# A PEKS-Based NDN Strategy for Name Privacy
## 2 Background and Related Work
### NDN Architecture
#### 2.1.2 Packets in NDN  
In NDN, data consumers start communication using a pull request. NDN uses two types of packets: An interest packet and a data packet. A name is set to both types of packets to uniquely identify a piece of data [2; 14]. An interest packet is created by a consumer and sent to the network to retrieve the desired data content. Forwarding the interest packet to its corresponding producer is done by routers using Forward Information Base (FIB) table contained in each router. When the Interest packet arrives at the data producer, the producer node will reply a data packet that is composed of both the name of the data and as well as the content. This data packet is returned to the consumer by following the incoming Interest path [2]. Figure 1 describes formats of both Interest and Data packets. A Nonce field is contained in the Interest packet. The purpose of the Nonce field is to prevent interest packets from looping in the network. Data packet is composed of Content requested by a Consumer, name of the interest packet and the Signature.  
The data producer signs the data packet and adds a signature in the data packet. Key locator in the Signature field contains the name of public key that is used to verify data packets and the public key can be retrieved using the name. The owner of the public key can be considered as a legitimate signer [15]. In NDN, a key is also a named data content and it can also be signed by administrators' keys and/or a pre-authenticated root key [16]. A signed data packet, containing the public key as data content, becomes a certificate.  
Interest packet authentication can be also done by signing an interest packet. A generated signature is appended to the last component of the interest name. The signature contains InterestSignatureInfo and InterestSignatureValue as shown in Figure 2. InterestSignatureInfo contains the elements such as a type of signature algorithm and key locator. To ensure that a signed interest packet is unique and to prevent possible replay attacks, InterestSignatureInfo must contain at least one of the elements:  
* SignatureNonce: This number is added to assure the uniqueness of the signature,
* SignatureTime: This number is the timestamp of the signature represented in milliseconds since 1970-01-01T00:00:00Z (Unix epoch),
* SignatureSeqNum: This element is also used to provide the assurance of the signatures' uniqueness. The number is used to protect against replay attacks [17].  
InterestSignatureValue contains the generated signature value. When a producer, a consumer or a network node receives an interest or data packet with a signature, it can authenticate the sender of the packet by using the information contained in InterestSignatureInfo and InterestSignatureValue [11]. An entity, which receives a signed interest packet or data packet, can recursively follow the key locator in  
Figure 1: Named Data Networking (NDN) Packets (reproduced according to “Name Data Networking”) [2].  
each packet to retrieve the public-key certificate of the signer who has created the packet. These procedures are necessary if the entity needs to authenticate the packet.