Secure Distribution of Protected Content in Information-Centric Networking
Muhammad Bilal Sangheon Pack
cs.NI cs.CR cs.DC C.2.0, C.2.2, C.2.4, K.6.5, K.6.m, D.4.6, K.4.2 C.2.0; C.2.2; C.2.4; K.6.5; K.6.m; D.4.6; K.4.2










Secure Distribution of Protected Content in Information-Centric Networking
    Muhammad Bilal, Member, IEEE,
Sangheon Pack, Senior Member, IEEE
This work is supported in part by the Hankuk University of Foreign Studies research funds for 2019 and in part by National Research Foundation (NRF) of Korea Grant funded by the Korean Government (MSIP) (No. 2017R1E1A1A01073742).   
Muhamamd Bilal is with Hankuk University of Foreign Studies, Yongin-si, Rep. of Korea. (email: m.bilal@ieee.org)
Sangheon Pack is with Korea University, Seoul, Rep. of Korea. (email: shpack@korea.ac.kr)
A preliminary version of this paper was presented at IEEE VTC 2018-Spring RAFNET Workshop, Porto, Portugal, June 2018 <cit.>.
    December 30, 2023
======================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================

[remember picture,overlay]
    [align=center,text=red] at ([yshift=1em]current page text area.north) This article is an  enhancement version of journal article published in IEEE Systems Journal, DOI: 10.1109/JSYST.2019.2931813;
    [align=center,text=blue] at ([yshift=-1em]current page text area.south) 1937-9234 © 2019 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.;
  





 The benefits of the ubiquitous caching in ICN are profound, such features make ICN promising for content distribution, but it also introduces a challenge to content protection against the unauthorized access. The protection of a content against unauthorized access requires consumer authentication and involves the conventional end-to-end encryption. However, in information-centric networking (ICN), such end-to-end encryption makes the content caching ineffective since encrypted contents stored in a cache are useless for any consumers except those who know the encryption key. For effective caching of encrypted contents in ICN, we propose a secure distribution of protected content (SDPC) scheme, which ensures that only authenticated consumers can access the content. SDPC is lightweight and allows consumers to verify the originality of the published content by using a symmetric key encryption. Moreover, SDPC naming scheme provides protection against privacy leakage. The security of SDPC was proved with the BAN logic and Scyther tool verification, and simulation results show that SDPC can reduce the content download delay. 



Information Centric Networking, Named Data Networking, 5G, Content Distribution, Access control, In-network caching, Security, Authentication, Privacy.








§ INTRODUCTION


Since the earliest time of the Internet, its underlying architecture has been based on packet-switching and host-to-host communications. The TCP/IP layered architecture employs the same view and provides an abstract host-to-host communication model to communication applications. It decouples what to communicate from how the communication is done. This basic design feature of the TCP/IP architecture was far-reaching, allowing the Internet to grow for almost four decades while adopting various features and yet maintaining high efficiency. However, in the recent past there has been a profound increase in Internet connectivity, and with the emergence of new Internet applications, the Internet semantics have changed from host centric to content centric. To satisfy the needs of emerging internet applications, the current TCP/IP Internet architecture has adopted several application layer solutions known as over-the-top (OTT) applications, such as content delivery network (CDN), web caching, and peer-to-peer networking <cit.>. With the addition of numerous applications, the gap between the basic semantics of the current Internet architecture and its usage is bound to increase; in fact, the additions of new OTT applications are leading us towards a very complex Internet architecture, and are introducing challenges to achieving efficiency, security, and privacy at acceptable economical cost.


Further, Internet trends are shifting away from browsing information to online consuming and sharing all types of content, including user-generated contents. Hence, the most promising characteristic of the future Internet is ubiquitous content delivery. What is being communicated is becoming more important than who is communicating. In this perspective, information-centric networking (ICN) has emerged as a promising architecture for the Future Internet; recently, the ICN support for 5G use cases were specified by NGMN. ICN represents a paradigm shift from host-centric to content-centric services and from source-driven to receiver-driven approaches. In the ICN paradigm the network is in charge of doing the mapping between the requested content and where it can be found. To do so, a network level naming is used for identifying content objects, independent of their locations <cit.>. This means that the ICN architecture decouples contents from the host at the network level and supports a temporary storage of contents at in-network caches. 


In ICN, in-network caching is an integral part of the ICN service framework <cit.><cit.>. The benefits of the ubiquitous caching in ICN are profound, but it also introduces a challenge to content security; especially, the protection of a private or confidential content is a challenging task.  The ICN enabled cache routers can store the content segments for future use; hence, the content is temporarily cached in few intermediate cache routers while it is being delivered to a consumer. If content requests traverse a cache router that holds a temporarily cached copy of that particular content segment, then the request is entertained locally without being routed towards the publisher. However, in ICN the publisher has no control over the content after injecting it in the network; in particular, if  a private or confidential content is protected insecurely, then any unauthorized consumer can acquire it from intermediate caches. Traditionally, the protection of the content against unauthorized access requires consumer authentication and involves the conventional end-to-end encryption. Consequently, when the content is encrypted with the authorized user's key, the in-network caching becomes ineffective in ICN. 

In Figure <ref>, a publisher P publishes two content objects O_j and O_k. Further, two consumers N_A and N_B subscribe to access these protected contents O_j and O_k. Furthermore, the object O_j is published without encrypting, scrambling, or hashing the content name, while the object O_k is published with encrypting, scrambling or hashing the content name to ensure its privacy. Assume that the consumer N_A sent an interest packet I_A,j encapsulating the access authorization information. In reply, based on the subscription information, if N_A is a valid subscriber, the publisher P encrypts the requested content segment S_0,j with a consumer specific key and sends it to the consumer N_A. Based on the semantics of ICN and cache replacement schemes, the intermediate cache router R_5 stores the encrypted content segment S_0,j for future use. Now lets suppose, the consumer N_B requests the same content. If the meta-data of the encrypted stored packet is available to R_5, as in case of O_j, then the intermediate cache router R_5 will reply with the cached content S_0,j to the consumer N_B. However, N_B cannot decrypt the content segment S_0,j as it was solely intended for N_A and thus the payload is encrypted with the key known to P and N_A. Contrarily, if the meta-data of the encrypted stored packet is unavailable to R_5, as in case of O_k, the interest packet I_B,k will be forwarded to the publisher.








This issue can be solved by encrypting each content segment with a key known to all subscribers. In this regard, this issue can be viewed as a group key agreement problem. However, even in the presence of a perfect key distribution protocol, the assurance of backward and forward secrecy requires complex operations since the publisher in ICN has no control over the content after injecting it in the network. Moreover, in conventional group key agreement protocols <cit.>, the hosts share a cryptographic key for secure communications, which are not well-suited for the content centric ICN paradigm.

For example, if an authorized consumer unsubscribes from the service, then to ensure the forward secrecy it is necessary to make sure that leaving consumer don't have access to future keys for the group; hence, the shared key should be updated. From this point onward, the publisher would encrypt new version of content with updated group keys.  To access the content which is already disseminated in network caches, the authorized consumers need to keep both keys for effective cache utilization.  As shown in Figure <ref>(b), at time t_1, the publisher P publishes object O_j and shared the encryption key K_1 with all authorized consumers N_A, N_B and N_C. Let's assume at time t_2 consumer N_B unsubscribe with publisher P. The publisher P will issue a new key K_2. Further assume that before unsubscribe event the copies of segment S_0,j and S_1,j were already disseminated in ICN core network; now if a consumer N_A or N_C request object O_j, it may get S_0,j and S_1,j from cache router encrypted with K_1 and rest of the segments from publishers encrypted with K_2. Similarly, if a new authorized consumer subscribes for the service, then to ensure the backward secrecy the shared key should be updated, and previous group members need to keep both keys for effective cache utilization.  Imagine a highly dynamic group where the consumers subscribe or unsubscribe very frequently, it will trigger numerous leave and join events, which will invoke group key agreement protocols each time. For effective caching, all consumers would keep record of multiple keys. Moreover, an extra decision operation is required to select a proper key; associating a time stamp can solve the problem at the cost of group member synchronization. Hence, the conventional group key management cannot handle the access control problem in ICN for ensuring the effective caching.

