Privacy in ICN Nikos Fotiou and George Xylomenos Mobile Multimedia Laboratory Department of Informatics AUEB, Greece PURSUIT: Publish Subscribe Internet Technology -

A myth to bust (?) ICN inherently preserves user’s privacy –Endpoints are decoupled –Interest/Subscription and Advertisement/Publication messages do not contain sensitive information –Crumb-based and zFilter-based forwarding do not reveal packet destination 15/2/20132ICNRG Interim Meeting

But ICN reveals more information… 15/2/20133ICNRG Interim Meeting

…even if packet header is scrambled… 15/2/20134ICNRG Interim Meeting

…everybody can be a publisher… Let’s spy on some users! 15/2/20135ICNRG Interim Meeting

…and some old privacy attacks are upgraded…. I received the content fast. It should be cached. Someone close to me has already received it! 15/2/20136ICNRG Interim Meeting

The devil is in the (implementation) details “We represent this by having P(ublisher) digitally sign the mapping from his chosen name”* “PLA divides this problem into two distinct parts: binding a user's traffic to that user's cryptographic identity, and binding the user's cryptographic identity to their real identity”** * D. Smetters, V. Jacobson, "Securing Network Content", PARC Tech Report, October ** D. Lagutin and S. Tarkoma. Cryptographic signatures on the network layer - an alternative to the ISP data retention, ISCC Possibly Censorship Possibly Surveillance 15/2/20137ICNRG Interim Meeting

Privacy deserves our attention A proposed methodology: –Capture common ICN roles –Capture common ICN functions –Create a common threat model –Investigate how design choices affect user privacy 15/2/20138ICNRG Interim Meeting

An example Roles –Relaying party: Makes data available –Consumer: Interested in data –Mediator: Facilitates data dissemination Functions: Advertisement, Lookup Threat model: malicious local mediators, malicious global mediators, both targeting consumer surveillance and censorship 15/2/20139ICNRG Interim Meeting

Design choice 1: Advertisement and lookup are coupled to routing Advertisements are flooded 15/2/201310ICNRG Interim Meeting

Design choice 1: Advertisement and lookup are coupled to routing Lookups follow the routing plane 15/2/201311ICNRG Interim Meeting

Design choice 1: Advertisement and lookup are coupled to routing Default GW: I see all lookups of subscriber Intermediate Router: I have many chances to see both Lookup and Advertisement It is possible to use alternative routes 15/2/201312ICNRG Interim Meeting

Design choice 2: Advertisement and lookup are decoupled from routing Advertisements are sent to an overlay rendezvous node 15/2/201313ICNRG Interim Meeting

Design choice 2: Advertisement and lookup are decoupled to routing A single overlay node is the “Rendezvous point” for an information item 15/2/201314ICNRG Interim Meeting

Design choice 2: Advertisement and lookup are decoupled to routing Lookups follow the overlay network 15/2/201315ICNRG Interim Meeting

Design choice 2: Advertisement and lookup are decoupled to routing Default rendezvous node: It can be easily changed (as easily we can change default DNS) Intermediate Rendezvous node: Less chances to see both Lookup and Advertisement Rendezvous point: I see all advertisements for a piece of content 15/2/201316ICNRG Interim Meeting

Analysis Design choice 1: –Consumer can not easily change default GW –Default GW can easily watch/censor a consumer –Intermediate routers have also good chances to watch a consumer –Use alternative lookup paths to avoid censorship 15/2/201317ICNRG Interim Meeting

Analysis Design choice 2: –Default rendezvous node can be easily changed –Intermediate rendezvous nodes do not have many chances to watch or censor a consumer –The rendezvous point of an information item can watch all consumer interests and perform censorship 15/2/201318ICNRG Interim Meeting

On going work This was a very simple ICN model…. …a simpler threat model …and an even simpler set of design choices Much more to do! 15/2/201319ICNRG Interim Meeting