KR20200112237A - Method and apparatus for networking based on decentrazlized naming scheme - Google Patents

Abstract

The present invention provides an information-oriented networking method and apparatus based on a distributed naming scheme. According to the present invention, a networking method based on distributed naming comprises the steps of: receiving first object related information and second object related information, respectively, from a first object and a second object selecting the same name; obtaining a first authority value determined based on identification information of the first object and the name from the first object related information; obtaining a second authority value determined based on identification information of the second object and the name from the second object related information; and determining an owner of the name based on the first and second authority values. According to the present invention, a name used in a network is determined in a distributed manner, and networking based on a self-authenticating name is possible. In addition, according to the present invention, it is possible to improve the security of networking and services based on distributed naming.

Description

Distributed naming-based networking method and device {METHOD AND APPARATUS FOR NETWORKING BASED ON DECENTRAZLIZED NAMING SCHEME}

The present invention relates to a method and apparatus for networking based on distributed naming, and more particularly, to a method and apparatus for providing information-oriented networking based on a distributed naming scheme.

Traditionally, identifiers used in computer networking have been determined in a centralized manner. IP addresses or domain names are primarily assigned by ICANN (International Internet Address Management Organization), and the assigned addresses or names are re-assigned and used in detail by other organizations. In this structure, a specific organization or organization has authority over a specific address area or name, and authority over a specific address area or name can be given to other organizations. This is called a centralized management system or a hierarchical management system.

This centralized management system is very efficient and secure when the management organization can be trusted and is widely used in new networking structures. For example, in Named Data Networking (NDN), which is a kind of Information Centric Networking, the authority to use a specific name or namespace is granted by a Certificate Authority.

A centralized management system inevitably requires trust in a management agency or organization. In other words, if the management authority is hijacked by an attacker or makes a mistake, all networks will become confused. This single point of failure structure is inevitably vulnerable to security and, if possible, can be supplemented through a decentralized structure.

If you use the self-certifying name in the form of the following, a strong binding between the public key and the name is possible by taking the hash value of the public key (pk) as the name, but the readability of the name (human readability) drops:

name ← hash(pk)

Therefore, in Bitcoin's vanity address generation scheme or Tor hidden service, an address (or name) is created in the following way:

address ← encode(trim(hash(pk _i )))

Here, hash() is a hash function, trim() is an optional trimming function, and encode() is an encoding function. In Bitcoin, RIPEMD-160 hash function and Base58Check encoding function are used. Bitcoin does not use the trim() function. The Tor Hidden service uses the SHA-1 hash function, the trimming function that takes the first half of the input value, and the Base32 encoding function. In this method, the public key (pk _i ) is repeatedly generated until the desired human-readable and memorable name is generated.

However, this method has a problem that it is difficult to properly control (engineering) the key generation overhead. If the number of bits required for character encoding is k and the length of the character is n, it takes O(k ⁿ ) of work to find the public key that creates a specific name. Therefore, it takes a factor of 10 or more to generate a name of length n+10 than to generate a name of length n. In addition, this method is vulnerable to attacks aimed at preoccupying names in large quantities. This is because once the public key is generated and the hash value is calculated, only a simple operation is needed to compare whether there is a matching name in the list of names that you want to preempt.

In order to solve the above problems, the present invention provides a method and apparatus for applying a self-authenticating name to a distributed naming-based networking.

An object of the present invention is to provide a method of determining a name used in a network in a distributed manner, and to provide a networking method and apparatus based on such distributed naming.

The above-described objects and other objects, advantages, and features of the present invention, and methods of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings.

A networking method based on distributed naming according to an aspect of the present invention includes receiving first object related information and second object related information from a first object and a second object selecting the same name, respectively, the first object related information Obtaining the identification information of the first object and a first authority value determined based on the name from the second object-related information, the identification information of the second object and a second authority value determined based on the name And determining the owner of the name based on the first and second authority values.

In one example, the object identification information is the object's public key.

In an example, the authority value may be determined as a hash value of a value obtained by combining identification information of an object and a name of the object.

