Key catalogs in a content centric network

• US 10,097,346 B2
• Filed: 12/09/2015
• Issued: 10/09/2018
• Est. Priority Date: 12/09/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wood, Christopher A., Scott, Glenn C.
• Primary Examiner(s): Moorthy, Aravind K
• Application Number:
  US14/964,423
• Publication Number:
  US 20170170955A1
• Time in Patent Office: 1,035 Days
• Field of Search: 380278, 380 44, 713168, 713171, 713176, 713180, 713181
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

One embodiment provides a system that facilitates efficient key retrieval by using key catalogs in a content centric network. During operation, the system generates, by a client computing device, a first interest for a key indicated in a signed key catalog. In response to receiving the key, the system verifies the received key by determining that a hash of the received key matches a hash of the key as indicated in the catalog based on a name for the received key. The system generates a second interest for a content object, wherein a name for the second interest includes a name prefix associated with the key as indicated in the catalog, wherein the first interest is transmitted before or concurrent with transmitting the second interest. In response to receiving the content object, the system verifies the received content object based on the key.

Claims

1. A computer system to facilitate key retrieval, comprising:

a processor;

a storage device coupled to the processor and storing instructions that when executed by a computer cause the computer to perform a method, the method comprising;

generating, by a client computing device, a first interest for a key indicated in a signed key catalog, wherein the key indicated in the signed key catalog is embedded within a key set such that a request for another key within the signed key catalog functions as the first interest, wherein the signed key catalog comprises a link to a chunked key stream partitioned based on a chunking protocol;

in response to receiving the key as a received key, verifying the received key by determining that a hash of the received key matches a hash of the key as indicated in the catalog based on a name for the received key;

generating a second interest for a content object, wherein a name for the second interest includes a name prefix associated with the key as indicated in the catalog, wherein the first interest is transmitted before or concurrent with transmitting the second interest; and

in response to receiving the content object, verifying the received content object based on the key.

2. The computer system of claim 1, wherein the method further comprises:

generating an initial interest for the signed key catalog, wherein the catalog is digitally signed with a private key of a content producing device of the catalog; and

in response to receiving the signed key catalog, verifying the signature based on a public key of the content producing device of the catalog.

3. The computer system of claim 1, wherein the catalog is a content object with a name that is a hierarchically structured variable length identifier which comprises contiguous name components ordered from a most general level to a most specific level.

4. The computer system of claim 1, wherein the catalog indicates a collection of key sets, wherein a key set indicates one or more keys based on a name prefix associated with a respective key, a name for the respective key, and a hash of the respective key.

5. The computer system of claim 1, wherein a name for the first interest includes a name for the first key as indicated in the catalog, and wherein the first interest indicates a hash restriction equal to a hash of the first key as indicated in the catalog.

6. The computer system of claim 1, wherein the method further comprises:

storing the received key in a data structure based on the name for the received key and a name prefix associated with the received key as indicated in the catalog.

7. The computer system of claim 1, wherein verifying the received content object further comprises obtaining the key from a data structure, which involves:

looking up in the catalog the name prefix included in the second interest to obtain the name of a corresponding key; and

looking up in the data structure the name of the corresponding key to obtain the corresponding key.

8. The computer system of claim 1, wherein the method further comprises:

storing, for each of one or more keys indicated in the catalog, in a data structure a mapping between a name prefix associated with a respective key, a name for the respective key, and a hash of the respective key.

9. The computer system of claim 8, wherein verifying the received content object further comprises obtaining the key from a data structure, which involves:

looking up in the data structure the name prefix included in the second interest and the name of the corresponding key to obtain the corresponding key.

10. A computer-implemented method to facilitate key retrieval, the method comprising:

generating, by a client computing device, a first interest for a key indicated in a signed key catalog, wherein the key indicated in the signed key catalog is embedded within a key set such that a request for another key within the signed key catalog functions as the first interest, wherein the signed key catalog comprises a link to a chunked key stream partitioned based on a chunking protocol;

in response to receiving the key as a received key, verifying the received key by determining that a hash of the received key matches a hash of the key as indicated in the catalog based on a name for the received key;

generating a second interest for a content object, wherein a name for the second interest includes a name prefix associated with the key as indicated in the catalog, wherein the first interest is transmitted before or concurrent with transmitting the second interest; and

in response to receiving the content object, verifying the received content object based on the key.

11. The method of claim 10, further comprising:

generating an initial interest for the signed key catalog, wherein the catalog is digitally signed with a private key of a content producing device of the catalog; and

in response to receiving the signed key catalog, verifying the signature based on a public key of the content producing device of the catalog.

12. The method of claim 10, wherein the catalog is a content object with a name that is a hierarchically structured variable length identifier which comprises contiguous name components ordered from a most general level to a most specific level.

13. The method of claim 10, wherein the catalog indicates a collection of key sets, wherein a key set indicates one or more keys based on a name prefix associated with a respective key, a name for the respective key, and a hash of the respective key.

14. The method of claim 10, wherein a name for the first interest includes a name for the first key as indicated in the catalog, and wherein the first interest indicates a hash restriction equal to a hash of the first key as indicated in the catalog.

15. The method of claim 10, further comprising:

storing the received key in a data structure based on the name for the received key and a name prefix associated with the received key as indicated in the catalog.

16. The method of claim 10, wherein verifying the received content object further comprises obtaining the key from a data structure, which involves:

looking up in the catalog the name prefix included in the second interest to obtain the name of a corresponding key; and

looking up in the data structure the name of the corresponding key to obtain the corresponding key.

17. The method of claim 10, further comprising:

storing, for each of one or more keys indicated in the catalog, in a data structure a mapping between a name prefix associated with a respective key, a name for the respective key, and a hash of the respective key.

18. The method of claim 17, wherein verifying the received content object further comprises obtaining the key from a data structure, which involves:

looking up in the data structure the name prefix included in the second interest and the name of the corresponding key to obtain the corresponding key.

19. A computer system to facilitate key retrieval, comprising:

a processor;

a storage device coupled to the processor and storing instructions that when executed by a computer cause the computer to perform a method, the method comprising creating, by a content producing device, a key catalog that indicates a collection of key sets, wherein a key set indicates one or more keys based on a name prefix associated with a respective key, a name for the respective key, and a hash of the respective key; and

producing a digital signature for the key catalog based on a private key of the content producing device of the catalog,

wherein a given key in the key catalog is embedded within a given key set such that a request for another key within the key catalog functions as a first interest in a content-centric network, and

wherein the signed key catalog comprises a link to a chunked key stream partitioned based on a chunking protocol.

20. The computer system of claim 19, wherein the method further comprises:

in response to receiving an interest for the digitally signed key catalog, transmitting the catalog to a client computing device.