In our proposed scheme, we shifted the central target of keying process from hosts to data itself, i.e., the segments of the published content are encrypted with symmetric cryptographic keys that are unique to each segment and versions. The solution is to encrypt each content segment with a uniquely assigned key known to all subscribers; which raises three fundamental questions. How does one ensure that only an authenticated subscribed consumer can access the content? How can the consumer verify the originality of the content; that is, do we still need self-certifying? Finally, and most importantly, how can encryption keys be distributed among all of the consumers for each content segment? We answered all these questions in this work.

Specifically, we propose a secure distribution of protected content (SDPC) scheme, which consists of two protocol suites, 1) the keying protocol suite and 2) the subscription and content access protocol suite. The keying protocol suite enables the consumer and publisher to share a chain of secret keys required to decrypt the segments of the published content, while the subscription and content access protocol suite ensures that only authorized consumers receive the secret key generation information. 

The remainder of this paper is organized as follows. In Sections <ref> and <ref>, we summarize the related works and present the system model, respectively.  Section <ref> describes SDPC with detailed discussions. Section <ref> presents an inclusive security analysis. In Section <ref>, we present the performance analysis of SDPC. Finally, we provide concluding remarks in Section <ref>.









§ RELATED WORKS



Most existing access control schemes for secure contents are application specific or lack security strength. For example, in <cit.>, the authors presented a scheme for protected contents using network coding as encryption. However, the scheme requires a private connection between the publisher and consumer to obtain the decoding matrix and missing data blocks. In <cit.>, the authors presented a security framework for the copyrighted video streaming in ICN based on linear random coding. It is proven that the linear random coding alone improves the performance of ICN <cit.>. However in <cit.>, each video was encrypted with a large number of symmetric encryption keys, such that each video frame was encrypted with a unique symmetric encryption key. Since only authorized users who possessed the set of all keys could decrypt the video content, the distribution of a large number of keys for each video content can be an extra communication overhead.

 In earlier work <cit.>, the authors proposed a content access control scheme for ICN enabled wireless edge. The proposed one is an extension of  <cit.>, which employs the public-key based algorithm and shamir's secret sharing as a building block, named AccConF. To obtain a unique interpolating polynomial of shamir's scheme, AccConF espoused Lagrangian Interpolation technique. The calculation of Lagrangian Interpolation is a computationally expensive process. To reduce the client-side computational burden the publisher piggy backs an enabling block with each content, which encapsulates partially solved Lagrangian coefficients.

In work by  <cit.>, an access control realized by a flexible secure content distribution architecture, which combins the proxy re-encryption and identity-based encryption mechanisms. The publisher generates a symmetric key and encrypt the content before dissemination. To access the content from in-network cache or directly from publisher, a consumer first sends a request to publisher to acquires the symmetric encryption key. Upon receiving the key request, the publisher validates and verifies the authenticity of consumer, and sends the symmetric key encapsulated in response message encrypted with consumer’s identity. The proposed scheme eliminated the asymmetric encryption, but it is not clear that how the consumer’s private identity could be known to the content provider. 

In other work  <cit.>, author proposed a content access control scheme based on proxy re-encryption. In proxy re-encryption the content is re-encrypted by an intermediate node. In proposed scheme the edge routers perform the content re-encryption. Upon receiving a content request, the publisher encrypts the data and a randomly generated key k1, using its public key. Upon receiving the content request, edge router generates a random key k2 encrypted by the publisher’s public key and signed by the edge router. Edge router sends the encrypted k2 to publisher and appends the encrypted k2 with the content and dispatch it towards consumer. Meanwhile, the publisher verifies the authenticity of consumer, and generates the content decryption key K using K1, K2 and public key. Upon receiving K the consumer can decrypt the content. 

In other work <cit.>, the authors proposed a distributed information flow control mechanism (named MCAC) to enable secure access control for the published content. In MCAC, the requests and content objects are labeled with {h, n, d, p}. These labels classify the contents based on the security and privacy requirements, where the h-level signifies the highest protection level and enforces non-caching policy, the n-level enforces the 1-level caching policy, the d-level permits multi-level caching policy, and the p-level supports all reading policy. To administer the MCAC information flow, the intermediate routers require to implement a trust computing base (TCB), consists of three modules; trust storage module (TSM), trust labeling module (TLM), and trust enforcement module (TEM). TSM governs the process of cryptographic session key establishment between participating routers and other nodes. The session keys are used to attain the h-level security by encrypting highly confidential h labeled contents. TLM checks the label value and instructs the operating system accordingly to take further actions. TEM performs the content forwarding process and is responsible for content reclassification, i.e., TEM can re-labels a content to the h-level if it was at the n-level to hide the content based on privacy policy of the publisher. MCAC does not provide any mechanism to authenticate participating entities, which makes MCAC vulnerable to various attack. Moreover, to enforce the h-level security and privacy protection, all MCAC enabled routers need to establish a cryptographic session key and need to encrypt/decrypt all the communication between routers, which severely effects the performance of MCAC[ To verify the protocol claims, we implemented MCAC in an automated security protocol analysis tool, Scyther <cit.>, and also discussed its performance in Sections <ref> and <ref>.].

In another study <cit.>, the authors presented an access control scheme for the encrypted content in ICN, which is based on the efficient unidirectional proxy re-encryption (EU-PRE) proposed by <cit.>. The proposed scheme, named efficient unidirectional re-encryption (EU-RE), simplifies EU-PRE by eliminating the need of proxies in the re-encryption operation. However, the EU-RE scheme is still based on asymmetric cryptography, which is not suitable for several resource constraint applications such as, IoT and sensor networks. Moreover, the authors made an assumption that the content provider behaves correctly, i.e., it does not distribute any private content or decryption rights to unauthorized users. However, this assumption falsifies the protocol claims defined in <cit.>, which means EU-RE is weak against several attacks.[To verify the protocol claims, we implemented EU-RE in an automated security protocol analysis tool, Scyther <cit.>, and presented the results in Section <ref>.]




§ SYSTEM MODEL



The system model used throughout this work is shown in Figure <ref>(a). For concrete discussion and better understanding, in the rest of the article, we present SDPC for a particular ICN architecture, i.e., named data networking (NDN) <cit.>. However, SDPC can be adopted for other ICN architectures without changing the core idea.

In NDN core networks, we introduce a new entity, designated subscription manager M. The subscription manager M can be a module installed on the publisher or it could be an independent entity in the network. In this work we assume that subscription manager M is an independent entity associated with multiple publishers. We also assume that there is a secret number n_S^i associated with each valid subscriber (or consumer) i, which is registered with the subscription manager M. The registration could be made offline or online using a smart mechanism. The subscription manger M stores the secret number n_S^i in a hash table, which is a part of registration database, as shown in Figure <ref>(a). Note that being registered does not mean the consumer is entitled to access a certain protected content.  When a registered consumer is interested in a protected content, the consumer should first subscribe to the protected content, for instance, subscribing to a movie channel. In the first step, the consumer sends an interest request for the protected content along with the subscription request, and the publisher routes the request towards the subscription manager M. After that, the subscription manager M authenticates the consumer N_A and in response the publisher P sends the encryption key generation information KEY_MSG. Using KEY_MSG as a seed for a secure hash function, the consumer N_A and the publisher P can generate a chain of keys. Then, the publisher P uses these keys to encrypt the segments of the published content; likewise, after acquiring KEY_MSG the consumer N_A generates the same keys to decrypt the segments of the published content. 

