Introduction to Information Centric Networking

Transcription

1 Introduction to Information Centric Networking... with a Dash of Security Claudio Marxer <claudio.marxer@unibas.ch> Computer Networks Group University of Basel Switzerland Open Source IoT & Blockchain Hackathon, Berlin January 18,

2 Historic Perspective Past: Circuit-Centric Path s: You say how to contact... Present: Host-Centric Host/Location s: You say who to contact... Future: Information-Centric (?) Information/Content s: /the/content/name You say what you want to receive... 2

3 Outline ICN & Friends - Jungle of Abrevs (ICN, CCN, CICN, CCNx, NDN,... ) - Content Centric Networking Naming Scheme Packet Types Node Model Data Security in a Location-Agnostic World - Mindset: Content-Based Security - Some Mechanisms Access Control / Confidentiality Authenticity & Integrity 3

4 Through the Jungle of Abrevs Research Field & Architecture Paradigm: Information Centric Networking Network Service: lookup( <content-id> ) ICN Recent ICN Flavour: Content Centric Networking Naming Scheme, Packet Types, Node Model,... CCN CCN Derivates: Wire Formats, Running Code, NDN CICN CCNx 4

5 CCN Naming Scheme /this/name/has/five/components com / org this Hierarchical space Human-Readable... people ietf rfc wikipedia... name has Publisher owns a Domain (i.e. Prefix) - /org/ietf - /org/ietf/rfc 7945 five components 5

6 CCN Packet Types Content Object Interest Type: Content Object /org/ietf/rfc/7945 Payload 0x00 0x01 0x02 0x03 0x04... Type: Interest /org/ietf/rfc/7945 Meta-Info, Security... Meta-Info, Security... - Unique and unchangeable binding of a name and content - Container for a chunk of content - Location-independent and self-containing - Semantics: Sender expresses interest in receiving the named content object - Interface to the network: lookup(/some/content) 6

7 CCN Packet Types (2) 1 Type: Interest /org/ietf/rfc/7945 CCN Type: Content Object /org/ietf/rfc/7945 Payload 0x00 0x01 0x Communication pattern: pull-based, consumer-driven, flow-balanced. 7

8 CCN {Information, Data,,...} Centric World First-Class Citizens: -Payload-Signature Bundles Following: Internal Rules of this World 8

9 CCN Node Model (1) (or how the network satisfies an interest) A CCN relay maintains... Faces: Links to adacent nodes (e.g. via UDP, wifi, ethernet, bluetooth) Content Store (CS) Content object cache Forwarding Information Base (FIB) -prefix-based forwarding rules Pending Interest Table (PIT) Tracking interests from adjacent nodes Content Store Forwd Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/7945 9

10 CCN Node Model (2) (or how the network satisfies an interest) Incoming Interest Pipeline Forward Interest Interest Content Store Match? Matching PIT Entry? Matching Forwarding Rule? Content Object PIT Aggreg. Drop (NACK) Add to PIT Incoming FaceID 10

11 Example 1: Content Store Hit Type: Interest Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/

12 Example 1: Content Store Hit Type: Interest Internal State Incomming Interest Pipeline Content Store Match? Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/

13 Example 1: Content Store Hit Type: Interest Internal State Incomming Interest Pipeline Content Store Match? Satisfy interest from CS Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/

14 Example 1: Content Store Hit Type: Interest Internal State Incomming Interest Pipeline Content Store Match? Satisfy interest from CS Type: Content Object Payload 0x21 0xf6 0x93.. Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/

15 Example 2: PIT Aggregation Type: Interest /doc/blue Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/

16 Example 2: PIT Aggregation Type: Interest /doc/blue Incomming Interest Pipeline Content Store Match? Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/

17 Example 2: PIT Aggregation Type: Interest /doc/blue Incomming Interest Pipeline Content Store Match? Matching PIT Entry? Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue /org/ietf/

18 Example 2: PIT Aggregation Type: Interest /doc/blue Incomming Interest Pipeline Content Store Match? Matching PIT Entry? PIT Aggregation Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/

19 Example 2: PIT Aggregation Type: Interest /doc/blue Incomming Interest Pipeline Content Store Match? Matching PIT Entry? PIT Aggregation Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/

20 Example 3: Interest Forwarding Type: Interest /doc/purple Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/

21 Example 3: Interest Forwarding Type: Interest /doc/purple Internal State Incomming Interest Pipeline Content Store Match? Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/

22 Example 3: Interest Forwarding Type: Interest /doc/purple Internal State Incomming Interest Pipeline Content Store Match? Matching PIT Entry? Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/

23 Example 3: Interest Forwarding Type: Interest /doc/purple Internal State Incomming Interest Pipeline Content Store Match? Matching PIT Entry? Matching Forwarding Rule? Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/

24 Example 3: Interest Forwarding Type: Interest /doc/purple Internal State Incomming Interest Pipeline Content Store Match? Matching PIT Entry? Matching Forwarding Rule? Foward Type: Interest /doc/purple Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/7945 /doc/purple 13

25 Example 3: Interest Forwarding Type: Interest /doc/purple Internal State Incomming Interest Pipeline Content Store Match? Matching PIT Entry? Matching Forwarding Rule? Foward Add PIT Entry Type: Interest /doc/purple Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/7945 /doc/purple 13

26 CCN Node Model (3) (or how the network satisfies an interest) Incoming Content Pipeline Content Object PIT Entry? Backward (+ erase PIT entry) Content Object Add to Content Store Drop drop 14

27 Example 4: Content Backwarding Type: Content Object /doc/purple Payload 0x99 0xd4 0x9f.. Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/7945 /doc/purple 15

