Description

In traditional networking schemes, if a network entity wants to access some information content, it has to locate and connect to the server that provides such service following network routing protocols. As a result, the information is tightly associated with the location of the server. The entire network is centered on the connections between content consumers and content providers, making connection status an important factor to the network. In ICN architecture, the focus is shifted from consumer-server connections to consumer-content connections. Thus, in-stead of identifying the content owner’s address, the network changes to identify authentic content copies. In this way, the consumers do not need to know where the content locates, i.e. the IP address of the content owner. The content name is sufficient to direct the consumer to a content copy. Content owners publish the content, which can be copied and stored in the network using network caches. This design enables contents being efficiently delivered to consumers. This s because, in ICN, content owners and consumers are not directly connected. Content owners have no control over the distributed network caches. To enforce access control to the content, several frameworks have been proposed [9, 10]. Most of them require additional author-ities or secure communication channels in network to authenticate each content consumer. These schemes are sound but have too much reliance on traditional control schemes, making them inefficient in practice. In this paper, we propose an attribute-based access control for ICN naming scheme. The proposed scheme can be divided into two levels. At the upper-level, to address the attribute management problem, we present an ontology-based attribute management solution to manage the distributed attributes in ICN network. In this scheme, attributes defined by different authorities can be synchronized more efficiently than traditional approaches. Content consumers do not need to negotiate their attribute keys when they request contents from other authorities. At the lower-level, we propose an ABE-based naming scheme. This approach is inspired by Attribute Based Encryption (ABE) schemes. In our approach, each network entity is assigned with a set of attributes with the help of a Trusted Third Party (TTP) accord-in to their real identities. The access control policy is enforced according to the content names instead of the contents. Moreover, privacy-preservation is provided for the content access policies. This feature can greatly improve the privacy protection on ICN data when they are distributed in the public domain. In this way, a user is able to identify its eligibility of the accessed contents through the encrypted names before actually accessing the data content. To further support the use of ontology in attribute management, the proposed scheme enables. Comparison between attributes, which gives the capability to rank attributes and associate different privileges accordingly. In summary, the contributions of our work can be listed as follows: It provides ontology-based attribute management, which greatly reduces the cost for attribute management in distributed deployment. The proposed management scheme supports flexible attribute combination operations in access control policies; it enables attribute rankings and access privilege management, making it flexible to construct a data access policy in real-world scenario. The content access policy is confidentially preserved. Ineligible consumers cannot derive the data access policies even if they collude together; It proposes a naming scheme for ICN network which combines the flexible attribute management solution with the privacy preserving access policy; It significantly reduces the computation and communication overhead for a potential consumer to determine his eligibility to access the content.