Information firewall

1. A computer-implemented method, comprising:

obtaining an interest, by a computing device from a requesting entity over a content centric network, wherein the interest includes a location-independent structured name associated with a request for data;

obtaining the data associated with the location-independent structured name;

obtaining a policy associated with the data's location-independent structured name or name prefix;

determining a context for the interest;

determining whether the requesting entity is within a protected space for the obtained data as determined based on the policy and the context, wherein the protected space includes at least an application which is not suspect of having been compromised by an illegitimate user or software, and wherein determining that the requesting entity is within the protected space involves determining that a recent behavior profile for the requesting entity, as determined based in part on the context, is substantially similar to a previous behavior profile for the requesting entity; and

responsive to determining that the requesting entity is within the protected space, forwarding the data to the requesting entity over the content centric network.

2. The method 1 , wherein the requesting entity includes one or more of:

a computing node of a computer cluster;

a computing device of an Enterprise environment; and

a software application executed by a computing device.

3. The method of claim 1 , further comprising:

responsive to determining that the requesting entity is not within the protected space, requesting for an authorization from the requesting entity.

4. The method of claim 1 , further comprising:

responsive to determining that the interest is associated with a blacklisted namespace, blocking the data from being forwarded to the requesting entity.

5. The method of claim 1 , wherein determining that the requesting entity is within a protected space involves one or more of:

determining that the requesting entity is a trusted computing device;

determining that the requesting entity is a trusted software application;

determining that the requesting entity is coupled to a trusted computer network; and

determining that the context satisfies the policy's rules.

6. The method of claim 1 , further comprising:

selecting a namespace for which to control access;

determining one or more entities which have been provisioned for the namespace;

determining a network topology for the determined entities;

determining one or more interfaces to authorize for the selected namespace; and

generating a policy which authorizes access to the selected namespace, for the provisioned entities, and via the determined interfaces.

7. The method of claim 1 , wherein the context includes one or more of:

a hardware identifier;

a network address;

a biometric measurement;

a location identifier;

a location trace;

a user behavior;

a network behavior; and

an interest-related behavior.

8. The method of claim 1 , wherein obtaining the data associated with the location-independent structured name involves one or more of:

obtaining the data from a local repository; and

forwarding the interest to a remote computing device based on the location-independent structured name.

9. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

obtaining an interest, from a requesting entity over a content centric network, wherein the interest includes a location-independent structured name associated with a request for data;

obtaining the data associated with the location-independent structured name;

obtaining a policy associated with the data's location-independent structured name or name prefix;

determining a context for the interest;

determining whether the requesting entity is within a protected space for the obtained data as determined based on the policy and the context, wherein the protected space includes at least an application which is not suspect of having been compromised by an illegitimate user or software, and wherein determining that the requesting entity is within the protected space involves determining that a recent behavior profile for the requesting entity, as determined based in part on the context, is substantially similar to a previous behavior profile for the requesting entity; and

responsive to determining that the requesting entity is within the protected space, forwarding the data to the requesting entity over the content centric network.

10. The storage medium 9 , wherein the requesting entity includes one or more of:

a computing node of a computer cluster;

a computing device of an Enterprise environment; and

a software application executed by a computing device.

11. The storage medium of claim 9 , wherein the method further comprises:

responsive to determining that the requesting entity is not within the protected space, requesting for an authorization from the requesting entity.

12. The storage medium of claim 9 , wherein the method further comprises:

responsive to determining that the interest is associated with a blacklisted namespace, blocking the data from being forwarded to the requesting entity.

13. The storage medium of claim 9 , wherein determining that the requesting entity is within a protected space involves one or more of:

determining that the requesting entity is a trusted computing device;

determining that the requesting entity is a trusted software application;

determining that the requesting entity is coupled to a trusted computer network; and

determining that the context satisfies the policy's rules.

14. The storage medium of claim 9 , wherein the method further comprises:

selecting a namespace for which to control access;

determining one or more entities which have been provisioned for the namespace;

determining a network topology for the determined entities;

determining one or more interfaces to authorize for the selected namespace; and

generating a policy which authorizes access to the selected namespace, for the provisioned entities, and via the determined interfaces.

15. The storage medium of claim 9 , wherein the context includes one or more of:

a hardware identifier;

a network address;

a biometric measurement;

a location identifier;

a location trace;

a user behavior;

a network behavior; and

an interest-related behavior.

16. The storage medium of claim 9 , wherein obtaining the data associated with the location-independent structured name involves one or more of:

obtaining the data from a local repository; and

forwarding the interest to a remote computing device based on the location-independent structured name.

17. An apparatus, comprising:

an interest-processing module configured to obtain an interest from a requesting entity over a content centric network, wherein the interest includes a location-independent structured name associated with a request for data;

a data-obtaining module to obtain the data associated with the location-independent structured name;

a policy-managing module to obtain a policy associated with the data's location-independent structured name or name prefix;

a context-determining module to determine a context for the interest; and

a data-providing module to:

determine whether the requesting entity is within a protected space for the obtained data, as determined based on the policy and the context, wherein the protected space includes at least an application which is not suspect of having been compromised by an illegitimate user or software, and wherein determining that the requesting entity is within the protected space involves determining that a recent behavior profile for the requesting entity, as determined based in part on the context, is substantially similar to a previous behavior profile for the requesting entity;

responsive to determining that the requesting entity is within the protected space, provide the data to the requesting entity over the content centric network.

18. The apparatus 17 , wherein the requesting entity includes one or more of:

a computing node of a computer cluster;

a computing device of an Enterprise environment; and

a software application executed by a computing device.

19. The apparatus of claim 17 , wherein the data-providing module is further configured to:

responsive to determining that the requesting entity is not within the protected space, requesting for an authorization from the requesting entity.

20. The apparatus of claim 17 , wherein the data-providing module is further configured to:

determine whether the interest is associated with a blacklisted namespace; and

responsive to determining that the interest is associated with a blacklisted namespace, blocking the data from being forwarded to the requesting entity.

21. The apparatus of claim 17 , wherein determining that the requesting entity is within the protected space involves one or more of:

determining that the requesting entity is a trusted computing device;

determining that the requesting entity is a trusted software application;

determining that the requesting entity is coupled to a trusted computer network; and

determining that the context satisfies the policy's rules.

22. The apparatus of claim 17 , further comprising a protected-space-defining module to:

select a namespace for which to control access;

determine one or more entities which have been provisioned for the namespace;

determine a network topology for the determined entities;

determine one or more interfaces to authorize for the selected namespace; and

generate a policy which authorizes access to the selected namespace, for the provisioned entities, and via the determined interfaces.

23. The apparatus of claim 17 , wherein the context includes one or more of:

a hardware identifier;

a network address;

a biometric measurement;

a location identifier;

a location trace;

a user behavior;

a network behavior; and

an interest-related behavior.

24. The apparatus of claim 17 , wherein while obtaining the data associated with the location-independent structured name, the data-obtaining module is further configured to:

obtain the data from a local repository; or

forward the interest to a remote computing device based on the location-independent structured name.