In the step of determining the owner of the name, an object having a smaller authority value may be determined as the owner of the name by comparing the first and second authority values.

In an example, the first and second object related information may include an authority value as part of a name.

The first object-related information may include first data signed with the identification information of the first object, and the second object-related information may include second data signed with the identification information of the second object.

In an example, the networking method based on distributed naming may further include selecting one of the first data and the second data based on the first and second authority values.

In one example, the networking method based on distributed naming includes receiving information related to a third object from a third object that has selected a name, and re-determining the owner of the name based on a third authority value obtained from the information related to the third object. It may further include.

In an example, in the step of re-determining the owner of the name, when the third authority value is smaller than the authority value of the owner of the name, the third object may be re-determined as the owner of the name.

In an example, the networking method based on distributed naming may further include receiving data for a name and determining a destination of data for the name based on an authority value.

In an example, the networking method based on distributed naming may further include updating the destination as the owner of the name.

An electronic device for networking based on distributed naming according to another aspect of the present invention includes a storage and a processor that store object-related information including identification information of an object and an authority value determined based on a name.

The processor may be configured to receive first object-related information and second object-related information, respectively, from the first object and the second object selecting the same name.

The processor may be configured to determine the owner of the name based on the authority value of the first and second object related information.

In an example, the object identification information is the object's public key.

In an example, the authority value may be determined as a hash value of a value obtained by combining identification information of an object and a name.

In an example, the processor may be configured to compare the first and second authority values to determine an object having a smaller authority value as the owner of the name.

In an example, the storage may include an authority value as part of a name and store it as object-related information.

In an example, the processor may be configured to receive information related to the third object from the third object whose name is selected.

In an example, the processor may be configured to re-determine the owner of the name based on the third authority value obtained from the third object related information.

In an example, the processor may be configured to receive data on a name and determine a destination of the data on the name based on an authority value.

According to the present invention, a name used in a network is determined in a distributed manner, and networking based on a self-authenticating name is possible.

According to the present invention, it is possible to improve the security of networking and services based on distributed naming.

1 is a flowchart illustrating a networking process based on distributed naming according to an embodiment.
2 shows an example of a relationship between an authority value, data, and name.
3 exemplarily shows a data packet storing object related information.
4 is a block diagram of a networking device based on distributed naming according to an embodiment.
5 shows an exemplary update process of a data packet stored in a storage space.
6 shows an exemplary data packet delivery process based on distributed naming.
7 shows an exemplary method of configuring a hierarchical name based on distributed naming.
8 exemplarily shows a process of generating a key pair using an authority value.

The aspect in which the present invention is implemented will be described with reference to each of the following preferred embodiments. It is obvious that the present invention is not limited to the embodiments disclosed below, but can be implemented in other various forms within the scope of the technical idea of the present invention. The terms used in the present specification are also intended to describe embodiments and are not intended to limit the present invention. In this specification, the singular form also includes the plural form unless specifically stated in the phrase. As used in the specification, "comprise" and/or "comprising" refers to the presence of one or more other components, steps, actions and/or elements in which the stated component, step, action and/or element is Or does not preclude addition.

1 is a flowchart illustrating a networking process based on distributed naming according to an embodiment.

An embodiment according to the present invention provides a networking method based on distributed naming. In the networking method according to the embodiment, the step of receiving (110) first object-related information and second object-related information from a first object and a second object selected with the same name, respectively, and identifying a first object from the first object-related information Acquiring a first authority value determined based on the information and the name (120), obtaining a second authority value determined based on the identification information and the name of the second object from the second object-related information (120), and It includes the step 130 of determining the owner of the name based on the first and second authority values.

Here, the object includes all subjects that need a name. For example, objects include servers, terminals, nodes, computing devices, various IoT devices, network equipment, display devices, wearable devices, and the like. For example, objects include data, communication channels, sessions, applications, services, users, virtual devices, virtual objects, time objects, and place objects.

Prior to examining each step shown in FIG. 1 in detail, with reference to FIG. 2, the authority of an object with respect to a name in the present invention will be first described.

