Method and system for mitigating interest flooding attacks in content-centric networks
View Patent ↗One embodiment of the present invention provides a system for mitigating interest flooding attacks in content-centric networks (CCNs). During operation, the system receives, at a physical interface of a router, an interest packet; obtains current interest satisfaction statistics associated with the physical interface; and determines whether to forward or drop the interest packet based on the current interest satisfaction statistics.
1. A method for mitigating Interest flooding attacks in content-centric networks (CCNs), comprising:
receiving, by a network device via a physical interface of the network device, Interest packets for one or more name prefixes;
counting a number of Interests received via the physical interface and deleted from a pending Interest table due to a timeout;
computing Interest satisfaction statistics for the physical interface based on the counted Interests; and
in response to receiving an Interest packet for a target name prefix, determining whether to forward or drop the Interest packet based on the Interest satisfaction statistics for the target name prefix.
2. The method of claim 1 , wherein the Interest satisfaction statistics associated with the physical interface further comprise at least one of:
per-interface based Interest satisfaction statistics;
per-name-prefix-per-interface based Interest satisfaction statistics;
per-face based Interest satisfaction statistics;
per-name-prefix-per-face based Interest satisfaction statistics;
per-virtual-interface based Interest satisfaction statistics; and
per-name-prefix-per-virtual-interface based Interest satisfaction statistics.
3. The method of claim 1 , wherein the interest satisfaction statistics further comprises a ratio between satisfied Interest packets and received Interest packets.
4. The method of claim 3 , wherein determining whether to forward or drop the Interest packet is further based on the ratio between the satisfied Interest packets and the received Interest packets.
5. The method of claim 3 , wherein determining whether to forward or drop the Interest packet involves:
receiving, from a neighboring router, an outstanding Interest limit announcement indicating a maximum number of Interest packets acceptable by the neighboring router; and
assigning an outstanding Interest limit for the physical interface based on the Interest satisfaction statistics and the maximum number of the outstanding Interest packets acceptable by the neighboring router, wherein an outstanding Interest is an Interest that is not satisfied an not yet and not yet expired.
6. The method of claim 1 , wherein computing Interest satisfaction statistics further comprises:
determining whether an Interest packet has been satisfied by a corresponding data packet.
7. The method of claim 1 , further comprising updating the Interest satisfaction statistics subsequent to the Interest packet being satisfied or expired.
8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for mitigating Interest flooding attacks in content-centric networks (CCNs), the method comprising:
receiving, by a network device via a physical interface of the network device, Interest packets for one or more name prefixes;
counting a number of Interests received via the physical interface and deleted from a pending Interest table due to a timeout;
computing Interest satisfaction statistics for the physical interface based on the counted Interests; and
in response to receiving an Interest packet for a target name prefix, determining whether to forward or drop the Interest packet based on the Interest satisfaction statistics for the target name prefix.
9. The computer-readable storage medium of claim 8 , wherein the Interest satisfaction statistics associated with the physical interface further comprise at least one of:
per-interface based Interest satisfaction statistics;
per-name-prefix-per-interface based Interest satisfaction statistics;
per-face based Interest satisfaction statistics;
per-name-prefix-per-face based Interest satisfaction statistics;
per-virtual-interface based Interest satisfaction statistics; and
per-name-prefix-per-virtual-interface based Interest satisfaction statistics.
10. The computer-readable storage medium of claim 8 , wherein the Interest satisfaction statistics further comprises a ratio between satisfied Interest packets and received Interest packets.
11. The computer-readable storage medium of claim 10 , wherein determining whether to forward or drop the Interest packet is further based on the ratio between the satisfied Interest packets and the received Interest packet.
12. The computer-readable storage medium of claim 10 , wherein determining whether to forward or drop the Interest packet involves:
receiving, from a neighboring router, an outstanding Interest limit announcement indicating a maximum number of Interest packets acceptable by the neighboring router; and
assigning an outstanding Interest limit for the physical interface based on the Interest satisfaction statistics and the maximum number of the outstanding Interest packets acceptable by the neighboring router, wherein an outstanding Interest is an Interest that is not satisfied and not yet expired.
13. The computer-readable storage medium of claim 8 , wherein computing Interest satisfaction statistics further comprises:
determining whether an Interest packet has been satisfied by a corresponding data packet.
14. The computer-readable storage medium of claim 8 , wherein the method further comprises updating the Interest satisfaction statistics subsequent to the Interest packet being satisfied or expired.
15. A router in a content-centric network (CCN) for mitigating Interest flooding attacks, comprising:
a physical interface for receiving Interest packets for one or more name prefixes;
an Interest counter configured to count a number of Interests received via the physical interface and deleted from a pending Interest table due to a timeout;
an Interest satisfaction statistics calculator configured to compute Interest satisfaction statistics for the physical interface based on the counted Interests; and
a determination mechanism configured to determine whether to forward or drop an Interest packet based on the Interest satisfaction statistics for a target name prefix, in response to receiving the Interest packet for the target name prefix.
16. The router of claim 15 , wherein the Interest satisfaction statistics associated with the physical interface further comprise at least one of:
per-interface based Interest satisfaction statistics;
per-name-prefix-per-interface based Interest satisfaction statistics;
per-face based Interest satisfaction statistics;
per-name-prefix-per-face based Interest satisfaction statistics;
per-virtual-interface based Interest satisfaction statistics; and
per-name-prefix-per-virtual-interface based Interest satisfaction statistics.
17. The router of claim 15 , wherein the Interest satisfaction statistics further comprises a ratio between satisfied Interest packets and received Interest packets.
18. The router of claim 17 , wherein the determination mechanism is configured to determine whether to forward or drop the Interest packet further based on the ratio between the satisfied Interest packets and the received Interest packets.
19. The router of claim 17 , wherein while determining whether to forward or drop the Interest packet, the determination mechanism is further configured to:
receive, from a neighboring router, an outstanding Interest limit announcement indicating a maximum number of Interest packets acceptable by the neighboring router; and
assign an outstanding Interest limit for the physical interface based on the Interest satisfaction statistics and the maximum number of the outstanding Interest packets acceptable by the neighboring router, wherein an outstanding Interest is an Interest that is not satisfied and not yet expired.
20. The router of claim 19 , wherein the Interest limit announcement is included in one of:
a gossip protocol message;
a router control message; and
a router heartbeat message.
21. The router of claim 15 , wherein the Interest satisfaction statistics calculator is further configured to:
determine whether an Interest packet has been satisfied by a corresponding data packet.
22. The router of claim 15 , wherein the Interest satisfaction statistics calculator is further configured to update the Interest satisfaction statistics subsequent to the Interest packet being satisfied or expired.