# Reliable Application Layer Routing Using Decentralized Identifiers
###### Abstract  
Modern internet of things (IoT) applications can benefit from advanced communication paradigms, including multicast and anycast. Next-generation internet architectures, such as information-centric networking (ICN), promise to support these paradigms, but at the same time they introduce new security challenges. This paper presents a solution that extends an ICN-like architecture based on software-defined networking (SDN) that supports those communication paradigms. Using the proposed solution, the underlying architecture is enhanced with a novel security mechanism that allows content \"advertisements\" only from authorized endpoints. This mechanism prevents \"content pollution\", which is a significant security threat in ICN architectures. The proposed solution is lightweight, and it enables identity sharing as well as secured and controlled identity delegation. group communication; internet of things; software-defined networking; source routing +
Footnote †: journal:  
attack [4]. One root cause of a content pollution attack is that any entity is allowed to advertise and provide any content item. This paper considers an architecture that abides by the principles of ICN; it has the same advantages as ICN but, at the same time, it does not require modifications to the networking architecture. Then, it proposes an efficient solution to prevent content pollution attacks. The considered architecture leverages software-defined networking (SDN), and it was originally proposed in [5]. That architecture allows stateless broadcast and multicast by using content identifier advertisements and Bloom-filters-based network communication. In particular, in this architecture, Bloom filters are used for \"encoding\" the network path that a packet must follow [6]; additionally, edge nodes advertise content identifiers, and these advertisements are used for creating lookup tables that map a content identifier to the Bloom filter that should be used in order to reach the nodes that have advertised it. In order to solve the problem of content pollution, a solution is proposed that enables edge nodes to validate that an identifier is advertised by an _authorized_ entity: this is achieved using decentralized identifiers (DIDs) [7]. A DID is a URI-like identifier which resolves to a \"DID document\" that includes \"information\" about the DID owner. DIDs are a standardized self-sovereign identity (SSI) mechanism. SSIs have received increased attention in the context of the IoT [8]. The proposed system allows DIDs to be used as content identifiers and a DID document includes information that can be used for validating that an identifier advertisement has originated from an _authorized_ entity. Our paper makes the following contributions:  
* It proposes a solution that integrates DIDs with a registration system allowing ordinary, human readable URLs to be used as DIDs. These URLs can then be used for identifying and/or grouping IoT devices. * It defines methods that allow DID owners to securely bind a DID to IoT devices, enabling, in this way, IoT devices to generate \"proofs of ownership\", which are used as the main building block of our security solution. * It defines protocols that allow DID owners to perform identifier _delegation_ to a third party in a secure and controlled way. * It designs the solution to be lightweight since the only operation that an IoT device should perform is the generation of a digital signature and the only operation that an edge node should perform is the validation of that signature. The remainder of this paper is organized as follows. Section 2 presents background information, and it introduces DIDs and the SDN-based underlay architecture. Section 3 discusses related work in this area. Section 4 details the design of the proposed solution. The implementation and evaluation of the proposed solution are presented in Section 5. Section 6 discusses alternative DID methods and ICN underlays as well as the impact of the proposed solution in lightweight devices.