Security Bootstrapping for Securing Data Plane and Control Plane in Named Data Networking

Among several information-centric networking architectures envisioned thus far, named data networking (NDN) offers name-based forwarding, in-network caching, and content-based security. The original design of NDN security employs the PKI-based signature and encryption for content authenticity and access control. Several studies were conducted to reduce the computational complexity induced by the signatures and the number of message exchanges as well as to mitigate several denial-of-service attacks inherent in NDN. However, there exists no security bootstrapping method for securely distributing initial security parameters and cryptographic keys to each NDN entity, and the distribution was assumed to be performed out-of-band without any specifications. To address the design gap induced by the out-of-band method, this paper proposes a security architecture based on the consortium blockchain and bootstrapping procedures for NDN security. Based on this architecture, a symmetric-key-based authenticated encryption scheme is designed to replace the signature and public-key encryption, which can be applied to the data and control planes of the NDN. A (finite or infinite) one-way hash chain is employed to embed the source authentication functionality into the proposed scheme. The security of the proposed scheme is extensively analyzed under various adversarial scenarios, and its performance is evaluated and compared using mini-NDN. It is shown that the proposed scheme is a viable solution to enhance NDN security.