises one or more of:

dropping content packets, thereby preventing creation of content with a certain name;

dropping interest packets, thereby preventing interests from circulating;

forwarding the packet to another node;

copying or redirecting the packet;

deferring action on the packet; and

applying a default policy when no conditions match.

4. The method of claim 1, wherein determining that the packet satisfies the condition comprises matching one or more of:

an identity of a signer of the content by using a public key;

a credential held by a signer of the content;

an identity of a node generating an interest by using a public key;

a network interface on which the packet arrived; and

a network address indicating where the packet is originated or destined.

5. The method of claim 1, further comprising automatically retrieving keys and credential information (from the CCN) to check policy compliance.

6. The method of claim 1, further comprising stochastically verifying the routing policy by router nodes, thus enabling an overall expected level of policy compliance and verification.

7. The method of claim 1, further comprising:

dynamically retrieving the policy from the CCN; and

dynamically updating the policy.

8. The method of claim 1, further comprising defeating a denial-of-service attack against a policy enforcement system by greylisting keys so that automatic retrieval of the keys is deferred.

9. The method of claim 1, further comprising propagating the routing policy to an upstream node, whereby the upstream node can optionally enforce the routing policy and filter content.

10. An apparatus for controlling the spread of interests and content in a content centric network (CCN), comprising:

a processor;

a memory;

a maintaining mechanism configured to maintain a routing policy for content data,

wherein the routing policy specifies a namespace, a condition, and a routing action corresponding to the condition;

wherein the namespace corresponds to one or more structured names and includes at least part of a content name which can be used to match content with a more specific name that falls logically within the scope of the name space;

wherein a respective structured name is unique and persistent with respect to certain content; and

wherein the condition specifies when the routing action can be taken upon receipt of data packets associated with the namespace;

a receiving mechanism configured to receive a packet associated with a piece of content or an interest for the content;

wherein the content is identified by a structured name; and

wherein the structured name in the packet includes authentication information for the content;

a first determining mechanism configured to determine that the structured name included in the packet is within the namespace specified in the routing policy;

a second determining mechanism configure to determine that the packet satisfies the condition in the routing policy; and

a routing mechanism configured to route the packet based on in part the action corresponding to the condition as specified in the routing policy.

11. The apparatus of claim 10, wherein while determining that the structured name included in the packet is within the namespace specified in the routing policy, the first determining mechanism is further configured to use a longest name match policy to match the structured name against the namespace.

12. The apparatus of claim 10, wherein while routing the packet, the routing mechanism is configured to perform one or more of the following operations:

dropping content packets, thereby preventing creation of content with a certain name;

dropping interest packets, thereby preventing interests from circulating;

forwarding the packet to another node;

copying or redirect the packet;

deferring action on the packet; and

applying a default policy when no conditions match.

13. The apparatus of claim 10, wherein while determining that the packet satisfies the condition, the determining mechanism is further configured to match one or more of:

an identity of a signer of the content by using a public key;

a credential held by a signer of the content;

an identity of a node generating an interest by using a public key;

a network interface on which the packet arrived; and

a network address indicating where the packet is originated or destined.

14. The apparatus of claim 10, further comprising an automatic retrieval mechanism configured to automatically retrieve keys and credential information (from the CCN) to check policy compliance.

15. The apparatus of claim 10, further comprising:

a dynamic retrieval mechanism, configured to dynamically retrieve the policy from the CCN; and

a dynamic updating mechanism, configured to dynamically update the policy.

16. The apparatus of claim 10, further comprising a denial-of-service defeating mechanism configured to defeat a denial-of-service attack against a policy enforcement system by greylisting public keys associated with content publishers so that automatic retrieval of the keys is deferred.

17. The apparatus of claim 10, further comprising propagating the routing policy to an upstream node, whereby the upstream node can optionally enforce the routing policy and filter content.

18. A computer-readable storage device storing instructions that when executed by a computer cause the computer to perform a method for controlling the spread of interests and content in a content centric network (CCN), the method comprising:

maintaining a routing policy for content data,

wherein the routing policy specifies a namespace, a condition, and a routing action corresponding to the condition;

wherein the namespace corresponds to one or more structured names and includes at least part of a content name which can be used to match content with a more specific name that falls logically within the scope of the name space;

wherein a respective structured name is unique and persistent with respect to certain content; and

wherein the condition specifies when the routing action can be taken upon receipt of data packets associated with the namespace;

receiving a packet associated with a piece of content or an interest for the content;

wherein the content is identified by a structured name; and

wherein the structured name in the packet includes authentication information for the content;

determining that the structured name included in the packet is within the namespace specified in the routing policy; and

determining that the packet satisfies the condition in the routing policy; and

routing the packet based on in part the action corresponding to the condition as specified in the routing policy.

19. The storage device of claim 18, wherein determining that the structured name included in the packet is within the namespace specified in the routing policy comprises using a longest name match policy to match the structured name against the namespace.

20. The storage device of claim 18, wherein routing the packet comprises one or more of:

dropping content packets, thereby preventing creation of content with a certain name;

dropping interest packets, thereby preventing interests from circulating;

forwarding the packet to another node;

copying or redirecting the packet;

deferring action on the packet; and

applying a default policy when no conditions match.

21. The storage device of claim 18, wherein determining that the packet satisfies the condition comprises matching one or more of:

an identity of a signer of the content by using a public key;

a credential held by a signer of the content;

an identity of a node generating an interest by using a public key;

a network interface on which the packet arrived; and

a network address indicating where the packet is originated or destined.

22. The storage device of claim 18, wherein the method further comprises automatically retrieving keys and credential information (from the CCN) to check policy compliance.

23. The storage device of claim 18, wherein the method further comprises stochastically verifying the routing policy by router nodes, thus enabling an overall expected level of policy compliance and verification.

24. The storage device of claim 18, further comprising:

dynamically retrieving the policy from the CCN; and

dynamically updating the policy.

25. The storage of claim 18, further comprising defeating a denial-of-service attack against a policy enforcement system by greylisting public keys associated with content publishers so that automatic retrieval of the keys is deferred.