Considering the edge-cloud environment and uploading large amounts of data from IoT devices through the edge node towards the cloud, this paper investigates an aggregation method of data streams compressed by Generalized Deduplication (GD) for the edge node. The simplest way is to decode GDcompressed data streams, aggregate raw streams and re-encode it into a single GD-compression stream. However, this involves a large computational complexity for aggregation due to the decoding and re-encoding of linear codes underlain the GD. From this observation, this paper presented a novel aggregation method, called Aggregable GD (AGD). The AGD is designed to aggregate multiple GD streams into a single AGD stream, and removes duplicated information among GD streams without decoding and re-encoding operations of GD. This paper also shows that AGD involves smaller computational complexity for data aggregation than the ordinary simple scheme. Furthermore, by the preliminary computer simulation using the Hamming code as the underlying linear code of GD, we demonstrate that AGD performs comparable to the ordinary method from the viewpoints of the compression rate.

Private information delivery (PID) from coded stor-age is a problem in delivering a message to a receiver without revealing the locations of servers storing encoded pieces of the message. Although existing researches only focus on the method to keep the server locations secret to the receiver, they do not consider other types of security against storage servers; security of stored messages against the Byzantine servers and the eavesdropping servers. In this paper, we first define the security properties against these attackers in PID; 1) the t-Byzantine resistance and 2) the$\mu$-message confidentiality, where$t$and$\mu$are the maximum capable numbers of Byzantine servers and eavesdropping servers, respectively. We also introduce an explicit scheme guaranteeing these properties with no deterioration of the PID's server locations privacy. The scheme can be viewed as a pre-coding method of messages using the maximum rank distance (MRD) code, and it can be applied to any PID scheme from coded storage. Furthermore, we characterize the maximum possible$t$and$\mu$in terms of parameters of the underlying MRD code, and clarify the degradation in the transmission rate introduced by these properties.

The traditional Domain Name System (DNS) lacks fundamental security and privacy features in its design. As privacy concerns increased on the Internet, security and privacy enhancements of DNS have been actively investigated. Specifically, in the context of user privacy in DNS queries, several relay-based anonymization schemes have been recently introduced. However, these schemes are vulnerable to collusion between relays and full-service resolvers, which means user identities cannot be hidden from resolvers. This paper introduces a new concept for achieving user anonymity in DNS queries through a multiple-relay-based approach, called μODNS (Mutualized Oblivious DNS), by extending the concept of existing relay-based schemes. μODNS introduces a reasonable assumption that each user has at least one trusted or dedicated relay within the network and mutually shares the relay with other users. The user simply sets his trusted relay as the next-hop relay to convey his queries to the resolver and randomly chooses its zero or more subsequent relays shared by other entities. Under this assumption, the user’s identity remains concealed from the target resolver in μODNS even if an unknown subset of relays colludes with the resolver. Namely, in μODNS, users can preserve their anonymity by paying a small cost of sharing their resources. Additionally, we extend existing protocols, Anonymized DNSCrypt and Oblivious DoH, to provide practical Proof-of-Concept specifications and implementations as instances of μODNS. These implementations are publicly available on the Internet as open-source software and public services. Furthermore, we demonstrate, through measurements of round-trip times for DNS messages, that our implementation can minimize the performance degradation resulting from its privacy enhancements, achieving performance levels that maintain the positive user experiences observed in existing schemes.

Information Centric Networking (ICN), the security, privacy and access control mechanisms are deployed directly in the network layer. However, the gap between security in the network and application layers creates a vulnerable space for cyber attacks from inside a device. We adopt a proxy reencryption technique to facilitate a flexible ICN access control specific to applications. Unlike the existing work in which the proxy re-encryption is done in the network, we propose an In-device Proxy Re-Encryption Service (IPRES) for filling this security gap and for efficiency in both access control management and resource usage. We present the architecture and protocol of IPRES incorporating principles from security management specific to each application. Our evaluation shows that IPRES improves the state of the art by closing the security gap while it introduces acceptable operational and memory overheads at the device level.