To acquire KEY_MSG, the first interest packet sent by a consumer should reach the publisher. To avoid any cache hit, it is important the name of the content should be unique between the consumer and the publisher, yet it should identify the requested object. As shown in Figure <ref>(b), the name of the segment 0, "korea.ac.kr/∼fil/test.doc/_v1/_s0", is a variable length and in a human readable form. However, to avoid any cache hit the SDPC naming scheme adopts the name uniqueness, such that the name of first interest is unique between consumer and publisher. To, achieve the name uniqueness the consumer inserts the hash of the secret number n_S^i, and encrypts the content name with K_TS^i. Then, the name of the segment 0 becomes "korea.ac.kr/∼fil/Hash ( n_S^i)/E_TS^i( test.doc/ _v1/ _s0 )". In this naming scheme the insertion of digest and encryption of naming part provides a consumer-publisher specific unique name and as a result the interest packet always reaches the publisher without any cache hit. Note that the usage of consumer name space is restricted for acquiring KEY_MSG only, this gives provides prevention against DoS attacks.

After acquiring KEY_MSG the consumer can access the rest of the segments by using a shared authoritative name space. The name for each segment includes a hash digest Hash ( KEY_MSG), and the object name is encrypted with a uniquely assigned key K_l^j, which is generated using KEY_MSG for each segment l of an object O_j. For example, the name for segment _ s1 of object O_j is given by "korea.ac.kr/∼ fil/Hash ( KEY_MSG)/E_1^j( test.doc/_v1/ _s1 )". With the insertion of Hash ( KEY_MSG) and encryption of the naming part with keys generated using KEY_MSG, this naming scheme provides a shared authoritative name space for all authorized consumers and thus it enables an effective content caching.  Moreover, this naming scheme ensures the privacy, because the content name is invisible to outsider without any knowledge of n_S^i, KEY_MSG, and cryptographic keys K_TS^i and K_l^j.


Let's suppose Figure <ref>(a), a consumer sends an interest packet I_A,i utilizing the proposed naming scheme. Then, the packet will reach publisher without any cache hit. Let us say that protected content object O_i is composed of k segments of S= { S_1,i, S_2,i… S_k,i}; further, the intermediate cache routers R_1 and R_2 have the copies of the protected content segments, represented by S_R1,i⊆ S  and S_R2,i⊆ S. If the consumer is a valid subscriber, the publisher sends the encryption key generation information KEY_MSG to the consumer. After receiving the key generation information, the consumer can decrypt the content segments, which may be delivered directly from the intermediate cache router.




§ SECURE DISTRIBUTION OF PROTECTED CONTENT



SDPC consists of two protocol suites: 1) the keying protocol suite and 2) the subscription and content access protocol suite. The keying protocol suite is comprised of a key generation protocol and a key agreement protocol for content protection. Likewise, the subscription and content access protocol further includes three protocols, one dealing with the consumer subscription and the other two dealing with access to the protected contents published by different publishers. 



 §.§ Keying Protocol Suite


In the keying protocol suite, the key generation protocol generates a commitment key using an irreversible function similar to the ones used in <cit.> <cit.>. The commitment key is further used to drive multiple keys; for instance, a chain of content segment encryption keys, a ticket encryption key, and a consumer associated symmetric key are derived from the commitment key.

The key generation mechanism for the content protection is shown in Figure <ref>(a). First, the publisher divides a large content into equal sized segments. For each protected content object O_j, the publisher generates a unique commitment key generator by using an irreversible one-way hash function ζ_0^j=H ( T_P, O_j), where T_P is the time of publishing and O_j represents the content name and version[Each version of content object is encrypted with a separate chain of keys. It empowers the publisher to control version-based access.]. After that, the publisher generates a chain of key generators of the length L=sizeof ( O_j) /segment size by using an irreversible one-way function { H (  ζ _0^j) = ζ _1^j, H (  ζ _1^j) =ζ _2^j, …, H (  ζ _l-1^j) = ζ _l^j}. Each generator ζ in the chain is used by a function g at a specific index location in the chain to derive a content segment encryption key. For instance, at index k, the function g (  ζ _k^j) =H (  ζ _k^j,K_p) generates the key K_k^j used for encrypting the kth segment of the content object O_j, where K_p is the public key of the publisher. The use of K_p, in symmetric key generation process, implicitly ensures the originality of the content, i.e., the content are still self-certifying with out use of expensive asymmetric encryption. For instance, very efficient public key algorithms, such as ECC <cit.>, are almost three thousand times slower than symmetric key algorithms <cit.> such as RC5 <cit.>. The symmetric keys generated as a result of the SDPC keying protocol have the size of 256 bits. Hence, in the subsequent section on the authentication protocols, any symmetric encryption algorithms supporting the 256-bit key can be used, e.g., RC5/6 <cit.>, Rijndael <cit.>, and Twofish <cit.>.




 §.§ Subscription and Content Access Protocol suite

When a consumer wants to subscribe to the protected content, the consumer gains an initial access using a subscription protocol (SubP). After SubP, the consumer can use a ticket to access multiple protected contents published by the publishers or managed by a third party. 









  §.§.§ Initial Access and Subscription Protocol (SubP)


If a consumer N_i wants to subscribe to the protected content (e.g., subscribing for a movie channel), N_i first generates an encryption key K_TS^i=H(K_p^j⊕ n_S^i), where K_p^j is the public key of the publisher and n_S^i is a secret number shared with the subscription manager M. SubP continues as follows:


	
  * As shown in 1 at Figure <ref>(b), N_i injects a subscription interest packet  I_i and the NDN core network forwards it to the publisher P_j. The interest packet encloses n_0^i that is encrypted with the generated encryption key K_TS^i. 

	
  * Upon receiving the request from N_i, P_j forwards the request in conjunction with its identity and the challenge n_2 to the subscription manager M. Note that P_j cannot decrypt the part of the interest packet which is encrypted with key K_TS^i and registration number n_S^i remains invisible to the publisher.

	
  * M retrieves the profile of N_i from the database. If N_i is a legitimate consumer, M generates the keys K_TS^i=H(K_p^j⊕ n_S^i) and K_S^i=H ( T_M⊕ n_S^i), and sends u_0=E_TS^i( n_0+1 || n_1|| T_k|| K_s^i) to P_j, where T_M is the time of issuing the session key K_S^i. The message M3 includes a ticket T_k=E_P^j( N_i|| K_s^i||  profile ), a challenge n_1 for N_i, and a challenge response for P_j. After that, P_j verifies the challenge response and stores n_1 to use it as a message authentication in M5 and M6. In addition, P_j retrieves the profile and the session key K_s^i from the ticket. Since ticket is encrypted with the public key of P_j, the consumer  N_i cannot decrypt it, but can use it to subscribe to other contents published by P_j, without contacting the subscription manager M.
	
	
  * P_j forwards u_0 to N_i along with KEY_MSG=H (  ζ _0^j,K_p), which is required to decrypt the segments of the published content and also used as a content object identifier. After verification of a challenge ( n_0+1 ), N_i accepts T_k and generates a key chain to decrypt the protected content. The generated key chain involves the public key of P_j, hence, the content is also self-certifying.

