# Secure and DoS-Resilient Fragment Authentication in CCN-Based Vehicular Networks

Authors: Sangwon Hyun; Hyoungshick Kim
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

Content-Centric Networking (CCN) is considered as a promising alternative to traditional IP-based networking for vehicle-to-everything communication environments. In general, CCN packets must be fragmented and reassembled based on the Maximum Transmission Unit (MTU) size of the content delivery path. It is thus challenging to securely protect fragmented packets against attackers who intentionally inject malicious fragments to disrupt normal services on CCN-based vehicular networks. This paper presents a new secure content fragmentation method that is resistant to Denial-of-Service (DoS) attacks in CCN-based vehicular networks. Our approach guarantees the authenticity of each fragment through the immediate fragment verification at interim nodes on the routing path. Our experiment results demonstrate that the proposed approach provides much stronger security than the existing approach named FIGOA, without imposing a significant overhead in the process. The proposed method achieves a high immediate verification probability of 98.2% on average, which is 52% higher than that of FIGOA, while requiring only 14% more fragments than FIGOA.


---

## Body

## 1. Introduction

Smart transportation based on vehicle-to-everything (V2X) communications is considered as a promising technology due to its potential to provide intelligent services for driving safety and efficiency. Due to the limitation of traditional IP-based networking in vehicular network environments, the transition to a new network paradigm is being discussed. As one of these research directions, several previous studies have proposed various possible Content-Centric Networking (CCN) architectures for V2X communication environments [1–3].CCN [4] was originally proposed as a future Internet architecture that providesnamed data,name-based request and routing, andin-network data caching. Those characteristics seem to be well suited to V2X communications that require high mobility and intermittent connectivity of vehicles. In other words, CCN allows a vehicle to retrieve interested data from any nearby entities even though the vehicle has no connectivity with the original data publisher. Because V2X communication systems are generally designed for the vehicle and pedestrian communication to guarantee the safety of people, establishing secure communication between network entities has naturally become the most critical issue for V2X communications.In this paper, we particularly focus on the problem to provide the authenticity of packet fragments in CCN. To apply the CCN architecture to V2X communication services, it is important to mitigate various network attacks. For example, an attacker can generate a massive amount of fake fragments [5] to disrupt normal services on V2X communication. A possible solution for checking the authenticity of incoming fragments is to use a digital signature system. CCN already mandates that every content be digitally signed by its publisher, and this allows a receiving node to verify the authenticity of the received content through the signature verification. However, each content packet in CCN can be fragmented according to the Maximum Transmission Unit (MTU) size of the data delivery path. Therefore, checking the authenticity of incoming fragments at the content level is not efficient because this process typically incurs a significant delay to collect necessary fragments and reassemble them. These delays are even accumulated at every hop on the routing path. A better option that avoids such latency isfragment-based authentication rather than content-based one, so that each fragment whose authenticity has been confirmed can efficiently be propagated to the next hop without waiting for the remaining fragments.FIGOA [5] is a recent approach to fragment-based authentication in CCN that integrates a one-way hash chain and signature. However, due to the use of one-way hash chain, any single fragment loss results in that none of the subsequent fragments on the hash chain can be verified immediately upon receipt. Consequently, propagation delays can be significant with unverifiable fragments for some V2X applications requiring timely delivery of data packets (e.g., the message for a fatal road accident). To prevent such authentication delays from leading to propagation delays, FIGOA takes a strategy of just forwarding fragments whose authenticity has not been confirmed yet. Unfortunately, this opens the door to DoS attacks to exhaust the fragment buffers of network nodes (e.g., vehicles and roadside units) by intentionally introducing a massive amount of immediately unverifiable fake fragments. Furthermore, CCN-based vehicular networking typically requires network nodes to cache and forward overheard unsolicited data as well as solicited data to facilitate data discovery and delivery under the mobility of vehicles [6–10], and this feature even increases the impact of such DoS attacks. To make matters worse, such flooding of fragments also makes it infeasible to identify the origin of the attack.Figure1 illustrates the DoS attack against FIGOA in the CCN-based vehicular network. The adversary who overhears the interest messages requesting the contents (e.g., X and Y) injects a massive amount of immediately unverifiable fake fragments of the requested contents. According to the optimistic forwarding of FIGOA, the unverified fake fragments are propagated over the vehicles and used to consume the fragment buffers of the vehicles. As particularly illustrated with V1 in Figure 1, the unverified fragments broadcast by V1 affect all the remaining nodes within V1’s signal range as well as V2 and V3 that requested the contents.Figure 1
DoS attack against FIGOA in CCN-based vehicular network.In this paper, we present the design and analysis of an efficient, secure, and DoS-resilient fragment authentication technique for CCN-based vehicular networks. The proposed technique not only guarantees the authenticity of fragments but also provides resistance to DoS attacks exploiting authentication delays. Our key contribution is to propose a novel hash tree construction, which seamlessly integrates an erasure code (for forward error correction) into a hash tree. The proposed hash tree achieves a high immediate verification probability for each fragment upon receipt. Specifically, our analysis results demonstrate that our approach achieves a high immediate verification probability of 98.2% on average over all the test cases, which is 52% higher than that of FIGOA, while requiring 14% more fragments than FIGOA.As another layer of protection against DoS attacks, we have devised an adaptive forwarding strategy for fragments whose authenticity cannot be confirmed immediately upon receipt. By adaptively adjusting the probability of forwarding such fragments according to the recently observed ratio of authentic/inauthentic fragments, it allows the rapid propagation of legal fragments in benign environments, while effectively filtering out illegal fragments in hostile environments.The rest of this paper is organized as follows. Section2 provides some preliminary information on CCN, hash tree, and Rabin’s Information Dispersal Algorithm. Section 3 presents the proposed techniques for secure and DoS-resilient fragment authentication and delivery. Section 4 describes the analysis results of the security and efficiency of the proposed approach. Section 5 overviews related work, and Section 6 concludes this paper.


