CN109040163B

CN109040163B - Named data network privacy protection caching decision method based on k anonymity

Info

Publication number: CN109040163B
Application number: CN201810381113.9A
Authority: CN
Inventors: 柳毅; 李小燕; 凌捷
Original assignee: Guangdong University of Technology
Current assignee: Guangdong University of Technology
Priority date: 2018-04-25
Filing date: 2018-04-25
Publication date: 2021-03-30
Anticipated expiration: 2038-04-25
Also published as: CN109040163A

Abstract

The invention relates to a named data network privacy protection caching decision method based on k anonymity, which is characterized in that caching decision is only carried out on a node where a user sends a request, and the neighbor node to which the named data network is cached is decided according to the cache replacement rate of the node. Even if an attacker can know that the content has been accessed recently, the attacker cannot deduce which user has accessed the content recently through which router because of the cache cooperation in the region, so that the attacker can be prevented from detecting the privacy information of the requester, and the privacy of the requester can be effectively protected. Moreover, the user anonymous area is expanded by means of neighbor cooperative caching to protect the caching privacy, the router does not need to execute construction of the anonymous area, data searching in the anonymous area is not needed, the implementation difficulty of the anonymous area is reduced, and the time delay of local users for acquiring data is reduced.

Description

Named data network privacy protection caching decision method based on k anonymity

Technical Field

The invention relates to the technical field of named data network privacy protection, in particular to a named data network privacy protection caching decision method based on k anonymity.

Background

With the continuous progress and development of internet information technology, the main functions of the internet have become efficient and secure acquisition and distribution of content. The initial network based on the TCP/IP protocol has the defects of insufficient IPv4 addresses, more network security loopholes, low network service quality and the like. The internet of the TCP/IP network system also has a serious resource waste, which is a problem of a large amount of repeated content transmission. To address the fundamental problems of TCP/IP networks, a revolutionary future Network architecture, Information-Centric Network (ICN) (Vasilakos A V, Li Z, Simon G, et al. Information-Centric Network: research scales and opportunities [ J ]. Journal of Network and Computer Applications 2015, 52: 1-10.) was proposed to meet the future development requirements for efficient, large-scale, secure content acquisition and transmission over the Internet. Among several representative ICN related architecture schemes, Named Data Networks (NDN) (Zhang L, Estrin D, Burke J, et al. Named Data Networking (NDN) project [ J ]. Relat obliterate rio T nic NDN-0001, Xerox Palo Alto Research Center-PARC,2010.) are becoming the mainstream of ICN architecture because of the advancement, feasibility and substantial progress of project concepts.

The utilization of network internal storage has the advantages of reducing redundant transmission in the network, realizing content sharing, improving content distribution speed and the like. When a data packet cached inside the network responds to a request instead of a data producer, that is, a Cache hit occurs, the Cache hit means that the use of bandwidth is reduced. That is, reasonable caching strategies inside the network can greatly reduce the network bandwidth and reduce the load of the original server. However, cached content inside the network may reveal some privacy sensitive information. An attacker may infer whether certain content has been accessed, or thus the location of the requester in the network topology, etc., by measuring the time at which the requested content is obtained. Therefore, for the named data network, the key for exerting the advantages of the in-network cache is to prevent the cache from revealing privacy information and improve the cache performance under the condition of low overhead. However, the policy of default Everywhere cache (LCE) (Wang W, Sun Y, Guo Y, et al CRCache: expanding the correlation between content and networking topology information for ICN caching [ C ]// IEEE International Conference on Communications (ICC); Sydney: IEEE,2014:3191 and 3196) is likely to cause cache redundancy, i.e., the same object has copies in multiple nodes, which results in serious waste of storage space, and an attacker can easily guess privacy information such as communication traces of neighbor users through the cache.