2 shows an example of a relationship between an authority value, data, and name.

In the present invention, the object is to produce a public key (pk _i) the repeated generation and the generated public key (pk _i) the value of the name (name) and bonded to an object is desired to take a hash value (auth). That is, the hash value auth is generated according to Equation 1 below.

Objects that want to use a specific name create an auth value as small as possible.

In the present invention, an object having a private key corresponding to the public key that generates the smallest auth value is given authority for the name.

For example, assume that there are two private keys sk _i and sk _j and corresponding public keys pk _i and pk _j . And it is assumed that there are auth _i and auth _j , which are auth values corresponding to a specific name (eg, /foo) according to Equation 1 above. The distributed naming scheme according to the present invention determines a distributed name according to the following definition.

Definition 1) (Relative authority of data) For a specific name, if auth _i <auth _j , data _i signed with sk _i is relatively more authoritative than data _j signed with sk _j .

Definition 2) (Absolute authority over the name) The subject with the private key corresponding to the public key that generates the smallest auth value for a specific name has authority over the name.

With reference to FIG. 2, for example, assume that there is a key pair (sk _A , pk _A ) generated by Alice, and that auth _A = 0x000f for the name /foo. Likewise, assume that there is a key pair (sk _B , pk _B ) created by Bob and that auth _B = 0x00ec for the name /foo. In FIG. 2(a), auth _A and auth _B are generated as a hash value of a value combining a name and a public key according to Equation 1. As described above, auth _A is 0x000f, auth _B is 0x00ec, and auth _A is smaller than auth _B. In Fig. 2(b), if Alice signs data _A for the name /foo with sk _A and publishes it, and Bob signs data _B for the name /foo with sk _B and publishes it, data _A for the name /foo Can be said to be more authoritative than data _B.

Next, with reference to FIG. 4, a networking device based on distributed naming according to an embodiment will be described with a focus on functional blocks. The networking device 400 according to the embodiment includes a communication unit 410, a control unit 420, and a storage unit 430 as functional blocks. For example, the networking device 400 is a computing device including a processor that drives the control unit 420. The communication unit 410 is a wired/wireless communication module that communicates with the outside including objects. The controller 420 performs each step of the networking method described in FIG. 1 and controls the communication unit 410 and the storage unit 430. For example, the controller 420 is driven by a processor included in the networking device 400. The storage unit 420 is a storage for storing object-related information including an authority value determined based on identification information and a name of an object. For example, the storage unit 420 may store object-related information in a routing table.

Returning to FIG. 1 again, in step 110, the communication unit 410 receives first object-related information and second object-related information, respectively, from the first object and the second object selected with the same name.

The object-related information includes the object's name and authority value. The networking device 400 performs networking using a data packet storing object related information. A data packet storing object-related information will be described later with reference to FIG. 3.

In step 120, the control unit 420 obtains a first authority value determined based on the identification information and name of the first object from the first object-related information received in step 110. Similarly, in step 120, the control unit 420 obtains a second authority value determined based on the identification information and name of the second object from the second object-related information received in step 110. That is, the authority value corresponds to the hash value generated according to Equation 1 based on the public key and name of the object.

In one example, the identification information of each object is the public key of each object. For example, the identification information of the first object is the public key of the first object. As described above with reference to FIG. 2, the authority value is determined as a hash value of a value combining identification information and a name of an object.

In step 120, the control unit 420 obtains the name of each object and the authority value of each object for the name from the received object-related information. For example, the control unit 420 receives a data packet storing object-related information, parses it, and extracts the name of each object and the authority value of each object for the corresponding name.

In step 130, the control unit 420 determines the owner of the name based on the first and second authority values obtained in step 120. In an example, the control unit 420 compares the first and second authority values in step 130 to determine an object having a smaller authority value as the owner of the corresponding name. For example, in FIG. 2(a) discussed above, Alice corresponds to the first object, Bob corresponds to the second object, and Alice has a smaller authority value, so the controller 420 refers to Alice as /foo. Decide as the owner of the name.

