Access control framework for information centric networking

1. A computer-implemented method, comprising:

obtaining, by a computing device, a Manifest object for a data collection, wherein the Manifest includes references to a set of encrypted Content Objects of the data collection, includes one or more Access Control Specification (ACS) that each specifies a decryption protocol for decrypting one or more Content Objects of the data collection, and includes a respective ACS by reference;

obtaining a respective encrypted Content Object listed in the Manifest over an Information Centric Network (ICN);

obtaining, by the computing device from the Manifest, an ACS associated with the respective encrypted Content Object, which involves:

obtaining, from the Manifest, a name prefix associated with the ACS;

disseminating, over ICN, an Interest whose name includes the name prefix; and

responsive to disseminating the Interest, receiving a Contact Object that includes the ACS; and

decrypting, by the computing device, the respective encrypted Content Object using the decryption protocol specified in the ACS.

2. The method of claim 1 , further comprising:

disseminating an Interest for the data collection over ICN; and

responsive to disseminating the Interest, receiving the Manifest object over ICN.

3. The method of claim 1 , wherein decrypting the encrypted Content Object involves:

obtaining an encrypted key that corresponds to the encrypted Content Object;

obtaining a decapsulation key by performing the decryption protocol specified in the ACS;

decrypting the encrypted key, using the decapsulation key, to obtain a decryption key; and

decrypting the encrypted Content Object using the decryption key.

4. The method of claim 3 , wherein obtaining the decapsulation key involves:

obtaining a decapsulation-key name which identifies the decapsulation key;

following a keychain until a key node identified by the decapsulation-key name is reached, wherein a respective key node of the keychain includes a decryption key in encrypted form, and wherein the decryption key is capable of decrypting a decryption key of a next key node of the keychain; and

obtaining the decapsulation key from the identified key node.

5. The method of claim 4 , wherein the decryption keys are encrypted using one or more of:

a group-based encryption scheme; and

a broadcast encryption scheme.

6. A computer-implemented method, comprising:

obtaining, by a computing device, an initiation Manifest object for a data collection, wherein the initiation Manifest includes an Access Control Specification (ACS) that specifies an end-to-end access control scheme for obtaining and decrypting one or more Content Objects of the data collection;

obtaining a public key of a publisher from the ACS in the initiation Manifest;

determining, by the computing device from the ACS, an encryption algorithm for a session with the publisher;

disseminating a setup Interest message for the publisher, wherein the setup Interest message includes a temporary key encrypted using the determined encryption algorithm and the publisher's public key;

receiving a setup Content Object that satisfies the setup Interest message, wherein the setup Content Object includes a session key and a session identifier;

disseminating a finish Interest message for the publisher, wherein the finish Interest message includes the session identifier; and

receiving an in-session Manifest that satisfies the finish Interest message, wherein the in-session Manifest includes references to one or more Content Objects of the data collection that are encrypted using the session key.

7. The method of claim 6 , further comprising:

obtaining verification data from the setup Content Object;

verifying the session key using the verification data; and

in response to determining that the session key is valid, disseminating the finish Interest message.

8. The method of claim 6 , wherein verifying the session key involves:

computing a hash from one or more of the session key, a key identifier, and an identifier for the determined encryption algorithm; and

comparing the computed hash to the verification data.

9. The method of claim 6 , further comprising:

obtaining a respective Content Object listed in the in-session Manifest over an Information Centric Network (ICN); and

decrypting the respective Content Object using the session key.

10. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

obtaining a Manifest object for a data collection, wherein the Manifest includes references to a set of encrypted Content Objects of the data collection, includes one or more Access Control Specification (ACS) that each specifies a decryption protocol for decrypting one or more Content Objects of the data collection, and includes a respective ACS by reference;

obtaining a respective encrypted Content Object listed in the Manifest over an Information Centric Network (ICN);

obtaining, by the computing device from the Manifest, an ACS associated with the respective encrypted Content Object, which involves:

obtaining, from the Manifest, a name prefix associated with the ACS;

disseminating, over ICN, an Interest whose name includes the name prefix; and

responsive to disseminating the Interest, receiving a Contact Object that includes the ACS; and

decrypting the respective encrypted Content Object using the decryption protocol specified in the ACS.

11. The storage medium of claim 10 , further comprising:

disseminating an Interest for the data collection over ICN; and

responsive to disseminating the Interest, receiving the Manifest object over ICN.

12. The storage medium of claim 10 , wherein decrypting the encrypted Content Object involves:

obtaining an encrypted key that corresponds to the encrypted Content Object;

obtaining a decapsulation key by performing the decryption protocol specified in the ACS;

decrypting the encrypted key, using the decapsulation key, to obtain a decryption key; and

decrypting the encrypted Content Object using the decryption key.

13. The storage medium of claim 12 , wherein obtaining the decapsulation key involves:

obtaining a decapsulation-key name which identifies the decapsulation key;

following a keychain until a key node identified by the decapsulation-key name is reached, wherein a respective key node of the keychain includes a decryption key in encrypted form, and wherein the decryption key is capable of decrypting a decryption key of a next key node of the keychain; and

obtaining the decapsulation key from the identified key node.

14. The storage medium of claim 13 , wherein the decryption keys are encrypted using one or more of:

a group-based encryption scheme; and

a broadcast encryption scheme.

15. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

obtaining an initiation Manifest object for a data collection, wherein the initiation Manifest includes an Access Control Specification (ACS) that specifies an end-to-end access control scheme for obtaining and decrypting one or more Content Objects of the data collection;

obtaining a public key of a publisher from the ACS in the initiation Manifest;

determining, from the ACS, an encryption algorithm for a session with the publisher;

disseminating a setup Interest message for the publisher, wherein the setup Interest message includes a temporary key encrypted using the determined encryption algorithm and the publisher's public key;

receiving a setup Content Object that satisfies the setup Interest message, wherein the setup Content Object includes a session key and a session identifier;

disseminating a finish Interest message for the publisher, wherein the finish Interest message includes the session identifier; and

receiving an in-session Manifest that satisfies the finish Interest message, wherein the in-session Manifest includes references to one or more Content Objects of the data collection that are encrypted using the session key.

16. The storage medium of claim 15 , further comprising:

obtaining verification data from the setup Content Object;

verifying the session key using the verification data; and

in response to determining that the session key is valid, disseminating the finish Interest message.

17. The storage medium of claim 15 , wherein verifying the session key involves:

computing a hash from one or more of the session key, a key identifier, and an identifier for the determined encryption algorithm; and

comparing the computed hash to the verification data.

18. The storage medium of claim 15 , further comprising:

obtaining a respective Content Object listed in the in-session Manifest over an Information Centric Network (ICN); and

decrypting the respective Content Object using the session key.