	
  * P_j sends the challenge response ( n_1+1 ) to M for the confirmation of a successful protocol run. After challenge ( n_1+1 ) confirmation, P_j may optionally register N_i in its own database. If P_j does not receive any challenge response within a certain period of time, P_j marks T_k as a stolen ticket.


In SubP, secure exchanges of n_0, n_1, and n_2 ensure the message authentication between the consumer and the subscription manger, between the subscription manger and the publisher, and between the publisher and subscription manger, respectively. Likewise, the message authentication between the consumer and publisher is established by the session key encryption and n_1. 




 §.§ Content Access Protocols



  §.§.§ Access Protocol after Subscription (APSub) 


When the consumer N_i wishes to access some other protected contents published by the publisher P_j, N_i sends an interest request for the protected content along with the ticket T_k and APSub continues as follows.


	
  * As shown in 2 at Figure <ref>(b), N_i injects a subscription interest packet, enclosing Access_req=E_S^i( N_i|| n_0)  || T_k. The NDN core network forwards it to the publisher P_j. The publisher P_j decrypts the ticket and verifies the sender's identity N_i  by retrieving K_s^i. If the value N_i does not match, P_j  will ignore the request and otherwise proceed as follows.

	
  * P_j sends a challenge response along with the new challenge encrypted with the session key K_s^i. P_j also send KEY_MSG, which is required to decrypt the segments of the published content.

	
  * N_i sends a challenge response n_1. If P_j does not receive the challenge response within a certain period of time, P_j marks T_k as a stolen ticket. 


In APSub, the secure exchange of n_0^i ensures the message authentication between the consumer and the publisher. 




  §.§.§ Access Protocol after Subscription involving a Third Party (APSub3)


Assume a consumer N_i subscribed with P_i, which means it shares a session key K_s^i with P_i and holds a T_k  encrypted with public key of P_i. Now if N_i wishes to access the protected contents published by a third-party content publisher P_j, APSub3 continues as follows.


	
  * As depicted in 3 at Figure <ref>(b), N_i injects a subscription interest packet enclosing Access_req=E_S^i( N_i|| n_0) || T_k and the packet is forwarded to the publisher P_j.

	
  * Upon receiving the request from N_i, P_j forwards the request in conjunction with its identity and the challenge n_2 to M. Note that P_j cannot decrypt  Access_req in the interest packet that is encrypted with the key K_s^i, which a shared session key between N_i and P_i, which ensures the third-party content distributor cannot misuse the consumer secure information, such as profile and secret share number.

	
  * M retrieves the profile from T_k, and if N_i is a legitimate consumer, M generates the key K_TS^i=H(K_p^j⊕ n_0), and sends u_0=E_S^i( n_0+1 || n_1|| KEY_MSG)  to  P_j. The message M3 also includes the key  K_TS^i, a challenge n_1 for N_i, and the challenge response for P_j, which are encrypted with the public key P_j. After that, the publisher P_i verifies the challenge response and stores n_1. Note that the ticket is encrypted with the public key of P_i. Therefore, N_i and third-party publisher P_j cannot decrypt it. Also, KEY_MSG is inaccessible to P_i, which ensures that the third-party content distributor cannot misuse the protected content.

	
  * P_j forwards u_0|| E_TS^i( P_j)  to N_i. After the verification of the challenge ( n_0+1 ), N_i generates K_TS^i=H(K_p^j⊕ n_0)  and sends the challenge response ( n_1+1 ) to P_j. Now N_i can generate a key chain to decrypt the protected published content. Since the key chain is generated using the public key of P_i, the content is also self-certifying.

	
  * P_j sends the challenge response ( n_1+1 ) to M for the confirmation of a successful protocol run.

	
  * After the challenge confirmation, P_j closes the protocol run. If P_j does not receive any challenge response within a certain period of time, P_j marks T_k as a stolen ticket.  


In SubP3, secure exchanges of n_0, n_1, and n_2 ensure the message authentication between the consumer and the subscription manger, between the subscription manger and the third-party publisher, and between the third-party publisher and subscription manger, respectively. Likewise, the message authentication between the consumer and the third-party publisher is established by a temporary session key K_TS^i and n_1.




§ SECURITY ANALYSIS



This section presents an inclusive security analysis, formal analysis using BAN logic <cit.>, and Scyther implementation results <cit.>. 



 §.§ Naming based Attacks


In NDN the objects are identified by a human readable naming system, which can lead to watchlist and sniffing attacks <cit.>. 

In watchlist, an attacker who has control over communication links and cache routers, can delete or filter the content based on a predefined list of content objects. With the use of SDPC, the content is encrypted and invisible to the attacker. Recall that in NDN it is not obligation that a content object must carry an explicit content name, rather it can carry an implicit content identifier computed from the corresponding interest. This solution hides the object from the attacker. Let us reconsider the example in Figure <ref>(b). The first interest packet carries the name "korea.ac.kr/∼fil/ Hash( ( n_S^i) / E_TS^i( test.doc/ _ v1/ _ s0  ))"  beside the insertion of hash digest hash( ( n_S^i),  the object name is encrypted with  K_TS^i .  After acquiring  KEY_MSG  the name for _s1 is then given by "korea.ac.kr/∼fil/ Hash ( KEY_MSG)  / E_1^j( test.doc/ _ v1/ _ s1  )". The attacker cannot get KEY_MSG, n_S^i, K_TS^i, and K_l^j, and thus launching watchlist attack is not possible. Moreover, it completely hides the object name from the attacker, which ensures the privacy of the consumer.

Contrarily, in a sniffing attack the intruder does not have any list of pre-defined contents, rather it monitors the network and filters or eliminates the data if it contains some specified keywords. Such sniffing attack is not possible in SDPC, because the data is encrypted with the secret keys. 




 §.§ DDoS Attacks

The in-network caching makes NDN intrinsically resilient against distributed denial of service (DDoS) attacks <cit.>.  DDoS is a malicious attempt to disturb normal traffic to a server, for instance, multiple compromised systems send fake interest packets to a content publisher. Once the content is disseminated across network caches, the DDoS attack against a publisher depletes due to the on-path cache hits. However, assume somehow an attacker manages to flood all interests to a targeted publisher. With the use of SDPC, the total burden after a successful DDoS attack on the targeted publisher will remain insignificant.  This is because the subscription manager M keeps the record of registered nodes in the hash table, which entries represent K_TS^i=H(K_p^j⊕ n_0) session keys. Thus, in case of suspicion, the subscription manger in SDPC can identify fake requests by a hash table lookup with the complexity O ( 1 ).




 §.§ Time Analysis Attack

In NDN any cache node can store content segments. An intruder can guess that a particular content was requested by a user in particular vicinity by observing the request response time of a cached or uncached content. With the use of SDPC the payload is encrypted with one of the key derived from KEY_MSG and the name of an object is identified by the digest and encrypted fields.  Since the intruder cannot acquire KEY_MSG on time, it cannot create a valid request to launch a time analysis attack.




 §.§ Unauthorized Access

SDPC allows the caches to store encrypted contents and to use a naming scheme unrecognizable to intruders. An intruder can access the content only after acquiring KEY_MSG. Since the delivery of KEY_MSG in SDPC is achieved by handshake messages, where each message exchange contains an explicate (nonce challenge) or implicit (encryption key derived from nonce) message authentication; further each message is encrypted with K_TS^i=H(K_p^j⊕ n_0), for unauthorized access an intruder needs to acquire K_TS^i.



 §.§ Traffic Monitoring Attack

In traffic monitoring attack <cit.>, an intruder targets a consumer and tries to identity the requested contents. To launch a traffic monitoring attack the intruder takes control of edge router and observes all the requests send by the target consumer. However, in SDPC the content name is encrypted, which hides the object name from the attacker, consequently the traffic monitoring cannot reveal the identity of requested contents.