Content-Centric Networking (CCN) is an attractive future Internet architecture that enables rapid data retrieval due to its native in-network caching mechanism. However, existing caching policies in CCN do not always perform effectively in terms of the user-centric performance that is typically measured by the content download time. This is because they have been designed to improve network-centric performances, such as cache hit ratio and hop count. In this paper, we focus on the Round-Trip Time (RTT) computed at routers, and present two caching policies based on the RTT in order to achieve the high user centric performance. Our policies have the advantage that they can be deployed with no modification of the CCN packet structure in contrast to the existing ones. This paper demonstrates that our policies achieve much shorter download time than the existing ones over various network topologies, and provides deep insights on caching policies to improve the user-centric performance.

Information-centric networking (ICN) can bring many benefits to network operators, e.g., in-network request resolution via router's cache, and name-based forwarding. However, creating a smooth migration path from the current IP network to the ICN is a challenging task that must be investigated. Network function virtualization (NFV) is one of the key technologies to achieve this migration because of its flexibility in supporting new network services as software. Nevertheless, when we consider the deployment of ICN services over NFV, two performance issues are found: processing delay of name look-up and computational overhead of the virtual machine. In this paper we propose NFV infrastructure-assisted name-based forwarding by integrating the name look-up into the Open vSwitch. The contributions are twofold: 1) First, we provide a novel look-up scheme that can forward ICN packets without costly longest prefix match searching. 2) Second, we integrate this forwarding scheme into the virtualization infrastructure to mitigate computational overhead.

In the latest version of content-centric networking (CCN 1.0), a number of interests are issued when a large content is retrieved, and this could be a serious problem due to routers' heavy workload. In order to solve this problem, this paper proposes a novel strategy of "grouping" multiple interests with the common information and "packing" them to a special interest called the list interest. Our list interest is designed to cooperate with the manifest of CCN 1.0. This paper demonstrates that by using the common information in the list interest, the router can search its FIB/PIT/CS for the list interest-based request with dramatically smaller complexity than the case of the standard interest-based request. Furthermore, we also give a novel TCP-like congestion control method for list interests.

In the research of content-centric networking (CCN), there have been investigated several fragmentation methods of CCN messages in order to implement CCN as an L3 protocol. The latest version of the CCN protocol (CCN 1.0) adopts the end-to-end fragmentation method that fragments CCN messages only at the content publisher. This allows intermediate routers to simply forward fragmentation packets, and hence this can solve the problem of the processing delay at routers in the existing fragmentation methods for the CCN. However, the end-to-end fragmentation has not been well-analyzed and well-evaluated yet. In this paper, we analyze the end-to-end fragmentation and clarify its important parameter for the efficient transmission. Moreover, we evaluate fragmentation methods for the cache-hit ratio and the header overhead, and we clarify advantages and disadvantages of the methods in terms of the transmission efficiency.

This paper proposes a comprehensive encryption-based access control framework for content centric networking (CCN), called CCN-AC. This framework is both flexible and extensible, enabling the specification, implementation, and enforcement of a variety of access control policies for sensitive content in the network. The design of CCN-AC heavily relies on the concept of secure content object manifests and leverages them to decouple encrypted content from access policy and specifications for minimum communication overhead and maximum utilization of in-network caches. To demonstrate the flexibility of framework, we also describe how to implement two sample access control schemes, group-based access control and broadcast access control, within CCN-AC framework.

By extending the notion of minimum rank distance, this paper introduces two new relative code parameters of a linear code C1of length n over a field extension Fqmand its subcode C2⊆ C1. One is called the relative dimension/intersection profile (RDIP), and the other is called the relative generalized rank weight (RGRW). We clarify their basic properties and the relation between the RGRW and the minimum rank distance. As applications of the RDIP and the RGRW, the security performance and the error correction capability of secure network coding, guaranteed independently of the underlying network code, are analyzed and clarified. We propose a construction of secure network coding scheme, and analyze its security performance and error correction capability as an example of applications of the RDIP and the RGRW. Silva and Kschischang showed the existence of a secure network coding in which no part of the secret message is revealed to the adversary even if any dim C1-1 links are wiretapped, which is guaranteed over any underlying network code. However, the explicit construction of such a scheme remained an open problem. Our new construction is just one instance of secure network coding that solves this open problem.

The universal strongly secure network coding scheme allows communication at maximum rate while ensuring that, independently from the underlying network code, no part of the secret message is revealed to the wiretapper. Although Silva and Kschischang showed the existence of such a scheme, the explicit construction remained an open question. This paper demonstrates an explicit construction of the scheme that uses secret sharing schemes based on maximum rank distance (MRD) codes, which can be viewed as a special case of Ozarow-Wyner coset coding scheme.