Patent Application
20180219871
The present disclosure relates to information centric networking (ICN), such as content centric networking (CCN), and in particular to lightweight integrity verification of fragmented chunks in an ICN or CCN network.
Internet Protocol (IP) forwarding is based on host-to-host communication utilizing host addresses. Communications are assumed to take place between two static end points. IP forwarding is sender-oriented, i.e., the receiver has no control of specifying the properties related to the information it desires, for example, content version, publisher, etc. Considering the growth in user driven multimedia content today, content distribution network (CDN) has been developed to support content distribution. However, CDN is a technology overlaid over IP and is application specific.
As an alternative approach, information centric networking (ICN), such as content centric networking (CCN), addresses these issues by shifting the communication paradigm from a host-centric to a content-centric model. User requests are translated into packet data units that contain the name of the information sought with associated metadata. A router, upon receiving such a query, resolves it to itself if it has a cached copy of the data or forwards it along the direction where the content can be obtained.
Methods, apparatus, and systems are provided for lightweight integrity verification of fragmented chunks in an information centric network. Various examples are now described to introduce a selection of concepts in a simplified form that are further described below in the detailed description. The Summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.
In example 1, a method of securely providing data from a producer includes segmenting a data file into multiple chunks of data using a processor of the producer, and dividing each of the multiple chunks into virtual fragments based on a maximum transmission unit size using the processor. Using the processor, hash values are calculated using the virtual fragments, and a manifest is created using the hash values. Using the processor, the manifest is provided to a consumer based on a received interest for comparison and integrity verification of virtual fragments.
In example 2, the method also includes adding the hashes to a manifest file accessible to the consumer. In example 3, calculating hash values includes using a bloom filter for each of the multiple chunks. In example 4, using a bloom filter includes passing the virtual fragments to one or more hash functions, where the bloom filter represents the hash value of a corresponding chunk. In example 5, hash values are provided to an information centric network router for comparison and integrity verification of virtual fragments, in an embodiment. A size of a chunk is a multiple of a size of the virtual fragment, in example 6. The last chunk may be smaller than the size of the virtual fragment, in an embodiment. Each virtual fragment includes data from a single chunk, in example 7.
Example 8 provides a method implemented by an information centric network router. The method includes using a processor of the router to receive an interest for a data file segment from a consumer, and to send the interest to a content producer. A fragment of the data file segment is received from the producer in response to the interest, along with a fragment header, and the fragment is divided into virtual fragments based on a maximum transmission unit size. A hash value of the virtual fragment is compared to the fragment header to verify the integrity of the virtual fragment, and the virtual fragment is stored if the integrity was verified, in various embodiments.
In example 9, comparing a hash value of the virtual fragment to the fragment header to verify the integrity of the virtual fragment includes comparing the virtual fragment on a hop-by-hop basis. The method further includes assembling a chunk using the stored virtual fragments, in example 10, and forwarding the chunk to the consumer after assembling the chunk, in example 11. In example 12, the method includes dividing the fragment into virtual fragments using a bloom filter.
Example 13 provides a network enabled computer system including a processor and a storage device coupled to the processor. The storage device includes instructions to cause the processor to execute operations including segmenting a data file into multiple chunks of data, and dividing each of the multiple chunks into virtual fragments based on a maximum transmission unit size. Hash values are calculated using the virtual fragments, and a manifest is created using the hash values. The manifest is provided for use by consumer for comparison and integrity verification of virtual fragments, in various embodiments.
In example 14, calculating hash values using the virtual fragments includes calculating hash values on a hop-by-hop basis. The storage device includes instructions to cause the processor to add the hashes to a manifest file accessible to the consumer, in example 15. In example 16, the storage device includes instructions to cause the processor to calculate hash values includes using a bloom filter for each of the multiple chunks. In example 17, the storage device includes instructions to cause the processor to pass the virtual fragments to one or more hash functions, where the bloom filter represents the hash value of a corresponding chunk. The storage device includes instructions to cause the processor to provide hash values to an information centric network router for comparison and integrity verification of virtual fragments, in example 18. In example 19, a size of a chunk is a multiple of a size of the virtual fragment. Each virtual fragment includes data from a single chunk, in example 20.