3 illustrates an exemplary structure of a data packet for storing object-related information.

The data packet 310 and the data packet 320 are exemplary packet structures for storing each field of object related information.

The networking device 400 performs networking using a data packet storing object related information. In one example, when the object or the networking device 400 transmits data of the object, it may transmit not only the name but also the authority value.

For example, the object-related information includes the name and authority value of the object. Additionally, the object related information may further include meta information, content, and signature information of the object. For example, the meta-information of an object includes information according to the type of object. For example, when the object is a person, meta information of the object includes nationality, gender, age, etc. The content of the object includes data such as text, images, sounds, etc. The signature information included in the object-related information includes, for example, signature authentication information of the object for contents stored in the object-related information. For example, the object-related information includes data signed as identification information of the object, and the control unit 420 may select one of the signed data based on the authority value of the object-related information.

In one example, the data packet 310 may store name, authority value, meta information, content, and signature information included in object related information for each field. That is, the data packet 310 stores the authority value as an additional field. In another example, the data packet 320 may include the authority value as part of the name and store it. That is, the data packet 320 may accommodate the authority value in a specific part of the name. For example, in the case of a 32-byte name, it can be specified to have a name in the upper 28 bytes and an authority value in the lower 4 bytes.

4 is a block diagram of a networking device based on distributed naming according to an embodiment. In one example, the networking device 400 is an electronic device including a storage and a processor that stores object-related information including an authority value determined based on identification information and a name of the object.

4 is a functional block diagram of the networking device 400, and the storage unit 430 corresponds to a storage that stores object-related information. The communication unit 410 is a wired/wireless communication module responsible for communication with the outside. The control unit 420 is driven by a computing device including a processor.

The processor driving the controller 420 performs an operation of receiving first object-related information and second object-related information, respectively, from the first object and the second object selected with the same name. The processor drives the control unit 420 to determine the owner of the image name based on the authority values of the first and second object-related information.

In one example, the networking device 400 is a computing device configured to perform each step of a networking method based on distributed naming according to an embodiment.

5 shows an exemplary update process of a data packet stored in a storage space.

In a device that stores data for a specific name, the most authoritative data should be stored when there are multiple data for the same name. For example, when implemented in NDN, the content store should cache the most authoritative data. To this end, the controller 420 selects one of the most authoritative data among data for the same name based on the authority value included in the object-related information. That is, when the first object-related information includes first data signed with the identification information of the first object, and the second object-related information includes second data signed with the identification information of the second object, the control unit ( 420) selects one of the first data and the second data based on the first and second authority values.

In FIG. 5, a storage unit (Content Store) 430 stores object-related information for the name /foo and object-related information for the name /foo/bar. When the communication unit 410 receives a new data packet, the control unit 420 compares the name included in the object related information stored in the new data packet with the object related information stored in the storage unit 430. It is checked whether object-related information for the same name is already stored in the storage unit 430. When object-related information for the same name is already stored, the control unit 420 compares the newly received authority value and the stored authority value to store information related to the object having a smaller authority value (ie, more authority). Keep at 430.

In other words, when the communication unit 410 receives the third object-related information from the third object that has selected the same name, the control unit 420 determines the owner of the name based on the third authority value obtained from the third object-related information. Re-determine. For example, when the third authority value is smaller than the authority value of the current owner of the name, the control unit 420 re-determines the third object as the owner of the name.

Referring to FIG. 5, since the authority value of /foo/bar stored in the new data packet, which is the third object, is 0x0012, and the authority value for /foo/bar stored in the content store is 0x002e, the authority value of the new data packet is Smaller. In this case, the control unit 420 overwrites the object-related information on /foo/bar stored in the storage unit 430 with a newly received data packet having a smaller authority value (ie, more authority). That is, it re-determines the owner of the name /foo/bar.

6 shows an exemplary data packet delivery process based on distributed naming.

