METHOD AND SYSTEM FOR MITIGATING INTEREST FLOODING ATTACKS IN CONTENT-CENTRIC NETWORKS

• US 20140351929A1
• Filed: 08/20/2013
• Published: 11/27/2014
• Est. Priority Date: 05/23/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Mahadevan, Priya, Uzun, Ersin, Afanasyev, Alexander
• Granted Patent: US 9,185,120 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

One embodiment of the present invention provides a system for mitigating interest flooding attacks in content-centric networks (CCNs). During operation, the system receives, at a physical interface of a router, an interest packet; obtains current interest satisfaction statistics associated with the physical interface; and determines whether to forward or drop the interest packet based on the current interest satisfaction statistics.

Claims

1. A method for mitigating interest flooding attacks in content-centric networks (CCNs), comprising:

receiving, at a physical interface of a router, an interest packet;

obtaining current interest satisfaction statistics associated with the physical interface; and

determining whether to forward or drop the interest packet based on the current interest satisfaction statistics.

2. The method of claim 1, wherein the interest satisfaction statistics associated with the physical interface further comprise at least one of:

per-interface based interest satisfaction statistics;

per-name-prefix-per-interface based interest satisfaction statistics;

per-face based interest satisfaction statistics;

per-name-prefix-per-face based interest satisfaction statistics;

per-virtual-interface based interest satisfaction statistics; and

per-name-prefix-per-virtual-interface based interest satisfaction statistics.

3. The method of claim 1, wherein the interest satisfaction statistics indicates a ratio between satisfied interest packets and received interest packets.

4. The method of claim 3, wherein determining whether to forward or drop the interest packet is based on the interest satisfaction statistics.

5. The method of claim 3, wherein determining whether to forward or drop the interest packet involves:

receiving, from a neighboring router, an outstanding interest limit announcement indicating a maximum number of interest packets acceptable by the neighboring router; and

assigning an outstanding interest limit for the physical interface based on the interest satisfaction statistics and the maximum number of the outstanding interest packets acceptable by the neighboring router, wherein an outstanding interest is an interest that is not satisfied an not yet expired.

6. The method of claim 1, wherein obtaining the current interest satisfaction statistics associated with the physical interface involves:

determining whether an interest packet has been satisfied by a corresponding data packet; and

determining whether an interest packet is removed from a pending interest table due to a timeout.

7. The method of claim 1, further comprising updating the interest satisfaction statistics subsequent to the interest packet being satisfied or expired.

8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for mitigating interest flooding attacks in content-centric networks (CCNs), the method comprising:

receiving, at a physical interface of a router, an interest packet;

obtaining current interest satisfaction statistics associated with the physical interface; and

determining whether to forward or drop the interest packet based on the current interest satisfaction statistics.

9. The computer-readable storage medium of claim 8, wherein the interest satisfaction statistics associated with the physical interface further comprise at least one of:

per-interface based interest satisfaction statistics;

per-name-prefix-per-interface based interest satisfaction statistics;

per-face based interest satisfaction statistics;

per-name-prefix-per-face based interest satisfaction statistics;

per-virtual-interface based interest satisfaction statistics; and

per-name-prefix-per-virtual-interface based interest satisfaction statistics.

10. The computer-readable storage medium of claim 8, wherein the indicates a ratio between satisfied interest packets and received interest packets.

11. The computer-readable storage medium of claim 10, wherein determining whether to forward or drop the interest packet is based on the interest satisfaction statistics.

12. The computer-readable storage medium of claim 10, wherein determining whether to forward or drop the interest packet involves:

receiving, from a neighboring router, an outstanding interest limit announcement indicating a maximum number of interest packets acceptable by the neighboring router; and

assigning an outstanding interest limit for the physical interface based on the interest satisfaction statistics and the maximum number of the outstanding interest packets acceptable by the neighboring router, wherein an outstanding interest is an interest that is not satisfied and not yet expired.

13. The computer-readable storage medium of claim 8, wherein obtaining the current interest satisfaction statistics associated with the physical interface involves:

determining whether an interest packet has been satisfied by a corresponding data packet; and

determining whether an interest packet is removed from a pending interest table due to a timeout.

14. The computer-readable storage medium of claim 8, wherein the method further comprises updating the interest satisfaction statistics subsequent to the interest packet being satisfied or expired.

15. A router in a content-centric network (CCN) for mitigating interest flooding attacks, comprising:

a physical interface for receiving an interest packet;

an interest satisfaction statistics calculator configured to calculate current interest satisfaction statistics associated with the physical interface; and

a determination mechanism configured to determine whether to forward or drop the interest packet based on the current interest satisfaction statistics.

16. The router of claim 15, wherein the interest satisfaction statistics associated with the physical interface further comprise at least one of:

per-interface based interest satisfaction statistics;

per-name-prefix-per-interface based interest satisfaction statistics;

per-face based interest satisfaction statistics;

per-name-prefix-per-face based interest satisfaction statistics;

per-virtual-interface based interest satisfaction statistics; and

per-name-prefix-per-virtual-interface based interest satisfaction statistics.

17. The router of claim 15, wherein the interest satisfaction statistics indicates a ratio between satisfied interest packets and received interest packets.

18. The router of claim 17, wherein the determination mechanism is configured to determine whether to forward or drop the interest packet based on the interest satisfaction statistics.

19. The router of claim 17, wherein while determining whether to forward or drop the interest packet, the determination mechanism is further configured to:

receive, from a neighboring router, an outstanding interest limit announcement indicating a maximum number of interest packets acceptable by the neighboring router; and

assign an outstanding interest limit for the physical interface based on the interest satisfaction statistics and the maximum number of the outstanding interest packets acceptable by the neighboring router, wherein an outstanding interest is an interest that is not satisfied and not yet expired.

20. The router of claim 19, wherein the interest limit announcement is included in one of:

a gossip protocol message;

a router control message; and

a router heartbeat message.

21. The router of claim 15, wherein the interest satisfaction statistics calculator is further configured to:

determine whether an interest packet has been satisfied by a corresponding data packet; and

determine whether an interest packet is removed from a pending interest table due to a timeout.

22. The router of claim 15, wherein the interest satisfaction statistics calculator is further configured to update the interest satisfaction statistics subsequent to the interest packet being satisfied or expired.