## 5 Cache Privacy  
The digitally signed packets do not guarantee the protection against traffic analyses as described by [27]. Since each NDN node must have cache content, the privacy concerns increase for cached content. In NDN applications, cached data-contents can be objected to by an adversarial node(s). For instance, the characteristics between cached and uncached contents can be different, and can be used for identifying (or determining) the cached contents (targets) in router CS.  
In NDN, the network components can store such information about the requested content/data, in order to boost the network throughput, services, and latency. These information may reflect the content about its producer, the name, consumer (requester), size, and the certificate [1; 2; 3; 3; 28]. The time differences between the cached and uncached contents may reveal private information by adversarial attacks.  
To understand the adversarial attacks on NDN cache privacy, let us consider an adversary node (_Adv._) that would like to determine whether a target/consumer (_[PERSON]_) has requested a content/data packet (_C_--produced by _[PERSON]_) or not. An adversary estimates the RTT (round-trip time) [_R_\(\longleftrightarrow\)_Adversary_] of a shared first-hop router (_R_) with [PERSON]. Then, it issues interest for the content (_C_) and compares these two RTT values to be estimated if the targeted content (_C_)) has been cached recently or not from (_R_) (supposedly [PERSON] and [PERSON] connected to the NDN router. If there are other users, this will not change the nature of the attack). Additionally, the adversary node can also determine/estimate information about the content producer ([PERSON]).  
Similarly, let us consider that [PERSON] and [PERSON]. share the same router or are separated at least by one router. The Adv. estimates RTT [_[PERSON]_\(\longleftrightarrow\)_Adv._] and then issues an interest request for \(C\). The Adv. concludes that at least one consumer has requested \(C\) and is cached by the router(s) if this RTT is lower than the former RTT. Lastly, the Adv. may combine these two attack types against [PERSON] and [PERSON] to determine if they have exchanged packets recently or they exchange packets in real-time two-way communication, e.g., SSH or voice/video [2] (in the real-time voice/video attack, the Adv. must be a physical neighbor to the target (e.g., same shared Ethernet interface)).  
Possible attack scopes on NDN streaming applications: The prerecorded and live content can be published by NDNtube, NDNvideo, and NDNlive applications. To answer live and future requests when the producer becomes offline, the video and its segments can be cached by routers. Through this approach, the load of the producer can be reduced and the video distribution maximized [20; 22].  
The audio/video segments are cached by the CS and each segment can be targeted by a side-channel timing attack. For instance, the video segments can be targeted by an adversary to obtain the location of the targets. The attack can be designed for a single segment by an adversary to identify the popularity of the video. In addition, the attack can be configured to monitor the cache to obtain the video types or contents by region.