Efficient Content Verification in Nam ed Data Netw orking 2015. 10. - - PowerPoint PPT Presentation

efficient content verification in nam ed data netw orking
SMART_READER_LITE
LIVE PREVIEW

Efficient Content Verification in Nam ed Data Netw orking 2015. 10. - - PowerPoint PPT Presentation

Efficient Content Verification in Nam ed Data Netw orking 2015. 10. 2. Dohyung Kim 1 , Sunwook Nam 2 , Jun Bi 3 , Ikjun Yeom 1 mr.dhkim@gmail.com 1 Sungkyunkwan University 2 Korea Financial Telecommunications and Clearing Institute 3 singhua


slide-1
SLIDE 1

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficient Content Verification in Nam ed Data Netw orking

  • 2015. 10. 2.

Dohyung Kim1, Sunwook Nam2, Jun Bi3, Ikjun Yeom1 mr.dhkim@gmail.com

1Sungkyunkwan University 2Korea Financial Telecommunications and Clearing Institute 3singhua University

slide-2
SLIDE 2

2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)

  • Name-based consumer-driven content delivery

Request to Where  Request for What

I nternet

R2 R1

slide-3
SLIDE 3

2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)

  • Name-based consumer-driven content delivery

Request to Where  Request for What

I nternet

R2 R1

PIT entry is created at routers

Interest

slide-4
SLIDE 4

2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)

  • Name-based consumer-driven content delivery

Request to Where  Request for What

I nternet

R2 R1

  • PIT-based Content Delivery
  • In-network Caching

Response

slide-5
SLIDE 5

2nd ACM Conference on Information-Centric Networking in San Francisco

Nam ed Data Netw orking ( NDN)

  • Name-based consumer-driven content delivery

Request to Where  Request for What

I nternet

R2 R1

Interest

Content is served from in-network cache

slide-6
SLIDE 6

2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication

  • In IP networks

R1 R2

slide-7
SLIDE 7

2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication

  • In IP networks

End-to-end secure channel

R1 R2

slide-8
SLIDE 8

2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication

  • In IP networks
  • In NDN

End-to-end secure channel

R1 R2 R1 R2

slide-9
SLIDE 9

2nd ACM Conference on Information-Centric Networking in San Francisco

Secure Com m unication

  • In IP networks
  • In NDN

End-to-end secure channel

R1 R2 R1 R2

Content itself should be secure

slide-10
SLIDE 10

2nd ACM Conference on Information-Centric Networking in San Francisco

  • Fabricated content is placed in the content store

 Router compromise

Content Poisoning Attack

slide-11
SLIDE 11

2nd ACM Conference on Information-Centric Networking in San Francisco

  • Fabricated content is placed in the content store

 Router compromise  Injection from attackers’ server

Content Poisoning Attack

slide-12
SLIDE 12

2nd ACM Conference on Information-Centric Networking in San Francisco

  • Fabricated content is placed in the content store

 Router compromise  Injection from attackers’ server

Content Poisoning Attack

slide-13
SLIDE 13

2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack

  • Distribution of the fabricated content

I nternet

R2 R1

Poisoned content

slide-14
SLIDE 14

2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack

  • Distribution of the fabricated content

I nternet

R2 R1

Poisoned content

Interest

slide-15
SLIDE 15

2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack

  • Distribution of the fabricated content

I ntenet

R2 R1

  • Poisoned content is distributed

by the system itself

slide-16
SLIDE 16

2nd ACM Conference on Information-Centric Networking in San Francisco

Content Poisoning Attack

  • Distribution of the fabricated content

I ntenet

R2 R1

  • Poisoned content is distributed

by the system itself

  • Users are separated from

valid content sources

Interest

Not forwarded

Poisoned response

slide-17
SLIDE 17

2nd ACM Conference on Information-Centric Networking in San Francisco

NDN Content Verification

Signature verification

slide-18
SLIDE 18

2nd ACM Conference on Information-Centric Networking in San Francisco

NDN Content Verification

Signature verification incurs huge computational overhead

slide-19
SLIDE 19

2nd ACM Conference on Information-Centric Networking in San Francisco

Related W ork

  • Probabilistic caching
  • Bianchi, Giuseppe, et al. "Check before storing: What is the

performance price of content integrity verification in LRU caching?." ACM SIGCOMM Computer Communication Review 43.3 (2013): 59-67.

  • Verification overhead is controlled by caching probability
slide-20
SLIDE 20

2nd ACM Conference on Information-Centric Networking in San Francisco

Related W ork

  • Probabilistic caching
  • Bianchi, Giuseppe, et al. "Check before storing: What is the

performance price of content integrity verification in LRU caching?." ACM SIGCOMM Computer Communication Review 43.3 (2013): 59-67.

  • Verification overhead is controlled by caching probability
  • Limitation
  • Recency problem under dynamic content popularity
  • Limited application
  • Strongly bounded with random caching policy
slide-21
SLIDE 21

2nd ACM Conference on Information-Centric Networking in San Francisco

Motivations

  • Why do we verify even the content that is not actually

served?

slide-22
SLIDE 22

2nd ACM Conference on Information-Centric Networking in San Francisco

Motivations

  • Why do we verify even the content that is not actually

served?

