Information-centric networking (ICN) is a new communication paradigm that focuses on content retrieval from a network regardless of the storage location or physical representation of this content. In ICN, securing the content itself is much more important than securing the infrastructure or the endpoints. To achieve the security goals in this new paradigm, it is crucial to have a comprehensive understanding of ICN attacks, their classification, and proposed solutions. In this paper, we provide a survey of attacks unique to ICN architectures and other generic attacks that have an impact on ICN. It also provides a taxonomy of these attacks in ICN, which are classified into four main categories, i.e., naming, routing, caching, and other miscellaneous related attacks. Furthermore, this paper shows the relation between ICN attacks and unique ICN attributes, and that between ICN attacks and security requirements, i.e., confidentiality, integrity, availability, and privacy. Finally, this paper presents the severity levels of ICN attacks and discusses the existing ICN security solutions.

/pdf/a-survey-of-security-attacks-in-information-centric-490ss1ouvo.pdf

A Survey of Security Attacks in Information-Centric Networking

With the advent of content-centric networking (CCN) where contents can be cached on each CCN router, cache robustness will soon emerge as a serious concern for CCN deployment. Previous studies on cache pollution attacks only focus on a single cache server. The question of how caching will behave over a general caching network such as CCN under cache pollution attacks has never been answered. In this paper, we propose a novel scheme called CacheShield for enhancing cache robustness. CacheShield is simple, easy-to-deploy, and applicable to any popular cache replacement policy. CacheShield can effectively improve cache performance under normal circumstances, and more importantly, shield CCN routers from cache pollution attacks. Extensive simulations including trace-driven simulations demonstrate that CacheShield is effective for both CCN and today's cache servers. We also study the impact of cache pollution attacks on CCN and reveal several new observations on how different attack scenarios can affect cache hit ratios unexpectedly.

/pdf/enhancing-cache-robustness-for-content-centric-networking-3ijzve47cp.pdf

Enhancing cache robustness for content-centric networking

http://sprout.ics.uci.edu/projects/ndn/papers/ndn_cache_pollution.pdf

A lightweight mechanism for detection of cache pollution attacks in Named Data Networking

http://www.inf.fu-berlin.de/users/waehl/papers/interest-flooding-wsv-bdpts-13.pdf

Backscatter from the data plane - Threats to stability and security in information-centric network infrastructure

Methods and systems of authenticating electronic identification (ID) documents may provide for receiving a decryption key and an encrypted ID document from a certificate authority server at a mobile device, wherein the encrypted ID document includes a read only document having a photograph of an individual. Additionally, the decryption key may be applied to the encrypted ID document to obtain a decryption result in response to a display request. The decryption result can be output via a display of the mobile device, wherein the encrypted ID document can be sent to a challenge terminal if a challenge request is received.

Issuing, presenting and challenging mobile device identification documents

Proxy caching servers are widely deployed in today's Internet. While cooperation among proxy caches can significantly improve a network?s resilience to denial-of-service (DoS) attacks, lack of cooperation can transform such servers into viable DoS targets. In this paper, we investigate a class of pollution attacks that aim to degrade a proxy's caching capabilities, either by ruining the cache file locality, or by inducing false file locality. Using simulations, we propose and evaluate the effects of pollution attacks both in web and peer-to-peer (p2p) scenarios, and reveal dramatic variability in resilience to pollution among several cache replacement policies. We develop efficient methods to detect both false-locality and locality-disruption attacks, as well as a combination of the two. To achieve high scalability for a large number of clients/requests without sacrificing the detection accuracy, we leverage streaming computation techniques, i.e., bloom filters. Evaluation results from large-scale simulations show that these mechanisms are effective and efficient in detecting and mitigating such attacks. Furthermore, a Squid-based implementation demonstrates that our protection mechanism forces the attacker to launch extremely large distributed attacks in order to succeed.

/pdf/internet-cache-pollution-attacks-and-countermeasures-4wye6x9cvz.pdf

Internet Cache Pollution Attacks and Countermeasures

https://networks.cs.northwestern.edu/publications/cache_JCN.pdf

Pollution attacks and defenses for Internet caching systems

Systems and methods for pseudonymous public keys based authentication are described that enable an authentication to achieve pseudonymity and non-repudiation, for example, at the same time. Pseudonymity may provide, for example, that a user can show to different parties different digital identifiers for authentication instead of, for example, always using a single digital identifier everywhere, which may lead to a breach of privacy. Non-repudiation may provide, for example, that the authentication data at the server side can be used, for example, to verify a user's authentication request, but not to generate an authentication request, which might lead to user impersonation. A user may use a physical token to generate the authentication request corresponding to the user's identity to pass the authentication.

Pseudonymous public keys based authentication

An identity validation system and method for the Internet provides user accountability while supporting user privacy to counter SPAM, Internet vandalizers, and predators, as well as cyber bullies who use the Internet to communicate with actual or potential victims. The system includes network authority software that issues a permanent identity and secret code to a user and disseminates different hashed versions of the permanent identity and secret code to different agents. A user hardware Internet passport generates hashed versions of the permanent identity and secret code as well as a passcode that is generated from the hashed secret code and user software generates a temporary identity from the hashed permanent identity. The user software transmits the temporary identity and passcode to a selected agent that performs the actual identity validation.

User identity validation system and method

Measurement tools that can accurately locate and monitor congested Internet links would significantly help us understand how the Internet operates. However, developing such tools is challenging, especially when our concerned target is congestion on the core Internet links rather than that on the relatively easily measured access links. Congestion on core links - and persistent congestion in particular - can reveal systematic problems such as routing pathologies, poorly-engineered network policies, or non-cooperative inter-AS relationships. In this paper, we present Pong, a novel tool capable of accurately locating and monitoring a subset of non-access Internet links that exhibit persistent congestion over longer time scales. Pong takes advantage of the persistently congested link property to overcome the long-lasting challenges common for delay-based inference tools. In addition, it exploits the same property to (i) infer otherwise unknown underlying path conditions, (ii) determine appropriate queuing delay thresholds to reveal congestion, (iii) achieve high accuracy with low probing rate, and (iv) detect moments of its own inaccuracy. Finally, Pong can quantify measurement resultspsila accuracy comprehensively, allowing us to further select vantage points that maximize the observability of the underlying congestion.

/pdf/monitoring-persistently-congested-internet-links-1snnax8eh5.pdf

Leiwen Deng

Papers

Internet Cache Pollution Attacks and Countermeasures

Pollution attacks and defenses for Internet caching systems

Pseudonymous public keys based authentication

User identity validation system and method

Monitoring persistently congested Internet links