 §.§ Formal Analysis using BAN Logic


BAN logic <cit.> is widely used for the formal analysis of security protocols, till recently<cit.> <cit.> . To verify the security of the SDPC protocol suite, it is sufficient to demonstrate the security of SubP since the rest protocols are extensions of SubP. The BAN logic analysis shows that SDPC is safe against large number of attacks. A detailed formal analysis of SDPC using BAN logic can be found in Appendix-I or at <cit.> .



 §.§ Scyther Implementation Results


Although BAN logic provides a foundation for the formal analysis of security protocols, a few attacks can be undetectable even with BAN logic <cit.>. However, the critical analysis of BAN-logic in <cit.> is based on usage of asymmetric cryptography, whereas SDPC utilizes symmetric cryptography. Furthermore, <cit.> argue that BAN-logic methodology is faulty because it is assumed that physical security and administration do not suffer from the loss of messages by the underlying communication facility or because of host crashes. Owing to replication of contents across the network, in ICN this assumption has minor effect. Still, for the additional proof of the strength of the SDPC protocol suite, we implemented SDPC, EU-RE <cit.>, and MCAC <cit.> in an automated security protocol analysis tool, Scyther <cit.>.

We considered four claims: 1) aliveness, 2) weak agreement, 3) non-injective agreement, and 4) non-injective synchronization <cit.>. These four claims are proven to be true for SDPC  by using BAN logic. In Scyther, a protocol is modeled as an exchange of messages among different participating roles.  For instance, in NDN-SDPC, the consumer and publisher are in the roles of initiator (I) and responder (R), respectively, whereas the subscription manger is in the role of a server (S). In EU-RE, the publisher acts both as a responder and  as a server (R_S), whereas in MCAC the consumer and publisher are in the roles of I and R, respectively, whereas the 3rd party authenticator has the role of S. The Scyther tool integrates the authentication properties into the protocol specification as a claim event. We tested SDPC, MCAC, and EU-RE by employing the claims mentioned earlier, with the parameter settings given in Table <ref>.







The Scyther results are shown in Table <ref>. It is clear that SubP qualifies all of the protocol claims and no attacks were found. Consequently, for a large number of systems and scenarios, SDPC guarantees safety against a large number of known attacks such as impersonating, man-in-middle, and replay attacks. However, in EU-RE, the author made an assumption that the content provider behaves correctly, i.e., it does not distribute any private contents or decryption rights to unauthorized users, this assumption falsifies the protocol claims, which means EU-RE is weak against several attacks. The Scyther implementation shows that initiator fails to confirm claims 2, 3, and 4.

In MCAC, the TCB along with encrypted communication between routers provide strong security against man-in-middle attack; however, during the bootstrapping, the session key establishment is conducted by the Diffie-Hellman (DH) key distribution algorithm  <cit.> without using a proper authentication procedure. Since the DH algorithm does not inherently provide authentication, it can be secure only if it is properly integrated with another authentication protocol. This weak link in MCAC makes it vulnerable to several attacks, even a man-in-middle attack could be possible if an intruder tempered the session key distribution procedure during bootstrapping process. Therefore, from Scyther implementation results, it can be seen that MCAC fails to qualify a signal claim; further, if we assume the DH key exchange protocol is integrated with an authentication protocol or bootstrap process is hidden from the intruder, then MCAC qualifies all the claims. The inclusion of the authentication process causes the extra processing burden only during the bootstrap process and can be ignored for the next steps in the protocol.






§ PERFORMANCE EVALUATION



We consider a scale-free network of 200 cache nodes generated using the Barabási–Albert (BA) model, as shown in Figure <ref>, which connects the publisher and the consumer space. Each cache router has a static request routing table. Further, we assume five content publishers in the network. Each publisher has 100,000 secure content items, and a Zipf-distribution with a popularity distribution exponent α=0.7 is used to determine the population of content items in the entire network. 



To ensure quick dissemination of the contents in the network, the publishers are connected to the cache routers with the highest betweenness centrality score, it helps to bringing system in steady state in short time. Furthermore, 25 gateway cache routers are connected to the consumer space with a large number of consumers. At any given time, 400 500 consumers are subscribed with each publisher and thus the total number of consumers subscribed to five publishers varies between 2,000 and 2,500. The size of each content item is 1GB, which is divided into 10 segments, and the link capacity between two cache routers is 1 Gbps, Finally, least frequently and recently used (LFRU) <cit.> is used in the experiment as a content replacement scheme.

We implemented the network setup, as described above, in MATLAB and compared the performance of NDN-SDPC against MCAC, EU-RE, and native NDN for two scenarios, 1) using end-to-end encryption, which makes the caching ineffective, as discussed in Figure <ref>, and 2) enabling the caching with a conventional way of a shared group key <cit.><cit.>. In the scenario 2, the shared group key enables in-network caching, but the shared group key is unfeasible because the authorized consumers need to keep a large number of keys for effective cache utilization in highly dynamic environments. Moreover, extra decision operations are required to select a proper key and to determine the timing of key deletion. For simplicity, in the scenario 2, we only consider the computational and message complexity required to ensure backward and forward secrecy. The processing required to select an appropriate key on the consumer side is ignored. Further, the scenario 2 is simulated for different levels of dynamicity in the consumer space, by considering 5, 15, and 25 leave and join requests per unit time; representing cases 1, 2, and 3, respectively. This comparison is made in terms of average download time[The average download time is defined as the ratio of the total number of requests observed on all 25 cache routers to the time taken to receive all the requested contents at the gateway routers.], publisher load[The publisher load is defined as the percentage of interests reached at publisher. High the publisher load implies low cache hit.], and timeout interest ratio[The timeout interest ratio is defined as the percentage of interests timed out and re-transmitted.].




Figure <ref> shows the comparison of the average download time observed when each of the 25 gateway cache routers receives the requests that are generated by a Poisson distribution with a rate λ_j^d=100 req/s.  The results are considered for different cache sizes of 200 MB to 100 GB; further, in case of MCAC, it is considered that 20% of contents are labelled as the h-level and 80% as the d-level.[The existence of different levels of content impacts the overall performance of MCAC, as shown in Figure <ref>.] From Figure <ref>, it can be seen that NDN with SDPC outperforms  EU-RE and native NDN both in the scenarios 1 and 2. The performance of NDN in the scenario 2 degrades further with the increase in dynamicity of the consumer space. The performance results of EU-RE are interesting, for smaller cache size [200MB-1GB], the performance of EU-RE is very close to NDN-SDPC, and it outperforms native NDN both in the scenarios 1 and 2. However, the performance gap increases with the increase of the cache size, and it falls down below NDN in the scenario 2 with case 3. In Eu-RE, the key revocation and content version are not correlated, and this can be one of the reason of such performance degradation. For a large cache size, MCAC performs better than EU-RE and NDN in scenario 2 with cases 2 and 3; however, NDN-SDPC and NDN in scenario 2 with case 1 outperform the MCAC. As discussed earlier, MCAC enforces intermediate routers to implement TCB, which includes several operations and encryption/decryption process for the h-level and the n-level secure content, these extra operations introduce processing delay at intermediate routers, the performance of MCAC further decreases with increasing the number of h-level contents. 




Figure <ref> shows the comparison of average download time comparison between NDN, NDN-SDPC and MCAC, for different numbers of h-level contents ranging from 0 to 100% of total traffic, with the fixed 1GB cache size. From Figure <ref>, it is clear that performance of MCAC degrades with increasing number of h-level content.  The performance degradation of MCAC with increasing the number of the h-level contents is quite obvious, because h-level contents require no caching policy; hence, all interest packets traverse to the publisher. 




