Method and system for name encryption agreement in a content centric network

• US 10,043,016 B2
• Filed: 02/29/2016
• Issued: 08/07/2018
• Est. Priority Date: 02/29/2016
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wood, Christopher A., Scott, Glenn C.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US15/056,904
• Publication Number:
  US 20170249468A1
• Time in Patent Office: 890 Days
• Field of Search: 713164-167, 713189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: H04L 2101/355 containing special suffixes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

One embodiment provides a system that facilitates efficient name encryption in a CCN. During operation, the system determines, by a client computing device, an index for a name of an interest, wherein the name is a hierarchically structured variable length identifier that includes contiguous name components ordered from a most general level to a most specific level, wherein the index indicates a minimum number of the contiguous name components beginning from the most general level that represent a minimum routable prefix needed to route the interest to a content producing device that can satisfy the interest. The system encrypts one or more name components of the interest name beginning with the name component immediately following the minimum routable prefix. The system transmits the interest based on the encrypted name, thereby facilitating efficient name encryption in a CCN.

Claims

1. A computer system for facilitating efficient name encryption, the system comprising:

a processor; and

a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising;

determining, by a client computing device, an index for a name of an interest, wherein the name is a hierarchically structured variable length identifier that includes a plurality of contiguous name components ordered from a most general level to a most specific level, wherein the index indicates a minimum number of name components of the plurality of contiguous name components beginning from the most general level that represent a minimum routable prefix needed to route the interest to a content producing device that can satisfy the interest;

encrypting one or more name components of the plurality of contiguous name components beginning with a first name component that immediately follows the minimum routable prefix to generate an encrypted name of the interest; and

transmitting the interest based on the encrypted name, thereby facilitating efficient name encryption in a content centric network.

2. The computer system of claim 1, wherein determining the index comprises:

generating a first probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level;

in response to receiving a first content object which indicates a positive response of the first probing interest, setting the index to a number of name components in the first probing interest name; and

in response to receiving a second content object which indicates a negative acknowledgment of the first probing interest, generating a second probing interest with a name that comprises the first probing interest name followed by a next contiguous name component of the interest name.

3. The computer system of claim 2, wherein the method further comprises determining that the first content object indicates a positive response of the first probing interest, which comprises:

determining that the first content object indicates that a receiving content producing device can return a content object based on the name components of the interest name as included in the first probing interest name; and

determining that a key identifier of the first content object matches a public key of the content producing device.

4. The computer system of claim 2, wherein the method further comprises:

appending a first random nonce to the first probing interest name; and

appending a second random nonce to the second probing interest name.

5. The computer system of claim 1, wherein determining the index further comprises:

determining a midpoint index of a number of name components in the interest name, wherein a lower portion of the interest name includes the name components from the most general level name component to the name component preceding the name component corresponding to the midpoint index, and wherein an upper portion of the interest name includes the name components from the name component following the name component corresponding to the midpoint index to the most specific level name component;

generating a first probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level name component to the name component corresponding to the midpoint index; and

in response to receiving a first content object which indicates a positive response of the first probing interest, setting the index to a number of name components in the first probing interest name.

6. The computer system of claim 5, wherein determining the index further comprises:

in response to receiving a second content object which indicates that a receiving content producing device can return a content object based on the name components of the interest name as included in the first probing interest, and in response to determining that a key identifier of the second content object is associated with a public key of the content producing device;

determining a lower midpoint index of the lower portion; and

generating a second probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level name component to a name component corresponding to the lower midpoint index; and

in response to receiving a third content object which indicates a negative acknowledgment of the first probing interest;

determining an upper midpoint index of the upper portion; and

generating a third probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level name component to a name component corresponding to the upper midpoint index.

7. The computer system of claim 5, wherein the method further comprises:

appending a first random nonce to the first probing interest name;

appending a second random nonce to the second probing interest name; and

;

appending a third random nonce to the third probing interest name.

8. The computer system of claim 1, wherein determining the index further comprises generating one or more probing interests based on a number of number components for the interest name and further based on one or more of:

a linear search;

a binary search; and

a number of collapsed name prefixes in a forwarding information base, wherein a collapsed name prefix indicates a plurality of name components with a same forwarding information in the forwarding information base.

9. The computer system of claim 1, wherein determining the index further comprises:

generating an initial interest for the index, wherein the initial interest is transmitted to a third party service and has a payload that includes the interest name and a public key of the third party service, wherein the payload of the initial interest is encrypted based on a public key of the client computing device, wherein the initial interest indicates the public key of the client computing device; and

in response to the initial interest, receiving an initial content object that has a payload that indicates the index, wherein the payload of the initial content object is encrypted based on the public key of the third party service.

10. The computer system of claim 1, wherein the interest name includes one or more nested and encrypted names suffixes, wherein a name suffix comprises one or more contiguous name components of the interest name, and wherein the method further comprises:

determining a second index for a nested and encrypted name suffix, wherein the second index indicates a minimum number of contiguous name components beginning from the most general level that represent a minimum routable prefix needed to route the interest to a content producing device that can satisfy a nested interest with a name which includes the nested and encrypted name suffix; and

encrypting the name components following the name components corresponding to the second index.