When the communication unit 410 receives data for a specific name, the control unit 420 may determine the destination of the data for the name based on the authority value stored in the storage unit 430. In addition, the controller 420 may update the destination of the received data to the owner of the corresponding name and store it in the storage unit 430.

That is, the networking according to an embodiment may store information indicating a node that has data for a specific name. For example, in the networking device 400, the storage unit 430 may store a routing table that stores routing information for names. For example, the routing table stores name, authority value, and next hop information. The node includes a networking device 400. The routing table may be implemented to store the node having the most authoritative data for a corresponding name as a next hop. For example, when implemented in NDN, the Forwarding Information Base (FIB) maintains information so that an interest packet can be transmitted to the node with the most authoritative data.

Referring to FIG. 6, when an advertisement for /foo/bar is delivered to Node A, Node A manages to point to Node C, which is a more authoritative node, by the FIB entry of Node A. In other words, among the two nodes (Node B and Node C), Node C with the smaller authority value is updated with the next hop to /foo/bar. When the interest packet for /foo/bar arrives at Node A, Node A looks up the FIB and delivers the packet to Node C, the next hop.

7 shows an exemplary method of configuring a hierarchical name based on distributed naming.

In order to construct a hierarchical name such as a URI (Uniform Resource Identifier) based on the distributed naming method according to the present invention, it is disclosed through a signature from a subject having authority for the name corresponding to the prefix of the name to be taken. You can force your keys to be recognized.

For example, referring to FIG. 2, in the example of Alice and Bob, when Alice has authority over the name /foo, in order for Carol to have authority over /foo/bar, a lower authority value for /foo/bar ( For example, create a key pair (sk _C , pk _C ) with auth=0x003f) and have pk _C be signed with sk _A or the private key Alice has for the name /foo (i.e., hold it as a certificate) You can gain authority. If the signature is not received, the object with the signed minimum authority value may have authority over the name.

On the other hand, when there are multiple prefixes for a name, the signature of the subject having authority for all prefixes is equally valid. For example, when judging authority over the name /foo/bar/woo, the signature received as the subject with authority over the name /foo and the signature received as the subject with authority over the name /foo/bar are equal Since it is valid, the subject with a smaller auth value has authority.

8 exemplarily shows a process of generating a key pair using an authority value.

In one example, an object may repeatedly generate a key pair to obtain a desired name. In other words, you cannot use a single key pair, and you can continue to generate keys until an appropriate key pair is generated for each specific name. Therefore, it is impossible to use the key embedded in the hardware that is securely generated in advance. In addition, since key generation performance is important, it is also limited to generate keys in a secure execution environment such as a Trusted Execution Environment (TEE). If the implementation uses ECC (Elliptic Curve Cryptography), the key can be separated and safely stored through the process of FIG. 8 using the following features of ECC.

Features 1) If (sk _i , pk _i ) and (sk _j , pk _j ) are valid ECC key pairs, (sk _i + sk _j ,pk _i + pk _j ) is also a valid ECC key pair.

In the initialization step of FIG. 8 (it may be offline or when hardware is produced), a key pair (sk _h , pk _h ) is generated. sk _h must not be exposed to the outside in any way (hardware). pk _h is exposed and can be used in software, etc.

The hash value obtained by using Equation 810 in which Feature 1 is applied to Equation 1 is used as the authority value.

In fact, if an auth value that is smaller than the threshold for a specific name is required, the private key sk _i obtained as a result of performing an operation on the public key like an algorithm must be stored, and the private key must be used for signing later. In this case, sk _h + sk _i can be used as a private key. At this time, since sk _h can use the key only through a request such as a signature, it can be safely stored without being exposed to the outside.

The networking method and apparatus according to an embodiment of the present invention may be implemented in a computer system or recorded on a recording medium. The computer system may include at least one processor, memory, user input device, data communication bus, user output device, and storage. Each of the above-described components communicates data through a data communication bus. The computer system may be, for example, a single server computer or similar system, or may be a plurality of servers arranged in one or more server banks or other arrangements. For example, the computer system may be a distributed processing system or a parallel processing system based on a plurality of processors, a clustering server group, or a cloud server. Computer systems, such as servers or groups of servers, may be located in a single facility, or may be distributed among many different geographic locations. Each server may include a processor, a communication interface, and a memory. The processor, memory and communication interface can be connected to each other through a communication bus.

