Network-layer application-specific trust model

1. A computer-implemented method, comprising:

obtaining a stack requirement for a custom stack, wherein the stack requirement specifies at least a description for a verifier stack component which verifies a Content Object using a key identifier associated with a content producer, wherein the custom stack is configured by a transport framework based on specific requirements of an application, and wherein the description for the verifier component includes one or more of:

a listing of one or more trust checkers to instantiate in the verifier stack component, wherein a respective trust checker analyzes the Content Object to accept the Content Object, reject the Content Object, or defer verification of the Content Object to another trust checker;

an ordering for the one or more trust checkers in the verifier stack component; and

an implementation for the respective trust checker;

instantiating the verifier stack component in the custom stack; and

using the custom stack to obtain a verified Content Object, which involves:

pushing, to the custom stack, an Interest that includes a name for a piece of content and includes the key identifier associated with the content producer; and

receiving, from the custom stack, the Content Object which the verifier stack component has verified is signed by the content producer associated with the key identifier,

thereby facilitating the custom stack to verify the Content Object on behalf of the application without requiring the application to be involved in verifying the Content Object.

2. The method of claim 1 , further comprising processing the Content Object using the verifier stack component of the custom stack, wherein processing the Content Object involves:

using a verifier module to verify whether the Content Object is signed by the content producer associated with the key identifier; and

responsive to determining that the verifier module does not validate or invalidate the Content Object, processing the Content Object using one or more trust checkers to determine whether the Content Object is trustworthy.

3. The method of claim 2 , further comprising:

accepting the Content Object responsive to determining that at least one trust checker has determined the Content Object to be trustworthy.

4. The method of claim 2 , further comprising:

rejecting the Content Object responsive to determining that at least one trust checker has determined the Content Object to not be trustworthy.

5. The method of claim 1 , wherein the description of the verifier stack component includes a list of trusted certificate authorities.

6. The method of claim 1 , wherein the set of trust checkers includes one or more of:

a trust checker that rejects Content Objects with stale data;

a trust checker that rejects a public key which is not published under a white-list name prefix; and

a trust checker which verifies the Content Object using a Pretty Good Privacy (PGP) web of trust.

7. The method of claim 1 , further comprising:

receiving, from the application, a control statement for the custom stack, wherein the control statement includes a set of trust checkers to enable in the verifier stack component; and

enabling the set of trust checkers.

8. The method of claim 1 , further comprising:

receiving, from the application, a control statement for the custom stack, wherein the control statement includes a set of trust checkers to disable in the verifier stack component; and

disabling the set of trust checkers.

9. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, comprising:

obtaining a stack requirement for a custom stack, wherein the stack requirement specifies at least a description for a verifier stack component which verifies a Content Object using a key identifier associated with a content producer, wherein the custom stack is configured by a transport framework based on specific requirements of an application, and wherein the description for the verifier component includes one or more of:

a listing of one or more trust checkers to instantiate in the verifier stack component, wherein a respective trust checker analyzes the Content Object to accept the Content Object, reject the Content Object, or defer verification of the Content Object to another trust checker;

an ordering for the one or more trust checkers in the verifier stack component; and

an implementation for the respective trust checker;

instantiating the verifier stack component in the custom stack; and using the custom stack to obtain a verified Content Object, which involves:

pushing, to the custom stack, an Interest that includes a name for a piece of content and includes a the key identifier associated with the content producer; and

receiving, from the custom stack, the Content Object which the verifier stack component has verified is signed by the content producer associated with the key identifier,

thereby facilitating the custom stack to verify the content object on behalf of the application without requiring the application to be involved in verifying the content object.

10. The storage medium of claim 9 , wherein the method further comprises processing the Content Object using the verifier stack component of the custom stack, wherein processing the Content Object involves:

using a verifier module to verify whether the Content Object is signed by the content producer associated with the key identifier; and

responsive to determining that the verifier module does not validate or invalidate the Content Object, processing the Content Object using one or more trust checkers to determine whether the Content Object is trustworthy.

11. The storage medium of claim 10 , wherein the method further comprises:

accepting the Content Object responsive to determining that at least one trust checker has determined the Content Object to be trustworthy.

12. The storage medium of claim 10 , wherein the method further comprises:

rejecting the Content Object responsive to determining that at least one trust checker has determined the Content Object to not be trustworthy.

13. The storage medium of claim 9 , wherein the description of the verifier stack component includes a list of trusted certificate authorities.

14. The storage medium of claim 9 , wherein the set of trust checkers includes one or more of:

a trust checker that rejects Content Objects with stale data;

a trust checker that rejects a public key which is not published under a white-list name prefix; and

a trust checker which verifies the Content Object using a Pretty Good Privacy (PGP) web of trust.

15. The storage medium of claim 9 , wherein the method further comprises:

receiving, from the application, a control statement for the custom stack, wherein the control statement includes a set of trust checkers to enable or disable in the verifier stack component; and

enabling or disabling the set of trust checkers.

16. A computer system comprising:

a processor; and

a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising:

obtaining a stack requirement for a custom stack, wherein the stack requirement specifies at least a description for a verifier stack component which verifies a Content Object using a key identifier associated with a content producer, wherein the custom stack is configured by a transport framework based on specific requirements of an application, and wherein the description for the verifier component includes one or more of:

a listing of one or more trust checkers to instantiate in the verifier stack component, wherein a respective trust checker analyzes the Content Object to accept the Content Object, reject the Content Object, or defer verification of the Content Object to another trust checker;

an ordering for the one or more trust checkers in the verifier stack component; and

an implementation for the respective trust checker; and

instantiating the verifier stack component in the custom stack; and

using the custom stack to obtain a verified Content Object, which involves:

pushing, to the custom stack, an Interest that includes a name for a piece of content and includes a the key identifier associated with the content producer; and

receiving, from the custom stack, the Content Object which the verifier stack component has verified is signed by the content producer associated with the key identifier,

thereby facilitating the custom stack to verify the Content Object on behalf of the application without requiring the application to be involved in verifying the Content Object.

17. The computer system of claim 16 , further comprising processing the Content Object for the custom stack, wherein processing the Content Object involves:

verifying whether the Content Object is signed by the content producer associated with the key identifier; and

responsive to determining that the Content Object is not validated or invalidated, processing the Content Object using one or more trust checkers to determine whether the Content Object is trustworthy.

18. The computer system of claim 17 , wherein the method further comprises accepting the Content Object responsive to determining that at least one trust checker has determined the Content Object to be trustworthy.

19. The computer system of claim 17 , wherein the method further comprises rejecting the Content Object responsive to determining that at least one trust checker has determined the Content Object to not be trustworthy.

20. The computer system of claim 16 , wherein the description of the verifier stack component includes a list of trusted certificate authorities.

21. The computer system of claim 16 , wherein the set of trust checkers includes one or more of:

a trust checker that rejects Content Objects with stale data;

a trust checker that rejects a public key which is not published under a white-list name prefix; and

a trust checker which verifies the Content Object using a Pretty Good Privacy (PGP) web of trust.

22. The computer system of claim 16 , wherein the method further comprises:

receiving, from the application, a control statement that includes a set of trust checkers to enable or disable in the verifier stack component; and

enabling or disabling the set of trust checkers.