14. The method of claim 1, wherein determining the index further comprises:

determining a midpoint index of a number of name components in the interest name, wherein a lower portion of the interest name includes the name components from the most general level name component to the name component preceding the name component corresponding to the midpoint index, and wherein an upper portion of the interest name includes the name components from the name component following the name component corresponding to the midpoint index to the most specific level name component;

generating a first probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level name component to the name component corresponding to the midpoint index; and

in response to receiving a first content object which indicates a positive response of the first probing interest, setting the index to a number of name components in the first probing interest name.

15. The method of claim 14, wherein determining the index further comprises:

in response to receiving a second content object which indicates that a receiving content producing device can return a content object based on the name components of the interest name as included in the first probing interest, and in response to determining that a key identifier of the second content object is associated with a public key of the content producing device;

determining a lower midpoint index of the lower portion; and

generating a second probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level name component to a name component corresponding to the lower midpoint index;

in response to receiving a third content object which indicates a negative acknowledgment of the first probing interest;

determining an upper midpoint index of the upper portion; and

generating a third probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level name component to a name component corresponding to the upper midpoint index;

appending a first random nonce to the first probing interest name;

appending a second random nonce to the second probing interest name; and

;

appending a third random nonce to the third probing interest name.

11. A computer-implemented method for facilitating efficient name encryption, the method comprising:

determining, by a client computing device, an index for a name of an interest, wherein the name is a hierarchically structured variable length identifier that includes a plurality of contiguous name components ordered from a most general level to a most specific level, wherein the index indicates a minimum number of name components of the plurality of contiguous name components beginning from the most general level that represent a minimum routable prefix needed to route the interest to a content producing device that can satisfy the interest;

encrypting one or more name components of the plurality of contiguous name components beginning with a first name component that immediately follows the minimum routable prefix to generate an encrypted name of the interest; and

transmitting the interest based on the encrypted name, thereby facilitating efficient name encryption in a content centric network.

12. The method of claim 11, wherein determining the index comprises:

generating a first probing interest with a name that comprises one or more contiguous name components of the interest name beginning from the most general level;

in response to receiving a first content object which indicates a positive response of the first probing interest, setting the index to a number of name components in the first probing interest name;

in response to receiving a second content object which indicates a negative acknowledgment of the first probing interest, generating a second probing interest with a name that comprises the first probing interest name followed by a next contiguous name component of the interest name;

appending a first random nonce to the first probing interest name; and

appending a second random nonce to the second probing interest name.

13. The method of claim 12, further comprising determining that the first content object indicates a positive response of the first probing interest, which comprises:

determining that the first content object indicates that a receiving content producing device can return a content object based on the name components of the interest name as included in the first probing interest name; and

determining that a key identifier of the first content object matches a public key of the content producing device.

16. The method of claim 11, wherein determining the index further comprises generating one or more probing interests based on a number of number components for the interest name and further based on one or more of:

a linear search;

a binary search; and

a number of collapsed name prefixes in a forwarding information base, wherein a collapsed name prefix indicates a plurality of name components with a same forwarding information in the forwarding information base.

17. The method of claim 11, wherein determining the index further comprises:

generating an initial interest for the index, wherein the initial interest is transmitted to a third party service and has a payload that includes the interest name and a public key of the third party service, wherein the payload of the initial interest is encrypted based on a public key of the client computing device, wherein the initial interest indicates the public key of the client computing device; and

in response to the initial interest, receiving an initial content object that has a payload that indicates the index, wherein the payload of the initial content object is encrypted based on the public key of the third party service.

18. The method of claim 11, wherein the interest name includes one or more nested and encrypted names suffixes, wherein a name suffix comprises one or more contiguous name components of the interest name, and wherein the method further comprises:

determining a second index for a nested and encrypted name suffix, wherein the second index indicates a minimum number of contiguous name components beginning from the most general level that represent a minimum routable prefix needed to route the interest to a content producing device that can satisfy a nested interest with a name which includes the nested and encrypted name suffix; and

encrypting the name components following the name components corresponding to the second index.

19. A computer system for facilitating efficient content exchange, the system comprising:

a processor; and

a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising;

receiving, by a content-hosting device, a first interest with a name that is a hierarchically structured variable length identifier that includes contiguous name components ordered from a most general level to a most specific level, the name of the first interest including a minimum routable prefix needed to route the first interest to the content-hosting device that can satisfy the first interest, and wherein a random nonce is appended to the first interest name immediately following the minimum routable prefix;

in response to determining that the content-hosting device can return a content object based on the first interest name, generating a first content object which indicates a positive response; and

in response to determining that the content-hosting device cannot return a content object based on the first interest name, generating a second content object which indicates a negative acknowledgment of the first interest.

20. The computer system of claim 19, wherein the method further comprises:

receiving a second interest with a partially encrypted name that includes one or more encrypted name components;

decrypting the partially encrypted name for the second interest;

determining a second content object corresponding to the decrypted name for the second interest;

replacing, in the second content object, the decrypted name for the second interest with the partially encrypted name for the second interest; and

transmitting the second content object.