For the defects of the LCE caching method for the named data network, researchers have proposed some caching strategies to reduce redundancy and improve network performance. Laoutaris, Eum, Wang et al propose random cache-based decisions that can reduce cache redundancy to some extent, but are more random and blind; psaras et al make a cache decision by calculating the number of node hops and the cache capacity (Psaras I, Chai W K, Pavlou G. basic in-network searching for Information-central networks [ C ]. ACM Proceedings of the subsequent edition of the ICN networks on Information-central networks (ICN),2012: 55-60.). In addition, the method of BetwRep (Temport, Liu river, Huangtao, etc. is proposed by Tokyo et al. content-centric networking cache strategy [ J ] based on node betweenness and replacement rate [ 1-7 ] in electronic and informatics report, 2014,36 (1)), and the replacement rate based on node betweenness and cached content is used as decision metric on a return path. Both methods do not take into account the distribution characteristics of the content request. Hu et al propose PRL method (Hu X, Gong J, Cheng G, et al, enhancing in-network caching by adding cache replacement, replacement and location [ C ]. IEEE,2015:5672-5678.), the router calculates the cache profit according to the request rate of the content, the hop count information and the content replacement rate, and selects the node with the largest profit as the cache node in the transmission path. This approach can significantly increase network load. The CCSPP method (Geguo, Guo Yuan Fei, Liu Cai, etc.. Cooperation cache strategy facing privacy protection in content center network [ J ]. electronic and information science report, 2015,37(5):1220 and 1226.) comprehensively considers the privacy protection of cache, constructs an anonymous area, and selects the maximum hot spot request area for caching when the content returns. But the difficulty of constructing anonymous areas is high and additional search delay is introduced. The invention is provided in consideration of the problems of insufficient privacy protection degree, potential safety hazard, low performance and the like of the existing cache strategy.

Disclosure of Invention

The invention aims to overcome the defects of the prior art and provides a named data network privacy protection caching decision method based on k anonymity, which prevents an attacker from detecting the caching content in a router and avoids the attacker from deducing and acquiring privacy information such as the access content of a neighbor user; meanwhile, on the premise of protecting the private information cached by the router, k anonymous shared cache data is realized, the cache utilization rate is improved, the number of router hops passed by the user for requesting the content is reduced, and the average request time of the content is reduced; and when the data packet returns, the cache decision is only carried out at the node where the user sends the request, so that the diversity of cache contents in the network is increased, a large amount of cache redundancy is reduced, and the local cache hit rate is improved.

In order to achieve the purpose, the technical scheme provided by the invention is as follows:

adding a Content State Table (CST) and a neighbor information Table (NST) in a router node of the named data network, wherein the Content State Table and the neighbor information Table are used for counting the quantity of Content requesting users and an encrypted requesting user set when an interest packet reaches the node;

when the router node receives the interest packet, according to the content C in the content status table CST_xAnd encrypted user U_yModifying the requested amount of users of the content;

when the original path of the data packet corresponding to the interest packet is returned, the cache decision is only carried out on the router node with cache hit, and the anonymous set for access is increased by utilizing the k anonymous characteristic to carry out neighbor cooperative cache.

Further, when the router node receives the interest packet, the specific processing steps are as follows:

s1-1, searching whether the content C exists in the content state table CST_xIf not, go to step S1-4; if so, searching whether a user U exists in the user set uSet of the content state table CST or not_yIf not, go to content C_xUser set uSet of (1) adds U_yAdding 1 to the number of users; if yes, go directly to step S1-2;

s1-2, judging content C in CST table_xValue of corresponding Interface: if the Interface is empty, go to step S1-5; if the Interface is equal to 0, returning a data packet to the user according to the content in the CS, and ending the process; if the Interface is not null or zero, go to step S1-3;

s1-3, according to content C in CST table_xThe corresponding interface is forwarded to the neighbor router, and the process is finished;

s1-4, adding a piece of content C to CST_xRecord of user U_yAdding a user set, and requesting the user amount to increase by 1;

s1-5, searching content C in PIT_xIf found, the content C is processed_xArriving interfaces add to PIT and discard the interestAnd (6) ending the process; otherwise look up content C in FIB_x；

S1-6, finding content C in FIB_x(ii) a Forwarding according to the found interface list, and adding a new entry of the interest packet in the PIT; not found in the FIB, indicating that the network cannot respond to the request, the interest packet is discarded.

