While the IoT market continues to grow, securing IoT systems remains a challenge as successful cyberattacks keep escalating. Named Data Networking (NDN) offers a number of advantages over traditional IP-based communications and is considered a promising candidate to revolutionize the IoT space, thanks to its improved scalability and built-in security features. A cornerstone of any NDN IoT network is the onboarding protocol, whose main goal is to bootstrap the cryptographic keys and trust relationships necessary for a newly joining device to securely communicate with the rest of the network. Though several such protocols have been proposed, none so far combines strong security guarantees with ease of use on IoT devices that have highly constrained input/output interfaces. In this paper we introduce a novel password-based onboarding protocol to address this need. In addition to discussing its design, we produce a formalization of the protocol and verify its security properties using an automated analyzer. Finally, we present the results of benchmarking carried out on a proof-of-concept implementation that demonstrates the feasibility of our approach.

One unique architectural benefit of Named Data Networking (NDN) is adaptive forwarding, i.e., the forwarding plane is able to observe past data retrieval performance and use it to adjust forwarding decisions for future Interests. To be effective, adaptive forwarding assumes thatInterest Routing Localityis related to Interests’ common name prefix, meaning that Interests sharing the same prefix are likely to follow a similar forwarding path within a short period of time. Since Interests can have multiple common prefixes with different lengths, the real challenge is determining which prefix length should be used in adaptive forwarding to record path performance measurements - we refer to this as thePrefix Granularity Problem. The longer the common prefix is, the better the Interest Routing Locality, and the larger the forwarding table. Given the limited FIB size, route names are designed to be considerably shorter than Interest names. Existing adaptive forwarding designs use route names to record path performance measurements, which looses forwarding adaptability as it promises in the event of partial network failures. In this work, we propose to dynamically aggregate and de-aggregate name prefixes in the forwarding table in order to use the prefixes that are the most appropriate given current network situation. In addition, to reduce the overhead of adaptive forwarding, we propose mechanisms to minimize the use of the longest prefix matching in Data packet processing. Simulations demonstrate that the proposed techniques can result in better forwarding decisions in the event of partial network failures with significantly reduced overhead.

A data-centric network architecture, Named Data Networking (NDN) has been developed to meet applications' growing demands of network effciency and resilience. Currently, the deployment of NDN in real network environments requires careful system design to not only enable NDN but also support IP traffc, considering IP network has been prevalent for decades and almost all the equipments and applications are IP-based. In this paper, we take the most popular local area network (LAN) technology, Ethernet, as an example to investigate incremental deployment of NDN. Assuming a local network with both NDN and IP traffc, we mainly layout three deployment scenarios: NDN-enabled hosts and all Ethernet switches, NDN-enabled hosts and all Dual-Stack switches (i.e., it can process both NDN and IP traffc), and a hybrid network with both Dual-Stack switches and Ethernet switches. We examine the technical issues involved in each scenario and present solutions. In particular, in the hybrid scenario, we propose heuristics to optimize the placement of Dual-Stack switches. Compared with traditional Ethernet, introducing Dual-Stack switches can improve network effciency and resiliency by utilizing more links, reducing each link's traffc load, and taking shorter paths, at the same time also maintaining the functionality of IP-based applications.

Power saving in the network infrastructure has received great attention in recent years. Power-aware traffic management is proposed in many works, in which a subset of routers/links are preferentially used to carry traffic while other links are activated only when traffic load is high. However, it remains challenging how to minimize the overhead to both ISPs and applications, which is important to the successful deployment of power-aware traffic management in a real network. This paper presents PALS, a new Power-Aware Link State routing based traffic management protocol. Compared with previous solutions, PALS remarkably reduces the overheads to ISPs and applications by the following innovations. First, PALS minimizes the forwarding table expansion due to dynamic power-aware routing, by using destination based routing instead of pairwise routing (e.g., MPLS). Second, PALS limits packet reordering for applications, by never splitting traffic between an IE (ingress-egress) router pair to multiple paths. Third, PALS significantly reduces the computation complexity of the power-aware routing algorithm, by running a simple path selection algorithm at each ingress router with the knowledge of local traffic information as well as global link utilization, which are much easier to obtain than global traffic matrix required by the state-of-the-art solutions (e.g., Zhang , IEEE ICNP 2010). Extensive simulations and testbed experiments show that, although bearing the simplicities to minimize the overhead, PALS saves satisfactory network power, with quick response to traffic variance and negligible impact on the packet delivery performance for applications.

As the network infrastructure has been consuming more and more power, various schemes have been proposed to improve the power efficiency of network devices. Many schemes put links to sleep when idle and wake them up when needed. A presumption in these schemes, though, is that router's line cards can be waken up very quickly. However, through systematic measurement of a major vendor's high-end routers, we find that it takes minutes to get a line card ready under the current design. To address this issue, we propose a new line card design that 1) keeps the host processor in a line card standby, which only consumes a small fraction of power but will save considerable wakeup time, and 2) downloads a slim slot of popular prefixes with higher priority, so that the line card will be ready for forwarding most of the traffic much earlier. We design algorithms as well as architecture that ensure fast and correct longest prefix match during prioritized routing prefix download. Experiments on an FPGA-based prototype show that the customized hardware can be ready to forward packets in 127.27 ms, which is 0.3% of the time the original design takes. This can better support numerous power-saving schemes based on the sleep/wakeup mechanism.

As the network infrastructure has been consuming more and more power, various schemes have been proposed to improve power efficiency of network devices. Many schemes put links to sleep when idle and wake them up when needed. A presumption in these schemes, though, is that router's line cards can be waken up quickly. However, through systematic measurement of a major vender's high-end router, we find that it takes minutes to get a line card ready under the current implementation. To address this issue, we propose a new line card design that (1) keeps the host processor in a line card always up, which only consumes a small fraction of power, and (2) downloads a slim slot of popular prefixes with higher priority, so that the line card will be ready for forwarding most of the traffic much earlier. We design algorithms that ensure fast and correct longest prefix match lookup during prioritized routing prefix download. Experiments on real hardware show that the wakeup time can be reduced to 127.27ms, which is 0.3% of the original line card wakeup time, well supporting many power-saving schemes.