Figure <ref> shows the comparison of publisher load. We considered the case-3 level dynamicity of consumer space for EU-RE, MCAC, and NDN-SDPC.  From Figure <ref>, it is evident that in NDN-SDPC the publisher load is 12 to 20% lower than EU-RE; however, publisher load at MCAC is almost same as NDN-SDPC, but MCAC's load increases with increasing number of h-level contents. This also implies that NDN-SDPC has higher cache hit ratio. 

Similarly, from Figure <ref>, it can be seen that EU-RE, NDN-SDPC and MCAC, with small numbers of h-level contents, suffer with lower number of time out interest packets. However, NDN-SDPC and MCAC with 20% of h-level contents suffer 35 to 50% less than EU-RE; however, this performance metric also shows that performance of MCAC reduces with increasing number of h-level contents. This also implies that in comparison to EU-RE and MCAC, the NDN-SDPC provides better cache diversity.








§ CONCLUSION



For effective caching and access control of the protected content in ICN, we proposed a secure distribution of protected content (SDPC). The SDPC's keying protocol suite empowers the publisher and consumer to generate multiple symmetric encryption keys with the exchange of a single commitment key. Moreover, SDPC's subscription and content access protocol suite ensures that only authenticated users can acquire the respective key generation information for the requested content. Another important aspect of proposed scheme is the hybrid naming scheme, which provide privacy protection and deters the time analysis attack. The commitment key in SDPC is generated with the publisher’s public key, along with other secret credentials, and thus allows the consumer to implicitly verify the originality of the published content. In other words, self-certifying is achieved with the symmetric key cryptography, which makes SDPC free from the expensive computation overhead problem incurred in public key algorithms <cit.>. Consequently, we believe that the adaptation of SDPC can make NDN more feasible for resource-limited networks such as Internet of things (IoT), which is one of our future works.





§ BAN LOGIC ANALYSIS


Three basic objects of BAN logic are principals, formula/statements, and encryption keys. The principals and the protocol participants are represented by symbols P and Q, respectively. The formula/statements are symbolized by X and Y, and represents the content of the message exchanged. The encryption keys are symbolized by K . The logical notations of BAN-logic analysis are given in Table <ref>, and Some primary BAN-logic postulates used in the analysis of SDPC are summarized in Table <ref>.










The SubP protocol should achieve the following four goals that state that both the consumer and the publisher trust the encryption key K_S^i for the secure exchange of KEY_MSG:


	
  * G1: P_j( N_i↔^K_S^iP_j)
	
  * G2:N_i( N_i↔^K_S^iP_j)
	
  * G3: P_jN_i( N_i↔^K_S^iP_j)
	
  * G4:N_iP_j( N_i↔^K_S^iP_j)



To verify the above-mentioned goals, the first step of BAN logic is to convert the subject protocol in its idealized form. The idealization is a process to represent each message exchange in its intended semantics. In other words, the idealization is a process of converting each message exchange into a logical formula by using BAN symbols and notations. The idealizations of SubP are given below.



	
  * M1: N_iVia P_jM:{( n_0,N_i↔^n_S^i M)}_K_TS^i = H( K_p^j ⊕ n_S^i)
	
  * M2: P_j→ M:{n_2,IDP_j}
	
  * M3:

    M →P_j
       {[ n_1, n_2, ( 
      profile, N_i,
      N_i(K_S^i)P_j,
       #( N_i(K_S^i) P_j ) 
      )_K_P^j]_K_P^j, [ n_0, n_1, ( 
      profile, N_i,
         N_i(K_S^i)P_j,
      #( N_i(K_S^i)P_j )
      )_K_P^j,   N_i(K_S^i)P_j,
       #( N_i(K_S^i)P_j ),
      N_in_S^iM 
      ]_K_𝑇𝑆^i = H(K_P^j ⊕ n_S^i)}


	
  * M4: 

    P_jVia MN_i
       {[ n_0, n_1, (   profile, N_i,
         N_i(K_S^i)P_j,  #( N_i(K_S^i)P_j )
      )_K_P^j,   N_i(K_S^i)P_j,
       #( N_i(K_S^i)P_j ),  N_in_S^iM 
      ]_K_𝑇𝑆^i = H(K_P^j ⊕ n_S^i), 
       [  ⟨ζ _0^j,K_p⟩ ,   N_i(K_S^i)P_j,
       #( N_i(K_S^i)P_j ),  N_in_S^iM  ]_K_𝑇𝑆^i = H(K_P^j ⊕ n_S^i)}


	
  * M5:P_j→ M:( n_1)_K_S^i
	
  * M6:N_i→P_j:( n_1)_K_S^i 


In an idealized protocol narration of SubP, the messages clearly show all the assertions. Using these assertions, all the implicit assumptions can be explicit. Then, the initial assumptions of SubP are given below.


	
  * A1:M #( n_0)
	
  * A2:M #( n_2)
	
  * A3: P_j#( n_1)
	
  * A4: N_i#( n_1)
	
  * A5: N_i( N_iK_TS^i = H( K_p^j ⊕ n_S^i)M)
	
  * A6: M ( N_iK_TS^i = H( K_p^j ⊕ n_S^i)M)
	
  * A7:P_j( P_j↔^K_P^j M)
	
  * A8:M ( P_j↔^K_P^j M)
	
  * A9: M N_i( N_iK_TS^i = H( K_p^j ⊕ n_S^i)M)
	
  * A10: N_i M ( N_iK_TS^i = H( K_p^j ⊕ n_S^i)M)
	
  * A11: M P_j( P_j↔^K_P^j M)
	
  * A12: P_j M ( P_j↔^K_P^j M)




Let us analyze SDPC to show that N_i and P_j share a session key. From M1, we have

    M <·{n_0,( N_i↔^n_S^i M)}_K_TS^i = H( K_p^j ⊕ n_S^i).


A6 and the message meaning rule infer that

    M N_i|∼{n_0,( N_i↔^n_S^i M)}.


A1 and the freshness conjuncatenation comprehend that

    M #{n_0,( N_i↔^n_S^i M)}.


Also, (<ref>), (<ref>), and the nonce verification rule deduce that

    M {N_i n_S^i,n_0,( N_i↔^n_S^i M)}.


Then, (<ref>) and the believe rule infer that

    M N_i( N_i↔^n_S^i M).


From A2, (<ref>), and the jurisdiction rule, it can be concluded

    M ( N_i↔^n_S^i M).


This belief confirms that M has received a message from a legitimate N_i. A2, A1, (<ref>), and the freshness conjuncatenation comprehend that

    M #{n_0,n_2,( N_i↔^n_S^i M)}.


According to the nonce freshness, (<ref>) proves that M confirmed that N_i is recently alive and running the protocol. Further, from (<ref>) and (<ref>), M has guaranteed that the N_i has been running the protocol, apparently with M. This also proves that M and N_i agree on the nonce values corresponding to all the nonce in M1 and M2. These three proven claims are known as aliveness, weak agreement, and non-injective agreement and defined in <cit.>.

From M3, we have

    P_j<·( n_1,n_2,( N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j),n_0^i)_K_P^j)_K_P^j.


A7, (<ref>), and n_2 nonce verification rule deduce that

    P_j M|∼{n_1,n_0^i,N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j)}.


In addition, A3, (<ref>), and the freshness conjuncatenation comprehend that

    P_j#{n_1,n_0^i,N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j)}.


(<ref>), (<ref>), and the nonce verification rule infer that

    P_j M {n_1,n_0^i,N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j)}.


(<ref>) and the believe rule comprehend that

    P_j M ( N_i↔^K_S^iP_j).


The logic belief proves that P_j is confident and believes that K_S^i is issued by M; moreover, the freshness of the key from (<ref>) also suggests that M is alive and running the protocol with P_j and N_i. Further, from (<ref>), (<ref>), and (<ref>), P_j has guaranteed that M has been running the protocol, apparently with P_j. This also proves that M and P_j are also agree on the nonce values corresponding to all the nonce in M3. This concludes that M and P_j also satisfy the liveness, weak agreement, and non-injective agreement. Consequently, (<ref>), (<ref>), and the jurisdiction rule conclude G1, i.e., 

    P_j( N_i↔^K_S^iP_j).




From M4, we have

    N_i<·{n_1,N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j),N_i↔^n_S^i M}_K_TS^i = H( K_p^j ⊕ n_S^i).


(<ref>), A5, and the message meaning rule comprehend that

    N_i M|∼{n_1,N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j)}.


Then, (Eq15), A4, and the freshness conjuncatenation rule infer that

    N_i#{n_1,N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j)}.


(<ref>), (<ref>), and the nonce verification rule deduce that

    N_i M {n_1,,N_i↔^K_S^iP_j,#( N_i↔^K_S^iP_j)}.


Then, (<ref>) and the believe rule infer that

    N_i M {N_i↔^K_S^iP_j}.


The logic belief proves that N_i is confident and believes that K_S^i is issued by M; moreover, the freshness of the key from (<ref>) also suggests that M is alive and running the protocol with N_i. Further, from (<ref>), (<ref>) and (<ref>), N_i has guaranteed that M has been running the protocol, apparently with N_i and P_j. This also proves that M and N_i are also agree on the nonce values corresponding to all the nonce in M4. This concludes that M and N_i also satisfies the liveness, weak agreement, and non-injective agreement. Conseuqently, (<ref>), (<ref>) and the jurisdiction rule conclude G2, i.e., 

    N_i{N_i↔^K_S^iP_j}.




From M5, we have

    N_i<· IDS_j.


(<ref>), (<ref>), (<ref>), and the meaning rule comprehend G3, i.e., 

    P_jN_i{N_i↔^K_S^iP_j}.



From M6, we have 

    P_j<·n_1.


(<ref>), (<ref>), (<ref>) and nonce verification rule deduce G4 of 

    N_iP_j{N_i↔^K_S^iP_j}.


The logic belief proves that N_i is confident and P_j also believes that K_S^i is issued by M. Moreover, (<ref>), (<ref>), and (<ref>) prove that all communicating partners are confident that their communication partners exactly follow their roles in the protocol and exchange the intended messages in the intended order. This proven claim is known as non-injective synchronization and defined in <cit.>.



Ge13
C. Ge, Z. Sun, and N. Wang, "A Survey of Power-Saving Techniques on Data Centers and Content Delivery Networks," IEEE Communications Surveys and Tutorials, vol. 15, no. 3, 3rd Quarter 2013, pp. 1334-1354. 

Malatras15
A. Malatras, "State-of-the-Art Survey on P2P Overlay Networks in Pervasive Computing Environments," Journal of Network and Computer Applications, vol. 55, Sept. 2015, pp. 1-23. 

Jacobson09
V. Jacobson, D. Smetters, J. Thornton, M. Plass, N, Briggs, and R. Braynard, "Networking Named Content," in Proc. ACM CoNEXT'09, Rome, Italy, Dec. 2009.

Ahlgren12
B. Ahlgren, C. Dannewitz, C. Imbrenda, D. Kutscher, and B. Ohlman, "A Survey of Information-Centric Networking," IEEE Communications Magazine, vol. 50, no. 7, July 2012, pp. 26-36. 

Zhang13
G. Zhang, Y. Li, and T. Lin, "Caching in Information Centric Networking: A Survey," Computer Networks, vol. 57, no. 16, Nov. 2013, pp. 3128-3141. 

Jin12
H. Jin,D. Xu, C. Zhao, and D. Liang, "Information-Centric Mobile Caching Network Frameworks and Caching Optimization: A Survey," EURASIP Journal on Wireless Communications and Networking, 2017: 33. doi:10.1186/s13638-017-0806-6. 

Bilal17Access
M. Bilal and S. Kang, "A Cache Management Scheme for Efficient Content Eviction and Replication in Cache Networks," IEEE Access, vol. 5, Feb. 2017, pp. 1692-1701. 

Bilal17Cluster
M. Bilal and S. Kang, "A Secure Key Agreement Protocol for Dynamic Group," Cluster Comput., vol. 20, no. 3,  Sep. 2017, pp. 2779–2792.

Zhang18
Q. Zhang, Y. Gan, and Q. Zhang, "A Dynamic and Cross-Domain Authentication Asymmetric Group Key Agreement in Telemedicine Application," IEEE Access, vol. 6, Jan. 2018, pp. 24064-24074.

Cho14
E. Cho, J. Shin, J. Choi, T. Kwon, and Y. Choi, "A Tradeoff between Caching Efficiency and Data Protection for Video Services in CCN," in Proc. NDSS SENT'14, San Diego, USA, Feb. 2014. 

Xiaobin16
T. Xiaobin, J. Liguo, Z. Zifei, and Y. Pei, "Copyright Protection Scheme for Information-Centric Networking Base on the Linear Network Coding," in Proc. CCC'16, Chengdu, China, July 2016.

Bilal18System
M. Bilal and S. Kang, "Network-Coding Approach for Information-Centric Networking," IEEE Systems Journal, August 2018, doi: 10.1109/JSYST.2018.2862913.

SMisra19
S. Misra, R. Tourani, F. Natividad, T. Mick, N. Majd, and H. Huang, "AccConF: An Access Control Framework for Leveraging In-Network Cached Data in the ICN-Enabled Wireless Edge," IEEE Transactions on Dependable and Secure Computing, vol. 16, no. 1, Jan. 2019, pp. 5-17.

SMisra13
 S. Misra, R. Tourani, and N. Majd, "Secure Content Delivery in Information-Centric Networks: Design Implementation and Analyses", in Proc. ACM SIGCOMM'13 ICN Workshop, Hong Kong, China, August 2013.

Wood14
 C. Wood and E. Uzun, "Flexible End-to-End Content Security in CCN", in Proc. IEEE CCNC'14, Las Vegas, United States, January 2014.


Qzheng15
 Q. Zheng, G. Wang, R. Ravindran, and A. Azgin "Achieving Secure and Scalable Data Access Control in Information-Centric Networking", in Proc. IEEE ICC'15, London, UK, June 2015.


Qli17
 Q. Li, R. Sandhu, X. Zhang, and M. Xu, "Mandatory Content Access Control for Privacy Protection in Information Centric Networks," IEEE Transactions on Dependable and Secure Computing, vol. 14, no. 5, Sept. 2017, pp. 494-506.

Mannes15
E. Mannes,  C. Maziero,  L. Lassance, and F. Borges, "Optimized Access Control Enforcement Over Encrypted Content in Information-Centric Networks," in Proc. ISCC'15, Larnaca, Cyprus, July 2015.

Chow10
S. Chow, J. Weng, Y. Yang, and R. Deng, “Efficient Unidirectional Proxy Re-encryption," in Proc. AFRICACRYPT'10, Stellenbosch, South Africa, May 2010.


Cremers06
C. Cremers, S Mauw, and E. Vink, "Injective Synchronisation: An Extension of the Authentication Hierarchy," Theoretical Computer Science, vol. 367, no. 1-2, Nov. 2006, pp. 1396-161.


Cremers12
C. Cremers and S. Mauw, "Security Properties," Springer Operational Semantics and Verification of Security Protocols, ISBN 978-3-540-78636-8, 2012. 

Bilal17JCS
M. Bilal and S. Kang, "Time-Assisted Authentication Protocol," Int J Commun Syst., vol. 30, no. 15, October 2017. 

Bilal17patent
M. Bilal and S. Kang, S. Kim, and J. Park, "Method and Apparatus for Providing Time-Assisted Authentication Protocol," U.S. Patent US20170134369A1, May 11, 2017.


koyama91
K. Koyama, U. Maurer, T. Okamoto, and S. Vanstone, "New Public-Key Schemes Based on Elliptic Curves over the Ring Zn," in Proc. CRYPTO'91, Santa Barbara, United States, August 1991. 

Wong06
Y. Wong, G. Attebury, and B. Ramamurthy, "A Survey of Security Issues In Wireless Sensor Networks," IEEE Communication Surveys and Tutorial, vol. 8, no. 2, 2nd Quarter 2006, pp. 2-23. 

Rivest94
R. Rivest, "The RC5 Encryption Algorithm," in Proc. FSE'94, Dec. 1994. 
DaemenAES
J. Daemen and R. Vincent, "AES Proposal: Rijndael. National Institute of Standards and Technology," Available online: <http://csrc.nist.gov/archive/aes/rijndael/Rijndaelammended.pdf>. 

SchneierTwo
B. Schneier, J. Kelsey, D. Whiting, D. Wagner, and C. Hal, "Twofish: A 128-Bit Block Cipher," Available online: <https://www.schneier.com/academic/paperfiles/paper-twofishpaper.pdf>. 

Burrows90
M. Burrows and R. Abadi, "A Logic of Authentication," ACM Trans. Comput. Syst, vol. 8, no. 1, Feb. 1990, pp. 18–36. 


Jakobsson17
M. Jakobsson and S. Stamm, "Web Camouflage: Protecting Your Clients from Browser-Sniffing Attacks," IEEE Security & Privacy, vol. 5, no. 6, Nov. 2017, pp. 16-24. 

Abdallah17
 E. AbdAllah, H. Hassanein, and M. Zulkernine, "A Survey of Security Attacks in Information-Centric Networking," IEEE Commun. Surveys Tuts., vol. 17, no. 3, 3rd Quart. 2015, pp. 1441-1454.

Klump10
R. Klump and M. Kwiatkowski, "Distributed IP Watchlist Generation for Intrusion Detection in the Electrical Smart Grid," Critical Infrastructure Protection IV, vol. 342, March 2010, pp. 113-126.

Wang18
K. Wang, Y. Zhao, S. Liu, and X. Tong, "On the Urgency of Implementing Interest NACK into CCN: from the Perspective of Countering Advanced Interest Flooding Attacks," IET Networks, vol. 7, no. 3, May 2018, pp. 136-140.

Xin16
Y. Xin, Y. Li, W. Wang, W. Li, and X. Chen, "A Novel Interest Flooding Attacks Detection and Countermeasure Scheme in NDN," in Proc. IEEE Globecom'16, Washington, D.C., United States, Dec. 2016. 

Tlau
T. Lauinger, N. Laoutaris, P. Rodriguez, T. Strufe, E. Biersack, and E. Kirda, "Privacy Risks in Named Data Networking: What Is the Cost of Performance," ACM SIGCOMM Computer Communication Review, vol. 42, no. 5, October 2012, pp. 54–57.

Nessett90
D. Nessett, "A Critique of the Burrows, Abadi and Needham logic," ACM SIGOPS Operating Systems Review, vol. 24, no. 2, April 1990, pp. 35-38.

Merkle1978
R. Merkle, "Secure Communications over Insecure Channels," Commun. ACM, vol. 21, no. 4, April 1978, pp. 294-299.

frash16
M. Frash, M. Turkanovic, S. Kumari, and M. Holbl, "An Efficient User Authentication and Key Agreement Scheme for Heterogeneous Wireless Sensor Network Tailored for the Internet of Things Environment," Ad Hoc Networks, vol. 36, no. 1, January 2016, pp. 152-176.

Mahood18
K. Mahmood, S. Chaudhry, H. Naqvi, S. Kumari, X. Li, and A. Sanaiah, "An Elliptic Curve Cryptography based Lightweight Authentication Scheme for Smart Grid Communication," Future Generation Computer Systems, vol. 81, April 2018, pp. 557-565.

SDPC_App
 M. Bilal and S. Pack, "Appendix: Secure Distribution of Protected Content in Information-Centric Networking," Available online, doi:10.13140/RG.2.2.21166.36164/1.

Bilal18VTC
M. Bilal, S. Kang, and S. Pack, "Effective Caching for the Secure Content Distribution in Information-Centric Networking," in Proc. IEEE VTC'18 Spring RAFNET Workshop, Porto, Portugal, June 2018.



[
    < g r a p h i c s >
]Muhammad Bilal(M'16) is an assistant professor of computer science in the Division of Computer and Electronic Systems Engineering at Hankuk University of Foreign Studies, Yongin, Rep. of Korea. He received his Ph.D. degree in Information and Communication Network Engineering from Korea University of Science and Technology, School of Electronics and Telecommunications Research Institute (ETRI) in 2017, M.S in computer engineering from Chosun University, Gwangju, Rep. of Korea in 2012, and B.Sc degree in computer systems engineering from University of Engineering and Technology, Peshawar, Pakistan in 2008. Prior to joining Hankuk University of Foreign Studies, he was a postdoctoral research fellow at Smart Quantum Communication Center, Korea University in 2017. He has served as a reviewer of various international Journals including IEEE Communications Magazine, IEEE Systems Journal, IEEE Access, IEEE Communications Letters, IEEE Transactions on Network and Service Management Journal of Network, IEEE IoT Journal, IEEE Transactions on Network Science and Engineering and Computer Applications, Personal and Ubiquitous Computing, and International Journal of Communication Systems. He has also served as a program committee member on many international conferences including IEEE VTC, IEEE IWCMC AI-IOT  and IEEE CCNC. He is an Editor of IEEE Future Directions Ethics and Policy in Technology Status and IEEE Future Directions Ethics and Policy in Technology Status. His primary research interests are Design and Analysis of Network Protocols, Network Architecture, Network Security, IoT, Named Data Networking, BlockChain, Cryptology and Future Internet.





[
    < g r a p h i c s >
]Sangheon Pack received the B.S. and
Ph.D. degrees from Seoul National University,
Seoul, South Korea, in 2000 and 2005, respectively. In 2007, he joined the faculty of Korea University, Seoul, Korea, where he is currently a Professor in the School of Electrical Engineering. He was the recipient of IEEE/Institute of Electronics and Information Engineers (IEIE) Joint Award for IT Young Engineers Award 2017, Korean Institute of Information Scientists and Engineers (KIISE) Young Information Scientist Award 2017, Korean Institute of Communications and Information Sciences (KICS) Haedong Young Scholar Award 2013, and IEEE ComSoc APB Outstanding Young Researcher Award. He served as a TPC vice-chair for information systems of IEEE WCNC 2020, a track chair of IEEE CCNC 2019, a TPC chair of EAI Qshine 2016, a publication co-chair of IEEE INFOCOM 2014 and ACM MobiHoc 2015, a co-chair of IEEE VTC 2010-Fall transportation track, and a publicity co-chair of IEEE SECON 2012. He is an editor of IEEE Internet of Things (IoT) Journal, Journal of Communications Networks (JCN), IET Communications, and he is a guest editor of IEEE Transactions on Emerging Topics in Computing (TETC). He is a senior member of the IEEE. His research interests include Future Internet, softwarized networking (SDN/NFV), information-centric networking (ICN)/delay tolerant networking (DTN), and vehicular networks. 



