Efficient Content Verification in Nam ed Data Netw orking 2015. 10. - PowerPoint PPT Presentation

Efficient Content Verification in Nam ed Data Netw orking 2015. 10. 2. Dohyung Kim 1 , Sunwook Nam 2 , Jun Bi 3 , Ikjun Yeom 1 mr.dhkim@gmail.com 1 Sungkyunkwan University 2 Korea Financial Telecommunications and Clearing Institute 3 singhua University 2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)  Name-based consumer-driven content delivery Request to Where  Request for What I nternet R2 R1 2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)  Name-based consumer-driven content delivery Request to Where  Request for What I nternet PIT entry is created R2 at routers R1 Interest 2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)  Name-based consumer-driven content delivery Request to Where  Request for What • PIT-based Content Delivery I nternet • In-network Caching Response R2 R1 2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)  Name-based consumer-driven content delivery Request to Where  Request for What Content is served from I nternet in-network cache R2 R1 Interest 2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication  In IP networks R2 R1 2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication  In IP networks R2 R1 End-to-end secure channel 2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication  In IP networks R2 R1 End-to-end secure channel  In NDN R2 R1 2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication  In IP networks R2 R1 End-to-end secure channel  In NDN R2 R1 Content itself should be secure 2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack  Fabricated content is placed in the content store  Router compromise 2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack  Fabricated content is placed in the content store  Router compromise  Injection from attackers’ server 2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack  Fabricated content is placed in the content store  Router compromise  Injection from attackers’ server 2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack  Distribution of the fabricated content Poisoned content I nternet R2 R1 2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack  Distribution of the fabricated content Poisoned content I nternet R2 R1 Interest 2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack  Distribution of the fabricated content • Poisoned content is distributed by the system itself I ntenet R2 R1 2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack  Distribution of the fabricated content • Poisoned content is distributed by the system itself I ntenet • Users are separated from valid content sources R2 R1 Not forwarded Poisoned response Interest 2nd ACM Conference on Information-Centric Networking in San Francisco

NDN Content Verification Signature verification 2nd ACM Conference on Information-Centric Networking in San Francisco

NDN Content Verification Signature verification incurs huge computational overhead 2nd ACM Conference on Information-Centric Networking in San Francisco

Related W ork  Probabilistic caching - Bianchi, Giuseppe, et al. "Check before storing: What is the performance price of content integrity verification in LRU caching?." ACM SIGCOMM Computer Communication Review 43.3 (2013): 59-67. - Verification overhead is controlled by caching probability 2nd ACM Conference on Information-Centric Networking in San Francisco

Related W ork  Probabilistic caching - Bianchi, Giuseppe, et al. "Check before storing: What is the performance price of content integrity verification in LRU caching?." ACM SIGCOMM Computer Communication Review 43.3 (2013): 59-67. - Verification overhead is controlled by caching probability  Limitation - Recency problem under dynamic content popularity - Limited application  Strongly bounded with random caching policy 2nd ACM Conference on Information-Centric Networking in San Francisco

Motivations  Why do we verify even the content that is not actually served ? 2nd ACM Conference on Information-Centric Networking in San Francisco

Motivations  Why do we verify even the content that is not actually served ?  ns-3 simulation for estimating the amount of serving contents Proportion of serving Cache hit rate content in the CS 2nd ACM Conference on Information-Centric Networking in San Francisco

Objective  Reduce verification overhead while preserving functionality of the built-in signature verification 2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Schem e  Verify serving contents only 2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Scheme - Verify Serving Contents Only 2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Scheme - Verify Serving Contents Only 2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Scheme - Verify Serving Contents Only Signature verification 2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Scheme - Verify Serving Contents Only  In the proposed scheme, poisoned content is either - Evicted from the content store without any damages to the network - Discarded by the verification mechanism before being brought out to the network 2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Schem e  Flag for the already verified content verify name data Content store False C1Name … structure … C2Name True 2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Schem e  Favor the already-verified content in the content store - Segmented LRU prevents serving content from being evicted by by-passing content in the content store 2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis  Efficiency metric - : the number of examined poisoned contents - : the number of verifications 2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis  In the basic scheme, corresponds to the proportion of the requests for the poisoned contents, 2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis  In the basic scheme, corresponds to the proportion of the requests for the poisoned contents,  In the proposed scheme, - is the request arriving rate - is the hit ratio for the unverified contents in the CS 2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis  Hit ratio for the unverified contents Proportion of requests for content i 2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis  Hit ratio for the unverified contents Cache-miss probability for the content i 2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis  Hit ratio for the unverified contents Cache-hit probability for the content i 2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis  Hit ratio for the unverified contents Cache-hit probability for the content i - According to Che approximation  is the size of CS, and t is the residing time in the CS 2nd ACM Conference on Information-Centric Networking in San Francisco

Analytic Results  without SLRU 2nd ACM Conference on Information-Centric Networking in San Francisco

Analytic Results  with SLRU 2nd ACM Conference on Information-Centric Networking in San Francisco

Analytic Results  In the proposed scheme without SLRU  In the proposed scheme with SLRU  When is close to 0, the proposed scheme achieve a 10 or 20 time larger value of  The value of is changed according to the amount of poisoned content, 2nd ACM Conference on Information-Centric Networking in San Francisco

Evaluation  Ns-3 simulation with - 10 6 Contents whose popularity follows Zipf-Mandelbrot distribution function - youTube trace from UMASS Campus during Mar. 11-17 in 2008 2nd ACM Conference on Information-Centric Networking in San Francisco

Results - Poisoned contents 2nd ACM Conference on Information-Centric Networking in San Francisco

Results - Effect of Segm ented LRU 2nd ACM Conference on Information-Centric Networking in San Francisco

Results - youTube Trace 2nd ACM Conference on Information-Centric Networking in San Francisco

Results - youTube Trace 2nd ACM Conference on Information-Centric Networking in San Francisco