Cache Privacy Research Articles

Detection and Mitigation of Cache Pollution Attack Using Popularity Variation in Information Centric Networking Based on SDN

Information centric networking (ICN) is the next generation of internet architecture with its ability to provide in-network caching that make users retrieve their data efficiently regardless of their location. In ICN, security is applied to data itself rather than communication channels or devices. In-network caches are vulnerable to many types of attacks, such as cache poisoning attacks, cache privacy attacks, and cache pollution attacks (CPA). An attacker floods non-popular content to the network and makes the caches evict popular ones. As a result, the cache hit ratio for legitimate users will suffer from a performance degradation and an increase in the content’s retrieval latency. In this paper, a popularity variation mechanism in a CCN-SDN environment (PV-CSDN) is proposed to detect and mitigate CPA. PV-CSDN is based on observing the behavior of legitimate users to learn the normal traffic pattern and record the required threshold values. Two key parameters are used to achieve the threshold values: the popularity of the contents and the average rate of repeated requests for each interface in the router. The current traffic pattern will be compared with the predefined thresholds and if any variation in the traffic is occurred the attack is detected. The algorithm was able to detect the attack, and as a mitigation process, the controller will block the malicious interface to prevent any further degradation in the performance. The experiments show that PV-CSD detects and prevents the attack effectively.

A Survey on Security Attacks and Intrusion Detection Mechanisms in Named Data Networking

Despite the highly secure content sharing and the optimized forwarding mechanism, the content delivery in a Named Data Network (NDN) still suffers from numerous vulnerabilities that can be exploited to reduce the efficiency of such architecture. Malicious attacks in NDN have become more sophisticated and the foremost challenge is to identify unknown and obfuscated malware, as the malware authors use different evasion techniques for information concealing to prevent detection by an Intrusion Detection System (IDS). For the most part, NDN faces immense negative impacts from attacks such as Cache Pollution Attacks (CPA), Cache Privacy Attacks, Cache Poisoning Attacks, and Interest Flooding Attacks (IFA), that target different security components, including availability, integrity, and confidentiality. This poses a critical challenge to the design of IDS in NDN. This paper provides the latest taxonomy, together with a review of the significant research works on IDSs up to the present time, and a classification of the proposed systems according to the taxonomy. It provides a structured and comprehensive overview of the existing IDSs so that a researcher can create an even better mechanism for the previously mentioned attacks. This paper discusses the limits of the techniques applied to design IDSs with recent findings that can be further exploited in order to optimize those detection and mitigation mechanisms.

A Countermeasure Approach for Brute-Force Timing Attacks on Cache Privacy in Named Data Networking Architectures

One key feature of named data networks (NDN) is supporting in-network caching to increase the content distribution for today’s Internet needs. However, previously cached contents may be threatened by side-channel timing measurements/attacks. For example, one adversary can identify previously cached contents by distinguishing between uncached and cached contents from the in-network caching node, namely the edge NDN router. The attacks can be mitigated by the previously proposed methods effectively. However, these countermeasures may be against the NDN paradigm, affecting the content distribution performance. This work studied the side-channel timing attack on streaming over NDN applications and proposed a capable approach to mitigate it. Firstly, a recent side-channel timing attack, designated by brute-force, was implemented on ndnSIM using the AT&T network topology. Then, a multi-level countermeasure method, designated by detection and defense (DaD), is proposed to mitigate this attack. Simulation results showed that DaD distinguishes between legitimate and adversary nodes. During the attack, the proposed DaD multi-level approach achieved the minimum cache hit ratio (≈0.7%) compared to traditional countermeasures (≈4.1% in probabilistic and ≈3.7% in freshness) without compromising legitimate requests.

Security Attacks in Named Data Networking: A Review and Research Directions

Contents such as audios, videos, and images, contribute most of the Internet traffic in the current paradigm. Secure content sharing is a tedious issue. The existing security solutions do not secure data but secure the communicating endpoints. Named data networking (NDN) secures the data by enforcing the data publisher to sign the data. Any user can verify the data by using the public key of the publisher. NDN is resilient to most of the probable security attacks in the TCP/IP model due to its new architecture. However, new types of attacks are possible in NDN. This article surveys the most significant security attacks in NDN such as interest flooding attacks, cache privacy attacks, cache pollution attacks, and content poisoning attacks. Each attack is classified according to their behavior and discussed for their detection techniques, countermeasures, and the affected parameters. The article is an attempt to help new researchers in this area to gather the domain knowledge of NDN. The article also provides open research issues that could be addressed by researchers.

A Cache Privacy Protection Mechanism based on Dynamic Address Mapping in Named Data Networking

A Cache Privacy Protection Mechanism based on Dynamic Address Mapping in Named Data Networking

A Triggered Delay-based Approach against Cache Privacy Attack in NDN

Content caching is one of the most significant features of Named Data Networking (NDN) that improves the performance. However, this feature makes the cache vulnerable to attacks that determine the recent cache access pattern. In cache privacy attack, an attacker can probe request and determine if the received content is cached or not, by simply observing the time difference between the requested and the received data. Existing solutions apply delay whenever the data is accessed from the cache. These approaches mitigate attack to some extent but compromise the performance of NDN. To overcome this issue, a counter scheme has been proposed in this article that detects the attack pattern at the gateway router itself and triggers the countermeasure in case of attack. The triggered-based approach delays the data accessed from the cache, only when the attack is detected instead of each time when the data is accessed from the cache. The proposed approach has been compared with an approach that induces a random delay in case of the cache hit. The results prove that the triggered delay-based approach is better than the random delay approach in terms of average delay.

A Triggered Delay-based Approach against Cache Privacy Attack in NDN

A Triggered Delay-based Approach against Cache Privacy Attack in NDN

Protecting User Privacy in a Multi-Path Information-Centric Network Using Multiple Random-Caches

In-network caching is a fundamental mechanism advocated by information-centric networks (ICNs) for efficient content delivery. However, this new mechanism also brings serious privacy risks due to cache snooping attacks. One effective solution to this problem is random-cache, where the cache in a router randomly mimics a cache hit or a cache miss for each content request/probe. In this paper, we investigate the effectiveness of using multiple random-caches to protect cache privacy in a multi-path ICN. We propose models for characterizing the privacy of multi-path ICNs with random-caches, and analyze two different attack scenarios: 1) prefix-based attacks and 2) suffix-based attacks. Both homogeneous and heterogeneous caches are considered. Our analysis shows that in a multi-path ICN an adversary can potentially gain more privacy information by adopting prefix-based attacks. Furthermore, heterogeneous caches provide much better privacy protection than homogeneous ones under both attacks. The effect of different parameters on the privacy of multi-path random-caches is further investigated, and the comparison with its single-path counterpart is carried out based on numerical evaluations. The analysis and results in this paper provide insights in designing and evaluating multi-path ICNs when we take privacy into consideration.

Privacy-Aware Multipath Video Caching for Content-Centric Networks

The prevalence of Internet video streaming challenges the design and operation of modern networks. Content centric networking (CCN) has been proposed to address the challenges through ubiquitous in-network caching. While the expected benefits include higher performance and lower bandwidth consumption, CCN introduces new privacy issues at layer 3. This is because adversaries could infer the content consumed by others by checking cached data in routers. In this paper, we first analyze the design space to improve both caching performance and cache privacy for video delivery in CCN. In light of the observation that these two metrics need to be balanced, we propose CodingCache. It adopts network coding and random forwarding to exploit the potentials of multipath routing in CCN to improve both the diversity of cached content along different paths and the anonymity set for consumers. We evaluate CodingCache through extensive experiments based on a real-world topology and a unique data set of video access logs from a large-scale commercial video service. Our results demonstrate that, compared with the existing CCN strategies, CodingCache is able to increase the cache hit rate while also improve the use of caches across the network, together with reasonable cache privacy.