## 2. Background

### 2.1. Overview of CCN

Every CCN packet contains a content name instead of a host identifier. In particular, a user requests a content by issuing aninterest that contains the name of the content. Each CCN node performs content name-based routing for this interest, so that it can be delivered to the corresponding content publisher. Upon receiving the interest, the publisher replies back with the requested content, and the content is delivered to the user by following the reverse path of the interest via the CCN’s routing mechanism. During delivery, the content is fragmented according to the MTU size of the network link. In addition, each CCN node performs in-network caching to reduce redundant data transmissions and latency. To enable the user to confirm the authenticity of a received content, every content is appended with the publisher’s digital signature.


### 2.2. Hash Tree

We adopt the general scheme of a hash tree described in [11]. A hash tree is constructed over multiple pieces of data to be authenticated, where a leaf node in the tree holds each data piece. Each internal node stores a set of hash values, each of which is the result of applying a collision-resistant hash function (e.g., SHA-256) to the value(s) stored at each of its child nodes. The hash value at the root node is signed using a digital signature algorithm such as RSA, DSA, or ECDSA. Figure 2 presents an example of a hash tree to authenticate eight data pieces, V0,0~V0,7. We assume that each internal node in this tree can have up to four hash values or a single digital signature along with a hash value. We refer to the path from each node up to the root node as itsauthentication path. In Figure 2, for example, the authentication path of V0,1 consists of V0,1, V1,0, V2,0, and V3,0. Given all the nodes over an authentication path, it is possible to verify their authenticity by performing signature verification on the root node and repeatedly computing and comparing hash values along the authentication path. When a piece of data corresponding to a leaf node (i.e., V0,0~V0,7) is modified, the hash values stored at its ancestor nodes, including the root node, are all changed. Moreover, due to the collision-resistance of the hash function, it is not feasible to modify any piece of data without the sign key. Thus, all of the data pieces are authenticated with just a single signature (SIG).Figure 2
Hash tree to authenticate eight pieces of data denoted asV0,0~V0,7.


### 2.3. Information Dispersal Algorithm

We useRabin’s Information Dispersal Algorithm (IDA) [12] to enable the loss-resilient recovery of the hash values stored at internal nodes in a hash tree. Rabin’s IDA is a type of erasure code and consists of two operations: Dispersal and Recovery. For a given Data chunk consisting of m equal-length blocks, Dispersal(Data,m,n) generates n encoded blocks EBi(1≤i≤n,n≥m), each of which has the same length as an input block. Given any m out of n encoded blocks, RecoveryEBij∣1≤ij≤n,1≤j≤m,m,n reconstructs the original Data. Thus, up to (n-m) block losses can be tolerated by using IDA. We refer to the ratio n-m/n as theredundancy rate of IDA.


## 2.1. Overview of CCN

Every CCN packet contains a content name instead of a host identifier. In particular, a user requests a content by issuing aninterest that contains the name of the content. Each CCN node performs content name-based routing for this interest, so that it can be delivered to the corresponding content publisher. Upon receiving the interest, the publisher replies back with the requested content, and the content is delivered to the user by following the reverse path of the interest via the CCN’s routing mechanism. During delivery, the content is fragmented according to the MTU size of the network link. In addition, each CCN node performs in-network caching to reduce redundant data transmissions and latency. To enable the user to confirm the authenticity of a received content, every content is appended with the publisher’s digital signature.