Further, when the original route of the data packet corresponding to the interest packet is returned, the cache decision step of the router node receiving the data packet is as follows:

S2-1、C_xthe data packet arrives at the user and sends out a request C on the way of returning_xNode R of_iFind out whether CS has C_xIf there is a data packet, the data packet is directly discarded, otherwise C is searched in CST_x；

S2-2, if C is found in CST_xThen, go to step S2-3; if C is not found in CST_xThen step S2-4 is executed;

s2-3, judging whether the Interface is empty and whether the number of router interfaces or the number of users requested by the CST table num of users is more than or equal to a threshold k;

if the Interface is empty and the number of interfaces of the router or the number of users num of users requested by the CST table is greater than or equal to the threshold k, the data packet copy is cached in the router R_iThe interface of CST table is updated to 0, and the neighbor router is updated to the local router R_i；

If the Interface is empty and the number of router interfaces or the number of users num of User requested by the CST table is not more than the threshold k, selecting the neighbor node R with the minimum cache replacement rate according to the NST_iForwarding and buffering the packet copy to R_iUpdating the selected neighbor interface to CST;

if the Interface is not empty and the number of router interfaces or the number of users num of User requested by CST table is greater than or equal to the threshold k, the data packet copy is cached in the router R_iThe interface of CST table is updated to 0, and the neighbor router is updated to the local router R_i；

If the Interface is not empty and the number of router interfaces or the number of users num of users requested by the CST table is not greater than or equal to the threshold k, directly executing step S2-4;

s2-4, searching C in PIT table_xIf not found, discarding the data packet, if found, pressing C in PIT_xAnd the corresponding interface forwards the data packet.

Further, a router node in the named data network is provided with a Neighbor update message (NUP) for the router to periodically notify the Neighbor router of local information, and the router node receiving the Neighbor update message NUP updates information in the content state table CST and the Neighbor information table NST according to the content of the Neighbor update message NUP, and the specific steps are as follows:

s3-1, router R_iPeriodically calculating the cache replacement rate in unit time

Wherein, S (f)_k) Represents a node R_iReplaced content f_kSize of (C), C (R)_i) Represents a node R_iM represents the node R in unit time_iThe number of contents to be replaced; if Re (R)_i) 0, indicating that the node cache is not full or no new content arrives;

s3-2, router R_iPeriodically advertising local information to neighboring routers;

s3-3, after the neighbor router receives the update message, the neighbor information table NST updates the node cache replacement rate of the corresponding router according to the message content, if the content state table CST contains the replaced cache content, the content state table CST deletes the corresponding tuple.

Compared with the prior art, the principle and the advantages of the scheme are as follows:

1. due to the default caching decision LCE of the named data network, content caching is performed on all nodes on a packet return path, which wastes the storage space of the network greatly and causes cache content redundancy. According to the scheme, when the data response node returns the original path of the data packet corresponding to the interest packet, the cache decision is only carried out at the node where the user sends the request, so that the redundancy of cache contents can be effectively reduced while a higher cache hit rate is kept, the diversity of data in a network is improved, and the updating frequency of the cache contents in the node is reduced.

2. An attacker can infer whether a neighbor user has recently requested the content by measuring the round trip time of a particular content, and even the topological location of the user in the network. Cache privacy protection for named data networks is therefore of paramount importance. In order to prevent the relevant privacy information of the requester from being revealed, when the data packet corresponding to the interest packet is returned in the original path, the caching decision is only carried out on the node where the user sends the request, and the neighbor node to which the data packet is cached is determined according to the cache replacement rate of the node. Even if an attacker can know that the content has been accessed recently, the attacker cannot deduce which user has accessed the content recently through which router because of the cache cooperation in the region, so that the attacker can be prevented from detecting the privacy information of the requester, and the privacy of the requester can be effectively protected.