  • ns-3 simulation for estimating the amount of serving contents

Cache hit rate Proportion of serving content in the CS

slide-23
SLIDE 23

2nd ACM Conference on Information-Centric Networking in San Francisco

Objective

  • Reduce verification overhead while preserving

functionality of the built-in signature verification

slide-24
SLIDE 24

2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Schem e

 Verify serving contents only

slide-25
SLIDE 25

2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Scheme

  • Verify Serving Contents Only
slide-26
SLIDE 26

2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Scheme

  • Verify Serving Contents Only
slide-27
SLIDE 27

2nd ACM Conference on Information-Centric Networking in San Francisco

Signature verification

The Proposed Scheme

  • Verify Serving Contents Only
slide-28
SLIDE 28

2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Scheme

  • Verify Serving Contents Only
  • In the proposed scheme, poisoned content is either
  • Evicted from the content store without any damages to the

network

  • Discarded by the verification mechanism before being brought
  • ut to the network
slide-29
SLIDE 29

2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Schem e

 Flag for the already verified content

C1Name

name data

C2Name … …

Content store structure

verify

True False

slide-30
SLIDE 30

2nd ACM Conference on Information-Centric Networking in San Francisco

The Proposed Schem e

 Favor the already-verified content in the content store

  • Segmented LRU prevents serving content from being evicted by

by-passing content in the content store

slide-31
SLIDE 31

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis

  • Efficiency metric
  • : the number of examined poisoned contents
  • : the number of verifications
slide-32
SLIDE 32

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis

  • In the basic scheme, corresponds to the proportion
  • f the requests for the poisoned contents,
slide-33
SLIDE 33

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis

  • In the basic scheme, corresponds to the proportion
  • f the requests for the poisoned contents,
  • In the proposed scheme,
  • is the request arriving rate
  • is the hit ratio for the unverified contents in the CS
slide-34
SLIDE 34

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis

  • Hit ratio for the unverified contents

Proportion of requests for content i

slide-35
SLIDE 35

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis

  • Hit ratio for the unverified contents

Cache-miss probability for the content i

slide-36
SLIDE 36

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis

  • Hit ratio for the unverified contents

Cache-hit probability for the content i

slide-37
SLIDE 37

2nd ACM Conference on Information-Centric Networking in San Francisco

Efficiency Analysis

  • Hit ratio for the unverified contents
  • According to Che approximation
  • is the size of CS, and t is the residing time in the CS

Cache-hit probability for the content i

slide-38
SLIDE 38

2nd ACM Conference on Information-Centric Networking in San Francisco

Analytic Results

  • without SLRU
slide-39
SLIDE 39

2nd ACM Conference on Information-Centric Networking in San Francisco

Analytic Results

  • with SLRU
slide-40
SLIDE 40

2nd ACM Conference on Information-Centric Networking in San Francisco

Analytic Results

  • In the proposed scheme without SLRU
  • In the proposed scheme with SLRU
  • When is close to 0, the proposed scheme achieve a 10
  • r 20 time larger value of
  • The value of is changed according to the amount of

poisoned content,

slide-41
SLIDE 41

2nd ACM Conference on Information-Centric Networking in San Francisco

Evaluation

  • Ns-3 simulation with
  • 106 Contents whose popularity follows Zipf-Mandelbrot

distribution function

  • youTube trace from UMASS Campus during Mar. 11-17 in 2008
slide-42
SLIDE 42

2nd ACM Conference on Information-Centric Networking in San Francisco

Results

  • Poisoned contents
slide-43
SLIDE 43

2nd ACM Conference on Information-Centric Networking in San Francisco

Results

  • Effect of Segm ented LRU
slide-44
SLIDE 44

2nd ACM Conference on Information-Centric Networking in San Francisco

Results

  • youTube Trace
slide-45
SLIDE 45

2nd ACM Conference on Information-Centric Networking in San Francisco

Results

  • youTube Trace
slide-46
SLIDE 46

2nd ACM Conference on Information-Centric Networking in San Francisco

Discussion

  • The access delay is increased due to the verification process
  • Limited to the first access to the content
slide-47
SLIDE 47

2nd ACM Conference on Information-Centric Networking in San Francisco

Discussion

  • The access delay is increased due to the verification process
  • Limited to the first access to the content
  • Multiple pending interests may distribute the poisoned content
  • Verification for the content that is matched with multiple

pending interests

slide-48
SLIDE 48

2nd ACM Conference on Information-Centric Networking in San Francisco

Discussion

  • The access delay is increased due to the verification process
  • Limited to the first access to the content
  • Multiple pending interests may distribute the poisoned content
  • Verification for the content that is matched with multiple

pending interests

  • Cache is attacked by using unverified data
  • Might show abnormal cache-hit pattern, that is, different value
  • f (Hit rate / amount of hit data)
slide-49
SLIDE 49

2nd ACM Conference on Information-Centric Networking in San Francisco

Conclusion

 We look at the content poisoning attack in NDN

  • Implementation and its effects
slide-50
SLIDE 50

2nd ACM Conference on Information-Centric Networking in San Francisco

Conclusion

 We look at the content poisoning attack in NDN

  • Implementation and its effects

 We present an efficient way to reduce overhead of content

verification at routers

  • Verification of the “serving content” only
slide-51
SLIDE 51

2nd ACM Conference on Information-Centric Networking in San Francisco

Conclusion

 We look at the content poisoning attack in NDN

  • Implementation and its effects

 We present an efficient way to reduce overhead of content

verification at routers

  • Verification of the “serving content” only

 We minimize verification overhead by favoring the serving contents

in the CS

  • Flag and Segmented LRU
slide-52
SLIDE 52

2nd ACM Conference on Information-Centric Networking in San Francisco

Q and A

Thank you