This Summary is an overview of some of the teachings of the present application and not intended to be an exclusive or exhaustive treatment of the present subject matter. Further details about the present subject matter are found in the detailed description and appended claims. The scope of the present invention is defined by the appended claims and their legal equivalents.
In the following description, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration specific embodiments which may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention, and it is to be understood that other embodiments may be utilized and that structural, logical and electrical changes may be made without departing from the scope of the present invention. The following description of example embodiments is, therefore, not to be taken in a limited sense, and the scope of the present invention is defined by the appended claims.
Information centric networking (ICN), such as content centric networking (CCN), shifts the communication paradigm from a host-centric to a content-centric model. User (or consumer) requests are translated into packet data units that contain the name of the information sought with associated metadata. A router, upon receiving such a query (or interest), resolves it to itself if it has a cached copy of the data or forwards it along the direction where the content can be obtained (the producer). The data is handled in segments called chunks. Chunks are created by segmentation of a data file, followed by calculation of hashes for the chunks, and publication of a manifest based on the hashes, according to various embodiments. A consumer fetches the manifest file, gets the hashes available in a chunk file, and requests data based on their hashes.
Fragmentation is used for chunks that are larger than a maximum transmission unit (MTU). Two types of fragmentation may be used, end-to-end fragmentation or hop-by-hop fragmentation. End-to-end fragmentation includes producer fragmentation of chunked data according to the MTU carried by the including interest. Hop-by-hop fragmentation includes re-fragmenting chunked data at each intermediate router.
The data is forwarded using forwarding rules, including hop-by-hop with assembly or cut-through switching. In hop-by-hop with assembly, the intermediate routers assemble all frames, check chunk integrity using hash values, and then fragment the chunk before forwarding. In cut-through switching, the intermediate routers forward the packets as soon as they are received, and reassembly is done at the end or host. Currently in ICN or CCN, if a chunk of data is corrupted, it may waste resources of the intermediate routers. An improved method and apparatus to verify integrity of fragmented chunks in an information centric network is needed.
The present subject matter provides verification of fragmented chunks to identify chunk corruption closer to the provider or producer, using a lightweight algorithm to preserve network resources. An improved method to create chunk hashes (referred to as contentObjectHash) is included that provides for rapid detection of corrupted chunks, in various embodiments. Thus, the present subject matter reduces the chances of distributed denial of service (DDoS) attacks from packet reassembly.
One aspect provides a method for a producer of data to create a manifest file, as shown in
In various embodiments, the method also includes adding the hashes to a manifest file accessible to the consumer. In one embodiment, calculating hash values includes using a bloom filter for each of the virtual fragments. Various embodiments include passing the virtual fragments to one or more hash functions, where the bloom filter represents the hash value of a corresponding chunk. The present subject matter provides a novel method of creating a manifest, or metadata file, using the hash values of virtual fragments. The manifest is provided to a consumer based on a received interest, in an embodiment. A size of a chunk is a multiple of a size of the virtual fragment, in various embodiments. Each virtual fragment includes data from a single chunk, in an embodiment.
Another aspect provides a method implemented by an information centric network router, as shown in
According to various embodiments, comparing a hash value of the virtual fragment to the fragment header to verify the integrity of the virtual fragment includes comparing the virtual fragment on a hop-by-hop basis. The method further includes assembling a chunk using the stored virtual fragments, in an embodiment, and forwarding the chunk to the consumer after assembling the chunk. Various embodiments include dividing the fragment into virtual fragments using a bloom filter.
A further aspect provides a network enabled computer system including a processor and a storage device coupled to the processor. The storage device includes instructions to cause the processor to execute operations including segmenting a data file into multiple chunks of data, and dividing each of the multiple chunks into virtual fragments based on a maximum transmission unit size. Hash values are calculated using the virtual fragments, and a manifest is created using the hash values. Hash values are provided for use by an information centric network router for comparison and integrity verification of virtual fragments, in various embodiments.