28 Example 4: Content Backwarding Type: Content Object /doc/purple Payload 0x99 0xd4 0x9f.. Incomming Content Pipeline Existing PIT Entry? Internal State Content Store Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/7945 /doc/purple 15

29 Example 4: Content Backwarding Type: Content Object /doc/purple Payload 0x99 0xd4 0x9f.. Incomming Content Pipeline Existing PIT Entry? Add to Content Store Internal State Content Store /doc/purple Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/7945 /doc/purple 15

30 Example 4: Content Backwarding Type: Content Object /doc/purple Payload 0x99 0xd4 0x9f.. Incomming Content Pipeline Existing PIT Entry? Add to Content Store Backward according to PIT Internal State Content Store /doc/purple Forwarding Info Base /doc /org/ietf Type: Content Object /doc/purple Payload 0x99 0xd4 0x9f.. Pending Interest Table /doc/blue, /org/ietf/7945 /doc/purple 15

31 Example 4: Content Backwarding Type: Content Object /doc/purple Payload 0x99 0xd4 0x9f.. Incomming Content Pipeline Existing PIT Entry? Add to Content Store Backward according to PIT Erase PIT Entry Type: Content Object /doc/purple Payload 0x99 0xd4 0x9f.. Internal State Content Store /doc/purple Forwarding Info Base /doc /org/ietf Pending Interest Table /doc/blue, /org/ietf/7945 /doc/purple 15

32 CCN in Action.. 1 A bob 2 3 repository /doc/blue B alice charly repository 16

33 CCN in Action.. bob FIB /doc 1 FIB /doc 2 FIB /doc /doc/blue f4 3 A repository B alice charly repository 16

34 CCN in Action.. bob 1 PIT PIT,f4 f4 3 A repository 2 B alice charly repository 16

35 CCN in Action.. bob PIT 1 PIT 2 PIT Aggregation PIT,f4 f4 3 A repository B alice charly repository 16

36 CCN in Action.. bob PIT 1 PIT 2 PIT,f4 f4 3 A repository B alice charly repository 16

37 CCN in Action.. bob 1 2 f4 3 A repository B alice charly repository 16

38 CCN in Action.. bob 1 f4 3 A repository 2 B alice charly repository 16

39 CCN in Action.. bob 1 f4 3 A repository 2 Cache Hit B alice charly repository 16

40 CCN in Action.. bob /doc/blue 1 /doc/blue Longest-Prefix Forwarding FIB /doc /doc/blue f4 3 /doc/blue A repository 2 B alice charly repository 16

41 CCN in Action.. bob /doc/blue 1 /doc/blue f4 3 /doc/blue A repository 2 B alice charly repository 16

42 Wrap Your Mind: Security in a Channel-Less World Protection and trust [should] travel with the content itself rather than being a property of the connections over which it travels. (Smetters & Jacobson, 2009) Host-Centric World: Unsecured data travels through secured connections. Transport Layer Security (TLS) Information-Centric World: Secured data is delivered by an untrusted network. Content-Based Security 17

43 Content-Based Access-Control / Confidentiality CCN /the/content/name 1 Two-step approach: 2 Symmentrically Encrypted Content is symmetrically encrypted (Data Encryption Key, DEK) Authorized clients: DEKs are provided separately - Identification: Public Key 4 /the/key/<pubkey> Asymmetrically Encrypted DEK 3 5 Access DEK 6 Access Content 18

44 Authenticity/Integrity of Location-Independent Content Approach: Publisher attaches a digital signature to each content object. Signing-authority policy framework: Publisher can own domains in the namespace Owner exclusively holds signing authority in his domain Ownership of sub-domains can be granted Challenge: Assessing authority of signing keys. Type: Content Object /org/ietf/rfc/7945 Payload 0x00 0x01 0x02 0x03 0x04... Digital Signature 0xA1 0xB2 0xC3 0xD4 0xE5... Signing Key /org/ietf/rfc/signingkey 19

45 Authenticity/Integrity of Location-Independent Content Approach: Publisher attaches a digital signature to each content object. Signing-authority policy framework: / Publisher can own domains in the namespace Owner exclusively holds signing authority in his domain Ownership of sub-domains can be granted com... ietf org wikipedia this name Challenge: Assessing authority of signing keys. people rfc has components 19

46 Authenticity/Integrity: Signing Key Chain /org/signingkey Payload <public key> pre-shared /org/ietf/signingkey Payload <public key> Digital Signature 0xF2 0x43 0x4C 0x0B Signing Key /org/signingkey /org/ietf/rfc/signingkey Payload <public key> Digital Signature 0x1C 0x2B 0xFF 0x9D Signing Key /org/ietf/signingkey sign /org/ietf/rfc/7945.txt Payload 0x13 0xFC 0x79 0x45... Digital Signature 0xA1 0xB2 0xC3 0xD4 refer Signing Key /org/ietf/rfc/signingkey 20

47 Wrap-Up Information-Centric Networking (Paradigm): Data as the pivotal entity Content-Centric Networking (Architecture): - Network Service to Consumer: Pull-Based Content Retrieval (interest-based) - Network Service to Publisher: Scalable Content Distribution: Multicasting due to PIT Aggregation & Caching - Network State & Mechanics: CS (in-network caching), FIB (name-based forwarding), PIT (forwarding state); Interest & Content Object Pipelines Content-Based Security: Secure Content, not Connections. 21

48 Q & A

49 Further Reading Information-Centric Networking IRTF Research Group: ACM ICN Conference: Content-Centric Networking V. Jacobson et al., Networking d Content in International Conference on Emerging Networking Experiments and Technologies, d Data Networking Project: Community ICN (CICN) Project: CCN-Lite (Relay): PiCN (Toolbox): 23