3. According to the scheme, the user anonymous area is enlarged in a neighbor cooperation caching mode to protect the caching privacy, compared with the CCSPP scheme provided by Kudzuvine and the like, the router does not need to execute the construction of the anonymous area and does not need to search data in the anonymous area, the realization difficulty of the anonymous area is reduced, and the time delay of local users for acquiring the data is reduced. Meanwhile, according to the scheme provided by the ge national multi-span and the like, while the user privacy protection is realized, the cache utilization is realized, but the content is only stored in the anonymous area with the highest hot spot on the path returned by the data packet, and if the users in other anonymous areas on the same path request the same data, a great probability of requesting the same data again is needed. According to the scheme, cache decision is carried out on all nodes of the data packet returning path where the user sends the request, and therefore cache utilization rate and cache hit rate are improved.

Drawings

FIG. 1 is a named data network topology;

FIG. 2 is a flow chart of interest packet forwarding according to the present invention;

FIG. 3 is a flow chart of a packet buffering decision process according to the present invention.

Detailed Description

Before setting forth the specific embodiments, the meaning of each symbol, phrase used in the present invention is first given:

the meaning of each symbol is as follows:

R_i: a router node i, a unique identity of the node;

C_x: a content x;

U_y: an encrypted user y's token;

CS: content Store of the router;

Re(R_i): the cache replacement rate of router node i;

CST: a Content State Table;

NST: neighbor State Table, neighbor State Table;

PIT: pending Interest Table, Pending Interest Table;

FIB: forwarding Information table, Forwarding Information Base;

NUP: neighbor update messages, Neighbor update packets;

num of User/uReq: all requested content C_iThe number of users of (c);

an Interface: represents an interface with a neighbor router, where 0 represents a local router;

user Set/ueset: user set, content C_iA set of encrypted user tokens for a corresponding requestor;

k: judging whether a threshold value for caching is carried out at the current node;

the invention will be further illustrated with reference to specific examples:

the named data network privacy protection caching decision method based on k anonymity comprises the following steps:

existing setting router R₀The CST of (A) is shown in Table 1, and the NST is shown in Table 2. CST maintains the content state of local node or neighbor node, and the user set is content C_xCorrespond toThe requested amount of users is all the requested contents C_xInterface 0 indicates that the content is stored at the local router, and 1-n indicates the interface with the neighbor router. The interface and neighbor routers are empty indicating that the requested packet has not yet arrived at the node. The network topology used in this embodiment is shown in fig. 1.

TABLE 1 Content State Table (CST)

TABLE 2 Neighbor State Table (NST)

As shown in fig. 2, the processing steps of the node when receiving the interest packet are as follows:

s1-1, searching whether the content C exists in the content state table CST_xIf not, go to step S1-4; if so, searching whether a user U exists in the user set uSet of the content state table CST or not_yIf not, go to content C_xUser set uSet of (1) adds U_yAdding 1 to the number of users; if yes, go to step S1-2;

s1-3, according to content C in CST table_xThe corresponding interface is forwarded to the neighbor router (in the strategy, the router has no interface 0, and the interface 0 indicates that the content is cached locally), and the process is ended;

S1-4、adding a piece of content C to CST_xRecord of user U_yAdding a user set, and requesting the user amount to increase by 1;

s1-5, searching content C in PIT_xIf found, the content C is processed_xAdd the arrival interface to the PIT and discard the interest packet; otherwise look up content C in FIB_x；

As shown in fig. 3, when the data packet corresponding to the interest packet is returned from the original route, the cache decision step after the router node receives the data packet is as follows:

if the Interface is not empty and the number of router interfaces or the number of users requested by CST table is num of users greater than or equal toAt threshold k, the packet copy is buffered in the router R_iThe interface of CST table is updated to 0, and the neighbor router is updated to the local router R_iUpdating the corresponding neighbor interface in the CST;

The following illustrates the decision process of the cache policy according to the data in table 1 and table 2:

let k be 30, the user passes through router R₅Has requested data D₁Now, the content provider returns a data packet D₁At a node R along the way₃When a User is found to make a request, num of User of CST is 10, because it is less than k, Re (R) in NST is found_i) Node R with the smallest value₂Data packet D₁Is duplicated from the router R₃Interface 2 forwards to the neighbor router for cooperative caching, and R is the same time₃Go on to hold D₁Return to R₅。

