A computer-implemented method, comprising: receiving, by a key-resolution service, KRS, over a Content Centric Network, CCN, an Interest message with a name that includes a routable prefix associated with the key-resolution service, wherein the Interest includes a KRS query for a content name that is to be resolved in the name or a payload of the Interest, and wherein the KRS is organised into a tree topology such that a local KRS (204.4) has a parent KRS (204.3); obtaining, from the Interest message, the content name that is to be resolved; obtaining a KRS record for the content name, wherein the KRS record includes security information for the content name or a prefix of the content name, wherein obtaining the KRS record involves: forwarding an Interest that includes a KRS query to a local KRS (204.4); forwarding the KRS query from the local KRS (204.4) to the parent KRS (204.3) in the tree topology if the local KRS (204.4) does not have a cached KRS record for the content name; performing a longest prefix-matching lookup in a next-hop table of the parent KRS (204.3), using the content name as input to determine a second routable prefix for a key-resolution zone associated with the content name or a prefix of the content name; disseminating, over the CCN, a second Interest message that includes the KRS query for the content name, and whose name includes the second routable prefix for the key-resolution zone (204.6); and in response to receiving, from the key-resolution zone, a Content Object that includes a routable prefix for a second key-resolution zone, obtaining the KRS record from the second key-resolution zone (204.6); and returning a Content Object whose payload includes the security information that satisfies the query, and whose name includes the Interest message's name, to satisfy the Interest message. receiving, by a key-resolution service, KRS, over a Content Centric Network, CCN, an Interest message with a name that includes a routable prefix associated with the key-resolution service, wherein the Interest includes a KRS query for a content name that is to be resolved in the name or a payload of the Interest, and wherein the KRS is organised into a tree topology such that a local KRS (204.4) has a parent KRS (204.3); obtaining, from the Interest message, the content name that is to be resolved; obtaining a KRS record for the content name, wherein the KRS record includes security information for the content name or a prefix of the content name, wherein obtaining the KRS record involves: forwarding an Interest that includes a KRS query to a local KRS (204.4); forwarding the KRS query from the local KRS (204.4) to the parent KRS (204.3) in the tree topology if the local KRS (204.4) does not have a cached KRS record for the content name; performing a longest prefix-matching lookup in a next-hop table of the parent KRS (204.3), using the content name as input to determine a second routable prefix for a key-resolution zone associated with the content name or a prefix of the content name; disseminating, over the CCN, a second Interest message that includes the KRS query for the content name, and whose name includes the second routable prefix for the key-resolution zone (204.6); and in response to receiving, from the key-resolution zone, a Content Object that includes a routable prefix for a second key-resolution zone, obtaining the KRS record from the second key-resolution zone (204.6); and forwarding an Interest that includes a KRS query to a local KRS (204.4); forwarding the KRS query from the local KRS (204.4) to the parent KRS (204.3) in the tree topology if the local KRS (204.4) does not have a cached KRS record for the content name; performing a longest prefix-matching lookup in a next-hop table of the parent KRS (204.3), using the content name as input to determine a second routable prefix for a key-resolution zone associated with the content name or a prefix of the content name; disseminating, over the CCN, a second Interest message that includes the KRS query for the content name, and whose name includes the second routable prefix for the key-resolution zone (204.6); and in response to receiving, from the key-resolution zone, a Content Object that includes a routable prefix for a second key-resolution zone, obtaining the KRS record from the second key-resolution zone (204.6); and returning a Content Object whose payload includes the security information that satisfies the query, and whose name includes the Interest message's name, to satisfy the Interest message.