The computer system may further include a network interface coupled to the network. The processor may be a central processing unit (CPU) or a semiconductor device that processes instructions stored in a memory and/or storage.

The memory and storage may include various types of volatile or nonvolatile storage media. For example, the memory may include ROM and RAM.

The networking method according to an embodiment of the present invention may be implemented in a computer-executable method. When the networking method according to an embodiment of the present invention is performed in a computer device, computer-readable instructions may perform the method according to the present invention.

The networking method according to the present invention described above may be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all types of recording media in which data that can be decoded by a computer system is stored. For example, there may be read only memory (ROM), random access memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, and the like. In addition, the computer-readable recording medium can be distributed in a computer system connected through a computer communication network, and stored and executed as code that can be read in a distributed manner.

So far, the present invention has been looked at based on examples. Those of ordinary skill in the art to which the present invention pertains will appreciate that the present invention can be implemented in variously modified or modified forms without departing from the essential characteristics of the present invention. Therefore, the disclosed embodiments should be considered from an illustrative point of view, not a limiting point of view. The scope of the present invention is shown in the claims rather than the above description, and all differences within the scope equivalent thereto should be construed as being included in the present invention.

400: networking device
410: communication department
420: control unit
430: storage unit

Claims (15)

In the networking method based on distributed naming,
Receiving first object related information and second object related information from a first object and a second object selected with the same name, respectively;
Obtaining a first authority value determined based on the identification information of the first object and the name from the first object related information;
Obtaining a second authority value determined based on the identification information of the second object and the name from the second object related information; And
Determining the owner of the name based on the first and second authority values
Networking method comprising a.
The method of claim 1,
The identification information of the object is the public key of the object,
The authority value is determined as a hash value of a value combining identification information of the object and the name.
The method of claim 1,
The step of determining the owner of the name,
The networking method of comparing the first and second authority values to determine an object having a smaller authority value as the owner of the name.
The method of claim 1,
The first and second object related information includes the authority value as part of the name.
The method of claim 1,
The first object related information includes first data signed with identification information of the first object,
The second object related information includes second data signed with the identification information of the second object,
Selecting one of the first data and the second data based on the first and second authority values
Networking method further comprising.
The method of claim 1,
Receiving third object related information from a third object whose name is selected, and
Re-determining the owner of the name based on a third authority value obtained from the third object related information
Networking method further comprising.
The method of claim 6,
The step of re-determining the owner of the name,
Networking method of re-determining the third object as the owner of the name when the third authority value is smaller than the authority value of the owner of the name.
The method of claim 1,
Receiving data for the name; And
Determining the destination of the data for the name based on the authority value
Networking method further comprising.
The method of claim 8,
Updating the destination to the owner of the name
Networking method further comprising.
In the electronic device for networking based on distributed naming,
A repository that stores object-related information including an authority value determined based on the object's identification information and name, and
Including a processor, the processor,
Each of the first object-related information and the second object-related information received from the first object and the second object selected the same name,
An electronic device configured to determine the owner of the name based on an authority value of the first and second object-related information.
The method of claim 10,
The identification information of the object is the public key of the object,
The authority value is determined as a hash value of a value obtained by combining the identification information of the object and the name. The method of claim 10,
The processor,
The electronic device is configured to compare the first and second authority values to determine an object having a smaller authority value as the owner of the name.
The method of claim 10,
The storage is,
An electronic device that includes the authority value as part of the name and stores it as object-related information.
The method of claim 10,
The processor,
Receiving information related to a third object from a third object that has selected the name,
An electronic device configured to re-determine the owner of the name based on a third authority value obtained from the third object related information.
The method of claim 10,
The processor,
Receive data for the name,
An electronic device configured to determine a destination of data for the name based on the authority value.

Images