Securing Content Sharing over ICN

Abstract

The emerging Information-Centric Networking (ICN) paradigm is expected to facilitate content sharing among users. ICN will make it easy for users to appoint storage nodes, in various network locations, perhaps owned or controlled by them, where shared content can be stored and disseminated from. These storage nodes should be (somewhat) trusted since not only they have (some level of) access to user shared content, but they should also properly enforce access control. Traditional forms of encryption introduce significant overhead when it comes to sharing content with large and dynamic groups of users. To this end, proxy re-encryption provides a convenient solution. In this paper, we use Identity-Based Proxy Re-Encryption (IB-PRE) to provide confidentiality and access control for content items shared over ICN, realizing secure content distribution among dynamic sets of users. In contrast to similar IB-PRE based solutions, our design allows each user to generate the system parameters and the secret keys required by the underlay encryption scheme using their own Private Key Generator, therefore, our approach does not suffer from the key escrow problem. Moreover, our design further relaxes the trust requirements on the storage nodes by preventing them from sharing usable content with unauthorized users. Finally, our scheme does not require out-of-band secret key distribution.

Name-Based Security for Information-Centric Networking Architectures

“…For this solution, we leverage IB-PRE to provide access control on content items stored in network endpoints outside the administrative realm of the content owner, as in [19]. We assume that each content item is encrypted by the content owner using a symmetric encryption algorithm (each item with a different key) and each item is protected by an access control policy.…”

“…Moreover, storage endpoints learn no secret information. For a more thorough security analysis of this solution, interested readers are referred to [19].…”

A keyword-based ICN-IoT platform

“…We argue that local processing of data within an edge IoT domain can provide better privacy and security compared to cloud-based systems that perform both storage and processing in the cloud. To that end, we envision a proxy reencryption (PRE) based access control scheme similar to the one proposed by Fotiou et al [17], which would allow encryption of processed IoT data before sending it to untrusted parties for better privacy and security. Using the proxy reencryption mechanism, a delegator (e.g., local processing node) can enforce the data access control policies of the IoT domain at an untrusted delegatee (e.g., remote storage services) when encrypted data are shared.…”

Rendezvous‐based access control for information‐centric architectures

“…Although our solution is specific to PSI, it can be generalized to any rendezvous‐based ICN architecture, ie, an architecture where a centralized network entity mediates content demand and supply. Our solution is built on our previous works described in Fotiou et al and Fotiou and Polyzos . In particular, the security mechanisms discussed in Fotiou and Polyzos are applied to the solution presented in Fotiou et al so as to remove the need for a trusted entity (in Fotiou et al, this entity is referred to as the Access Control Provider ).…”

“…Our solution is built on our previous works described in Fotiou et al and Fotiou and Polyzos . In particular, the security mechanisms discussed in Fotiou and Polyzos are applied to the solution presented in Fotiou et al so as to remove the need for a trusted entity (in Fotiou et al, this entity is referred to as the Access Control Provider ). As a consequence, this work adds significant less communication overhead compared to Fotiou et al…”