Named data networking (NDN) is an emerging information-centric networking paradigm, in which the Internet of Things (IoT) achieves excellent scalability. Recent literature proposes the concept of NDN-IoT, which maximizes the expansion of IoT applications by deploying NDN in the IoT. In the NDN, the security is built into the network by embedding a public signature in each data package to verify the authenticity and integrity of the content. However, signature schemes in the NDN-IoT environment are facing several challenges, such as signing security challenge for resource-constrained IoT end devices (EDs) and verification efficiency challenge for NDN routers. This article mainly studies the data package authentication scheme in the package-level security mechanism. Based on mobile edge computing (MEC), an efficient certificateless group signature scheme featured with anonymity, unforgeability, traceability, and key escrow resilience is proposed. The regional and edge architecture is utilized to solve the device management problem of IoT, reducing the risks of content pollution attacks from the data source. By offloading signature pressure to MEC servers, the contradiction between heavy overhead and shortage of ED resources is avoided. Moreover, the verification efficiency in NDN router is much improved via batch verification in the proposed scheme. Both security analysis and experimental simulations show that the proposed MEC-based certificateless group signature scheme is provably secure and practical.

An Efficient Signature Scheme Based on Mobile Edge Computing in the NDN-IoT Environment

Network caching in named data networks (NDN) is essential for improving the potentialities of the conventional IP networking. The concept of network caching is necessary for achieving optimal bandwidth utilization and location independent data access during multipath data dissemination. However, network caching in NDN makes it highly vulnerable to security breaches such as access content packets violation, flooding or malicious injection of packets and content cache poisoning. In this paper, a dynamic forest of random subsets-based one-time signature-based capability enhancing security architecture (DFORS-CSA) is proposed for attaining distributed data authentication. This DFORS-CSA security architecture leverages the potential in exploring the access privileges of the packets disseminated in the network. It includes the capability through which the routes can perform authentication of packets forwarded in NDN. It supports a significant verification strategy through which the routers can ensure the packet timeliness for resolving the problems that get introduced through unsolicited packets exchanged during flooding-based denial of service attacks. The simulation experiments of the proposed DFORS-CSA is conducted using the open source CCNs platform and Planetlab simulator. The results of the proposed DFORS-CSA confirmed its predominance in minimizing overall delay and time incurred in the bit vector generation by 16.74 and 15.63%, excellent to the baseline approaches. The results of the proposed DFORS-CSA also conformed a mean improvement in the precision rate by 10.21%, true positive rate by 8.94% and F-measure by 7.62% with decreased false positive rate of 8.56%, during the process of detecting content cache poisoning attack.

Dynamic forest of random subsets-based one-time signature-based capability enhancing security architecture for named data networking

In recent times, distributed denial of service (DDoS) has been one of the most prevalent security threats in internet-enabled networks, with many internet of things (IoT) devices having been exploited to carry out attacks. Due to their inherent security flaws, the attacks seek to deplete the resources of the target network by flooding it with numerous spoofed requests from a distributed system. Research studies have demonstrated that a DDoS attack has a considerable impact on the target network resources and can result in an extended operational outage if not detected. The detection of DDoS attacks has been approached using a variety of methods. In this paper, a comprehensive survey of the methods used for DDoS attack detection on selected internet-enabled networks is presented. This survey aimed to provide a concise introductory reference for early researchers in the development and application of attack detection methodologies in IoT-based applications. Unlike other studies, a wide variety of methods, ranging from the traditional methods to machine and deep learning methods, were covered. These methods were classified based on their nature of operation, investigated as to their strengths and weaknesses, and then examined via several research studies which made use of each approach. In addition, attack scenarios and detection studies in emerging networks such as the internet of drones, routing protocol based IoT, and named data networking were also covered. Furthermore, technical challenges in each research study were identified. Finally, some remarks for enhancing the research studies were provided, and potential directions for future research were highlighted.

/pdf/ddos-attack-and-detection-methods-in-internet-enabled-3iy8f3cj.pdf

DDoS Attack and Detection Methods in Internet-Enabled Networks: Concept, Research Perspectives, and Challenges

The concept of network caching is determined to be the potential requirement of named data networks (NDN) for enhancing the capabilities of the traditional IP networking It is responsible for location independent data accesses and optimal bandwidth utilization in multi-path data dissemination However, the network caching process in NDN introduces security challenges such as content cache poisoning, malicious injection or flooding of the packets and violation in accessing content packets In this paper, an Improved Merkle Hash Tree-based one-time signature scheme for capability-enhanced security enforcing architecture (IMHT-OTSS-CSEA) is proposed for provisioning data authenticity in a distributed manner for leveraging the capabilities to inform the access privileges of the packets during the process of data dissemination It is proposed for permitting the routers to verify the forwarded packets’ authenticity in NDN It is capable in handling the issues that emerge from unsolicited packets during a flooding-based denial of service attacks by supporting the indispensable verification process in routers that confirms the timeliness of packets The simulation experiments conducted using the open source CCNs platform and Planetlab confirmed a significant mean reduction in delay of 1461%, superior to the benchmarked schemes It is identified to minimize the delay incurred in generating bit vectors by a average margin of 1306%, excellent to the baseline approaches It also confirmed a mean increase in the true positive rate of 542%, a mean increase in the precision rate of 604%, decrease in false positive rate of 682% and increase in F-measure of 562% compared to the baseline approaches in the context of detecting content cache pollution attack respectively

Varghese Jensy Babu

Papers

Improved Merkle Hash Tree-Based One-Time Signature Scheme for Capability-Enhanced Security Enforcing Architecture for Named Data Networking

Dynamic forest of random subsets-based one-time signature-based capability enhancing security architecture for named data networking