Through a neighbor update message NUP, a router periodically announces local information to a neighbor router, and the method comprises the following specific steps:

s3-2, router R_iPeriodically advertising local messages to neighboring routersThe structure is shown in table 3;

TABLE 3 Neighbor update messages (NUP)

Router sign R_i
	Cache replacement rate Re (R)_i)
Time of message creation
	Replaced cache content C_i

In the embodiment, when the data response node returns the original path of the data packet corresponding to the interest packet, the cache decision is only performed at the node where the user sends the request, so that the redundancy of cache contents is effectively reduced while a higher cache hit rate is maintained, the diversity of data in the network is improved, and the update frequency of the cache contents in the node is reduced. In addition, when the original path of the data packet corresponding to the interest packet is returned, the cache decision is only carried out on the node which sends the request by the user, and the cache of which neighbor node is cached is determined according to the cache replacement rate of the node. Even if an attacker can know that the content has been accessed recently, the attacker cannot deduce which user has accessed the content recently through which router because of the cache cooperation in the region, so that the attacker can be prevented from detecting the privacy information of the requester, and the privacy of the requester can be effectively protected. Moreover, the user anonymous area is expanded by means of neighbor cooperative caching to protect the caching privacy, the router does not need to execute construction of the anonymous area, data searching in the anonymous area is not needed, the implementation difficulty of the anonymous area is reduced, and the time delay of local users for acquiring data is reduced.

The above-mentioned embodiments are merely preferred embodiments of the present invention, and the scope of the present invention is not limited thereto, so that variations based on the shape and principle of the present invention should be covered within the scope of the present invention.

Claims

1. A named data network privacy protection cache decision method based on k anonymity is characterized in that a content state table CST and a neighbor information table NST are added in a router node of a named data network and used for counting the quantity of content requesting users and an encrypted requesting user set when an interest packet reaches the node;

when the original path of the data packet corresponding to the interest packet is returned, caching decision is only carried out on the node where the user sends the request, and an anonymous set for access is increased by using the k anonymous characteristic to carry out neighbor cooperative caching;

when the original route of the data packet corresponding to the interest packet is returned, the cache decision step of the router node for receiving the data packet is as follows:

s2-1, when the data packet of Cx is in the return way, the data packet reaches a node Ri which sends a request Cx by a user, whether the CS has the data packet of Cx is searched, if yes, the data packet is directly discarded, and if not, the Cx is searched in CST;

s2-2, if Cx is found in CST, executing step S2-3; if Cx is not found in CST, executing step S2-4;

if the Interface is empty and the number of interfaces of the router or the number of users num of users requested by the CST table is greater than or equal to a threshold value k, the data packet copy is cached in the router Ri, the Interface of the CST table is updated to be 0, and the neighbor router is updated to be the router Ri;

if the Interface is empty and the number of router interfaces or the number of users num of users requested by the CST table is not more than or equal to a threshold value k, selecting a neighbor node Ri with the minimum cache replacement rate according to the NST, forwarding and caching the data packet copy to the Ri, and updating the selected neighbor Interface to the CST;

if the Interface is not empty and the number of interfaces of the router or the number of users num of users requested by the CST table is greater than or equal to a threshold value k, the data packet copy is cached in the router Ri, the Interface of the CST table is updated to be 0, and the neighbor router is updated to be the router Ri;

s2-4, searching Cx in PIT table, if not found, discarding the data packet, if found, forwarding the data packet according to interface corresponding to Cx in PIT.

2. The k-anonymity based named-data network privacy protection caching decision method according to claim 1, wherein when the router node receives the interest packet, the specific processing steps are as follows:

s1-5, searching content C in PIT_xIf found, the content C is processed_xAdding the arrival interface to the PIT, and discarding the interest packet, and ending the process; otherwise look up content C in FIB_x；

3. The k-anonymity-based named data network privacy protection caching decision method according to claim 1, wherein a router node in the named data network is provided with a neighbor update message NUP for periodically notifying local information to a neighbor router by the router, and the router node receiving the neighbor update message NUP updates information in the content state table CST and the neighbor information table NST according to the content of the neighbor update message NUP, and the specific steps are as follows: