Content-based Security Research Articles

Security and Integrity Attacks in Named Data Networking: A Survey

The notion of Information-Centric Networking (ICN) specifies a new communication model that emphasis on the content exchanged rather than the devices connected. ICN architectures like Content Centric Network (CCN) and Named Data Networking (NDN) have been proposed to shift from host-centric based to content-centric based communication along and provide benefits to users in addressing the challenges of traditional IP networks. It differs from host-centric standard Internet Protocol (IP) networking in of naming, routing, forwarding, and caching characteristics. Naming features used in NDN use global unique names provided by content-based security and encryption. It ensures content integrity and authenticity as part of its design. In this paper, we survey on security aspects of NDN/CCN, discussing three integrity attacks such as replay attacks, Man-in-The-Middle (MiTM) attacks, and Content Poisoning Attack (CPA) with countermeasure against them. In addition, we highlight an open challenge and offer future research directions in the context of security.

Automatic Algorithm for Fractal Plant Art Image Similarity Feature Generation

With the popularity of smart devices and the Internet, the volume of multimedia data is growing rapidly, and content-based image retrieval (CBIR) can search for similar images from large-scale images to realize the utilization of the data. For data owners, outsourcing the management and maintenance of image data to cloud service providers can effectively reduce costs, but there is a privacy leakage problem. In this paper, we focus on image feature extraction, index design, and image similarity recognition methods under a dual server model with content-based image security similarity recognition as the research topic, the work done such as proposing a BOVW (Bag of Visual Word) feature-based image security similarity recognition scheme. The scheme combines SIFT (scale-invariant feature transform) feature secure extraction and locally sensitive hashing algorithm to achieve secure extraction of BOVW features of images. To protect the BOVW features of images, an inverted index based on word frequency division is designed, the index is stored in chunks, and an image secure similarity recognition scheme based on CNN (convolutional neural networks) features is proposed. The scalable hash index based on dimensional division is designed based on the image CNN features secure extraction algorithm. The security and performance of the proposed scheme are theoretically analyzed and experimentally verified. Based on different image datasets, the impact of different parameters on the performance of the scheme is tested, and optimized parameters are given. The experimental results show that the proposed scheme in this paper can effectively improve the efficiency of analyzing the similarity of plant botanical art images compared to the existing schemes.

Access Control Mechanisms in Named Data Networks

Information-Centric Networking (ICN) has recently emerged as a prominent candidate for the Future Internet Architecture (FIA) that addresses existing issues with the host-centric communication model of the current TCP/IP-based Internet. Named Data Networking (NDN) is one of the most recent and active ICN architectures that provides a clean-slate approach for Internet communication. NDN provides intrinsic content security where security is directly provided to the content instead of communication channel. Among other security aspects, Access Control (AC) rules specify the privileges for the entities that can access the content. In TCP/IP-based AC systems, due to the client-server communication model, the servers control which client can access a particular content. In contrast, ICN-based networks use content names to drive communication and decouple the content from its original location. This phenomenon leads to the loss of control over the content, causing different challenges for the realization of efficient AC mechanisms. To date, considerable efforts have been made to develop various AC mechanisms in NDN. In this article, we provide a detailed and comprehensive survey of the AC mechanisms in NDN. We follow a holistic approach towards AC in NDN where we first summarize the ICN paradigm, describe the changes from channel-based security to content-based security, and highlight different cryptographic algorithms and security protocols in NDN. We then classify the existing AC mechanisms into two main categories: Encryption-based AC and Encryption-independent AC . Each category has different classes based on the working principle of AC (e.g., Attribute-based AC, Name-based AC, Identity-based AC). Finally, we present the lessons learned from the existing AC mechanisms and identify the challenges of NDN-based AC at large, highlighting future research directions for the community.

A blockchain-based architecture for secure vehicular Named Data Networks

In vehicular networks, vehicles exchange a massive amount of information aiming at improving people’s safety. Most of this information is personal or sensitive in nature, which makes security and privacy indispensable tasks. Named Data Networking is a future Internet architecture that adopts content-based security and in-network caching features to improve content delivery. However, the use of Named Data Networking on top of vehicular networks brings various challenges, especially in security and trust levels. The use of the distributed and control-less in-network caching allows malicious users to use the built-in design to launch attacks at the cache-store. Moreover, a malicious node can serve invalid or unlimited Interests to start an Interest flooding attack. In this paper, we propose a reputation-based Blockchain mechanism to secure both of Interest and Data forwarding plane, and content caching. The simulation results exhibit that our solution forwards only valid Interest and caches only trust content.

Access Controls for IoT Networks

The message queuing telemetry transport (MQTT) protocol is becoming the main protocol for the internet of things (IoT). In this paper, we define a highly expressive attribute-based access control (ABAC) security model for the MQTT protocol. Our model allows us to regulate not only publications and subscriptions, but also distribution of messages to subscribers. We can express various types of contextual security rules (temporal security rules, content-based security rules, rules based on the frequency of events, etc.).

Fog-Computing-Enabled Cognitive Network Function Virtualization for an Information-Centric Future Internet

Information-centric networking (ICN) is an important trend that will impact the future of the Internet. ICN caters to large content consumption patterns while achieving high performance. New features in the information-centric future Internet, such as caching, name-based routing, and content-based security, bring novel challenges to a decentralized environment. On one hand, the processing capabilities on the edge in an information-centric future Internet need to implement smart analysis for large quantities of content. On the other hand, the computational and storage resources need to be configured and controlled on demand and based on cognition of the content from users. To address these challenges, this article proposes a fog-computing- enabled cognitive network functions virtualization approach for an information-centric future Internet. We first propose an on-demand caching function virtualization scheme and design a communication scheme between the fog nodes and the future Internet nodes for the forwarding process. Then, to attain smart control for related operations (i.e., routing, cache policy, and security), we propose a control function virtualization approach. Finally, a cognitive resource configuration mechanism is proposed. The simulation results show the advantages and efficiency of the proposed approach.

Content-based security and protected core networking with software-defined networks

Successful execution of future network-centric military operations relies on effective enforcement of both need-to-know and responsibility- to-share principles. In modern military missions and coalitions, which have an increasingly agile character, a promising solution is to enforce security policies based on the properties of individual information objects - we call this approach content-based security. This article discusses the enforcement of content-based security policies at the different layers of the TCP/ IP model, and introduces a proof-of-concept implementation of a content-based protection and release mechanism in a software-defined networking environment. Our aim is to provide consistent enforcement of security policies across multiple system layers and multiple security dimensions (confidentiality, integrity, and availability). The results of an analysis of a concrete example of a software-defined network emulated in Mininet are encouraging and confirm the effectiveness of our approach with respect to improving protection of data in transit. The work presented in this article offers a basis for further research in this area.

Information-centric networking for the internet of things: challenges and opportunities

In view of evolving the Internet infrastructure, ICN is promoting a communication model that is fundamentally different from the traditional IP address-centric model. The ICN approach consists of the retrieval of content by (unique) names, regardless of origin server location (i.e., IP address), application, and distribution channel, thus enabling in-network caching/replication and content-based security. The expected benefits in terms of improved data dissemination efficiency and robustness in challenging communication scenarios indicate the high potential of ICN as an innovative networking paradigm in the IoT domain. IoT is a challenging environment, mainly due to the high number of heterogeneous and potentially constrained networked devices, and unique and heavy traffic patterns. The application of ICN principles in such a context opens new opportunities, while requiring careful design choices. This article critically discusses potential ways toward this goal by surveying the current literature after presenting several possible motivations for the introduction of ICN in the context of IoT. Major challenges and opportunities are also highlighted, serving as guidelines for progress beyond the state of the art in this timely and increasingly relevant topic.

SNUAGE: an efficient platform-as-a-service security framework for the cloud

In this paper we present SNUAGE, a platform-as-a-service security framework for building secure and scalable multi-layered services based on the cloud computing model. SNUAGE ensures the authenticity, integrity, and confidentiality of data communication over the network links by creating a set of security associations between the data-bound components on the presentation layer and their respective data sources on the data persistence layer. SNUAGE encapsulates the security procedures, policies, and mechanisms in these security associations at the service development stage to form a collection of isolated and protected security domains. The secure communication among the entities in one security domain is governed and controlled by a standalone security processor and policy attached to this domain. This results into: (1) a safer data delivery mechanism that prevents security vulnerabilities in one domain from spreading to the other domains and controls the inter-domain information flow to protect the privacy of network data, (2) a reusable security framework that can be employed in existing platform-as-a-service environments and across diverse cloud computing service models, and (3) an increase in productivity and delivery of reliable and secure cloud computing services supported by a transparent programming model that relieves application developers from the intricate details of security programming. Last but not least, SNUAGE contributes to a major enhancement in the energy consumption and performance of supported cloud services by providing a suitable execution container in its protected security domains for a wide suite of energy- and performance-efficient cryptographic constructs such as those adopted by policy-driven and content-based security protocols. An energy analysis of the system shows, via real energy measurements, major savings in energy consumption on the consumer devices as well as on the cloud servers. Moreover, a sample implementation of the presented security framework is developed using Java and deployed and tested in a real cloud computing infrastructure using the Google App Engine service platform. Performance benchmarks show that the proposed framework provides a significant throughput enhancement compared to traditional network security protocols such as the Secure Sockets Layer and the Transport Layer Security protocols.