arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 1505.06258cs.NIcs.CR
收藏

内容中心网络的基于XML的访问控制(扩展版)

Interest-Based Access Control for Content Centric Networks (extended version)

Cesar Ghali, Marc A. Schlosberg, Gene Tsudik, Christopher A. Wood

摘要:

内容中心网络(CCN)是一种新兴的网络架构,旨在克服当前基于IP的互联网的局限性。CCN的基本原则之一是数据或内容是网络中的命名和可寻址实体。消费者通过发出具有所需内容名称的兴趣消息来请求内容。这些兴趣由路由器转发给生产者,并且所得到的内容对象被返回并且可选地在沿着路径的每个路由器处被缓存。网络内缓存使得难以对生产者之外的敏感内容实施访问控制策略,因为路由器仅使用兴趣信息来进行转发决策。为此,我们提出了一种基于XML的访问控制(IBAC)方案,该方案仅使用包含在兴趣消息中的信息来实现访问控制实施,即,通过使敏感内容名称对未授权方不可预测。我们的IBAC方案支持基于哈希和基于解析的名称混淆。我们通过制定生产者和消费者之间的相互信任框架,使路由器能够执行授权检查时,满足他们的缓存利益的兴趣重放攻击的问题。我们评估每个IBAC变体的计算,存储和带宽开销。我们的设计是灵活的,并允许生产者任意指定和执行任何类型的访问控制的内容,而不必处理的内容加密和密钥分发的问题。这是第一个仅使用兴趣消息中包含的信息的CCN接入控制的综合设计。

英文摘要:

Content-Centric Networking (CCN) is an emerging network architecture designed to overcome limitations of the current IP-based Internet. One of the fundamental tenets of CCN is that data, or content, is a named and addressable entity in the network. Consumers request content by issuing interest messages with the desired content name. These interests are forwarded by routers to producers, and the resulting content object is returned and optionally cached at each router along the path. In-network caching makes it difficult to enforce access control policies on sensitive content outside of the producer since routers only use interest information for forwarding decisions. To that end, we propose an Interest-Based Access Control (IBAC) scheme that enables access control enforcement using only information contained in interest messages, i.e., by making sensitive content names unpredictable to unauthorized parties. Our IBAC scheme supports both hash- and encryption-based name obfuscation. We address the problem of interest replay attacks by formulating a mutual trust framework between producers and consumers that enables routers to perform authorization checks when satisfying interests from their cache. We assess the computational, storage, and bandwidth overhead of each IBAC variant. Our design is flexible and allows producers to arbitrarily specify and enforce any type of access control on content, without having to deal with the problems of content encryption and key distribution. This is the first comprehensive design for CCN access control using only information contained in interest messages.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