Augmenting name/prefix based routing protocols with trust anchor in information-centric networks

1. An apparatus comprising:

a memory;

a processor coupled to the memory, wherein the memory contains instructions that when executed by the processor cause the apparatus to:

receive an information centric network (ICN) name prefix announcement message comprising:

a message prefix specific to a content publisher node coupled to or comprised within the ICN;

a public key encryption certificate specific to the content publisher; and

a digital signature specific to the content publisher;

verify the signature with a name registration service (NRS); and

update internal data indicating that the content publisher is a trusted publisher, wherein the internal data comprises the prefix, the public key, and the signature.

2. The apparatus of claim 1 , wherein the internal data comprises a forwarding table for identifying the interface over which a packet should be forwarded.

3. The apparatus of claim 1 , wherein verifying the signature with a name registration service comprises verifying that the name registration service received the signature and additional identity verifying information from the content publisher.

4. The apparatus of claim 1 , wherein the instructions further cause the apparatus to generate a keyed-hash message authentication code (HMAC) for exchanging data with a router.

5. The apparatus of claim 4 , wherein the prefix announcement message further comprises a second HMAC, wherein the instructions further cause the apparatus to verify the first HMAC against the second HMAC, wherein the prefix announcement message is accepted when the verification passes, and wherein the prefix announcement message is dropped when the verification fails.

6. The apparatus of claim 1 , wherein the instructions further cause the apparatus to establish a secure session key (SSK) with a router.

7. The apparatus of claim 1 , wherein the instructions further cause the apparatus to:

receive an ICN name prefix revocation message comprising:

the message prefix specific to the content publisher;

the public key encryption certificate specific to the content publisher; and

the signature specific to the content publisher;

verify the signature with the NRS; and

update internal data to revoke the prefix.

8. A computer program product comprising computer executable instructions stored on a non-transitory medium that when executed by a processor cause the processor to:

receive, via a first face, an information centric network (ICN) name prefix announcement message comprising a prefix and a digital signature;

query a data table for a table entry corresponding to the first face, the prefix, and the signature;

forward the prefix announcement via a second face when the table entry exists in the table; and

when the table entry does not exist in the table:

send a signature verification request to a name registration service (NRS), wherein the request comprises the signature;

drop the prefix announcement message when a verification failure indication is received from the NRS in response to the request; and

when a verification confirmation indication is received from the NRS in response to the request:

create the table entry corresponding to the first face, the prefix, and the signature; and

forward the prefix announcement message via the second face.

9. The computer program product, stored on the non-transitory medium, of claim 8 , wherein when the table entry does not exist in the table the instructions further cause the processor to:

query the table for a second table entry corresponding to a third face, the prefix, and the signature; and

when the second table entry exists, forward the prefix announcement message via the third face.

10. The computer program product, stored on the non-transitory medium, of claim 8 , wherein the name prefix announcement message further comprises a public key certificate.

11. The computer program product, stored on the non-transitory medium, of claim 10 , wherein the instructions further cause the processor to:

generate a hash value for the public key certificate; and

replace the public key certificate with the hash value prior to forwarding the data request via the second face.

12. The computer program product, stored on the non-transitory medium, of claim 8 , wherein the data request further comprises a keyed-hash message authentication code (HMAC).

13. The computer program product, stored on the non-transitory medium, of claim 12 , wherein the instructions further cause the processor to:

generate a second HMAC; compare the first HMAC with the second HMAC; and

drop the name prefix announcement message when the comparison indicates that the data request is not authentic.

14. A method of executing a name prefix based routing protocol, comprising:

receiving a first information centric network (ICN) name prefix announcement message comprising a prefix, a signature, and a public key certificate;

querying a routing table for an entry corresponding to the first prefix announcement message, wherein the routing table comprises prefix, signature, and public key encryption certificate fields for each entry fields;

forwarding the first prefix announcement message upon receiving confirmation that the entry exists in the routing table; and

upon receiving confirmation that the entry does not exist in the routing table:

sending a signature verification request to a name registration service (NRS);

dropping the first prefix announcement message upon receipt of a verification failure indication from the NRS; and

upon receiving verification confirmation from the NRS:

creating the routing table entry corresponding to the prefix, the signature, and the public key; and

sending a second prefix announcement message via a second face.

15. The method of claim 14 , wherein the first prefix announcement message is received via a first face, wherein the routing table comprises a second entry for the prefix, the signature, and the public key certificate corresponding to a third face, wherein the routing table does not comprise an entry for the prefix, the signature, and the public key certificate corresponding to the first face, and further comprising forwarding a third prefix announcement message along the third face.

16. The method of claim 14 , wherein the second face utilizes a link-based secure session key (SSK).

17. The method of claim 16 , wherein the confirmation from the NRS indicates that the NRS created the signature in response to a publisher request for authorization coupled with additional publisher-supplied authorizing information.

18. The method of claim 14 , further comprising:

receiving an ICN prefix revocation message comprising the prefix, the signature, and the public key certificate;

verifying the signature with the NRS; and

updating the routing table to revoke the prefix.

19. The method of claim 14 , further comprising generating a keyed-hash message authentication code (HMAC) for exchanging data with a router.

20. The method of claim 19 , wherein the data request further comprises a second HMAC, the method further comprising:

verifying the first HMAC against the second HMAC;

forwarding the data request when the verification passes; and

dropping the data request when the verification fails.