According to various embodiments, calculating hash values using the virtual fragments includes calculating hash values on a hop-by-hop basis. The storage device includes instructions to cause the processor to add the hashes to a manifest file accessible to the consumer, in various embodiments. According to various embodiments, the storage device includes instructions to cause the processor to calculate hash values includes using a bloom filter for each of the virtual fragments, and to cause the processor to pass the virtual fragments to one or more hash functions, where the bloom filter represents the hash value of a corresponding chunk. The storage device includes instructions to cause the processor to provide the manifest to a consumer based on a received interest, in an embodiment. In one embodiment, a size of a chunk is a multiple of a size of the virtual fragment. Each virtual fragment includes data from a single chunk, in an embodiment.
The functions or algorithms described herein may be implemented in software in one embodiment. The software may consist of computer executable instructions stored on computer readable media or computer readable storage device such as one or more non-transitory memories or other type of hardware based storage devices, either local or networked. Further, such functions correspond to modules, which may be software, hardware, firmware or any combination thereof. Multiple functions may be performed in one or more modules as desired, and the embodiments described are merely examples. The software may be executed on a digital signal processor, ASIC, microprocessor, or other type of processor operating on a computer system, such as a personal computer, server or other computer system, turning such computer system into a specifically programmed machine.
One example computing device in the form of a computer 800 may include a processing unit 802, memory 803, removable storage 810, and non-removable storage 812 coupled by a bus 820. Although the example computing device is illustrated and described as computer 800, the computing device may be in different forms in different embodiments. For example, the computing device may instead be a smartphone, a tablet, smartwatch, router, or other computing device including the same or similar elements as illustrated and described with regard to
Memory 803 may include volatile memory 814 and/or non-volatile memory 808. Computer 800 may include—or have access to a computing environment that includes—a variety of computer-readable media, such as volatile memory 814 and/or non-volatile memory 808, removable storage 810 and/or non-removable storage 812. Computer storage includes random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM) or electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD ROM), Digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium capable of storing computer-readable instructions. Storage can also include networked storage such as a storage area network (SAN).
Computer 800 may include or have access to a computing environment that includes input 806, output 804, and a communication interface 816. In various embodiments, communication interface 816 includes a transceiver and an antenna. Output 804 may include a display device, such as a touchscreen, that also may serve as an input device. The input 806 may include one or more of a touchscreen, touchpad, mouse, keyboard, camera, one or more device-specific buttons, one or more sensors 807 integrated within or coupled via wired or wireless data connections to the computer 800, or other input devices. The computer may operate in a networked environment using a communication connection to connect to one or more remote computers, such as database servers. The remote computer may include a personal computer (PC), server, router, network PC, a peer device or other common network node, or the like. The communication connection may include a Local Area Network (LAN), a Wide Area Network (WAN), cellular, WiFi, Bluetooth, or other networks.
Computer-readable instructions, i.e., a program 818, comprises instructions stored on a computer-readable medium that are executable by the processing unit 802 of the computer 800. The terms computer-readable medium and storage device do not include carrier waves to the extent carrier waves are deemed too transitory.
In one example, the processing unit 802 executes the program 818 to receive an interest for a data file segment from a consumer, and send the interest to a content producer. A fragment of the data file segment is received from the producer in response to the interest, and the fragment is divided into virtual fragments based on a maximum transmission unit size. The virtual fragment is compared to a manifest to verify the integrity of the virtual fragment, and the virtual fragment is stored if the integrity was verified, in various embodiments.
Although a few embodiments have been described in detail above, other modifications are possible. For example, the logic flows depicted in the figures do not require the particular order shown, or sequential order, to achieve desirable results. Other steps may be provided, or steps may be eliminated, from the described flows, and other components may be added to, or removed from, the described systems. Other embodiments may be within the scope of the following claims.