## 2.2. Hash Tree

We adopt the general scheme of a hash tree described in [11]. A hash tree is constructed over multiple pieces of data to be authenticated, where a leaf node in the tree holds each data piece. Each internal node stores a set of hash values, each of which is the result of applying a collision-resistant hash function (e.g., SHA-256) to the value(s) stored at each of its child nodes. The hash value at the root node is signed using a digital signature algorithm such as RSA, DSA, or ECDSA. Figure 2 presents an example of a hash tree to authenticate eight data pieces, V0,0~V0,7. We assume that each internal node in this tree can have up to four hash values or a single digital signature along with a hash value. We refer to the path from each node up to the root node as itsauthentication path. In Figure 2, for example, the authentication path of V0,1 consists of V0,1, V1,0, V2,0, and V3,0. Given all the nodes over an authentication path, it is possible to verify their authenticity by performing signature verification on the root node and repeatedly computing and comparing hash values along the authentication path. When a piece of data corresponding to a leaf node (i.e., V0,0~V0,7) is modified, the hash values stored at its ancestor nodes, including the root node, are all changed. Moreover, due to the collision-resistance of the hash function, it is not feasible to modify any piece of data without the sign key. Thus, all of the data pieces are authenticated with just a single signature (SIG).Figure 2
Hash tree to authenticate eight pieces of data denoted asV0,0~V0,7.


## 2.3. Information Dispersal Algorithm

We useRabin’s Information Dispersal Algorithm (IDA) [12] to enable the loss-resilient recovery of the hash values stored at internal nodes in a hash tree. Rabin’s IDA is a type of erasure code and consists of two operations: Dispersal and Recovery. For a given Data chunk consisting of m equal-length blocks, Dispersal(Data,m,n) generates n encoded blocks EBi(1≤i≤n,n≥m), each of which has the same length as an input block. Given any m out of n encoded blocks, RecoveryEBij∣1≤ij≤n,1≤j≤m,m,n reconstructs the original Data. Thus, up to (n-m) block losses can be tolerated by using IDA. We refer to the ratio n-m/n as theredundancy rate of IDA.


## 3. Our Approach

This section presents the proposed techniques for achieving secure and DoS-resilient fragment authentication in CCN. The key contribution is to apply the systematic IDA into a hash tree so that the system becomes more resilient to time delays and packet losses. In the existing hash tree structure described in Section2.2, missing any internal node disables immediate verification of its child nodes upon receipt due to the loss of the hash values of the child nodes. To address this problem, we apply IDA for the hash values at each height of the hash tree, and this enables immediate verification of child nodes upon receipt even under a certain degree of losses by recovering missing hash values in a prompt manner. Moreover, the systematic property allows the hash values included in the internal nodes to directly appear in the encoded results generated by the dispersal operation. Thus if some of the hash values are received correctly, then we do not need to perform the recovery operation for the received hash values. This technique can significantly reduce the computation cost at receivers. In addition, receiving some of the hash values at height i allows us to immediately verify the corresponding child nodes at height i-1 upon receipt without waiting for mi nodes at height i to be received. This increases the chance of immediate verification in out-of-order delivery situations.Notations summarizes the notations that will be used in the remainder of this paper.


### 3.1. Content Fragmentation and Authentication

Given a content object (CO) to be transmitted, we first divide it into equal-sized fragments. For the fragment size f, we typically use the MTU size of the routing path via which CO will be delivered or if available the globally smallest MTU. Next, we construct a d-nary hash tree over the fragments of CO as described in Section 2.2. Each node in the hash tree corresponds to one fragment, and so we will use the terms “node” and “fragment” interchangeably hereafter. The hash tree illustrated in Figure 2 represents the case that CO consists of eight fragments, denoted as V0,0~V0,7, and each internal node can have up to four children’s hash values (d=f/F·=4).Unfortunately, in such a hash tree structure, any missing internal fragment results in the failure to construct the authentication path of all its child fragments. Thus, it becomes infeasible to immediately verify those child fragments upon receipt. To solve this problem, we integrate Rabin’s IDA into the hash tree construction to add some extra redundant fragments to the internal fragments at each height of the tree, ensuring that we can tolerate up to a certain degree of fragment losses.Systematic IDA.Directly applying Rabin’s IDA is not efficient due to the mandatory requirement of the recovery procedure. In other words, a receiver must always perform the recovery procedure in order to recover the original data from the received m or more packets. We propose customizing IDA such that the original data directly appears on the encoded blocks. As a result, it is possible to skip the recovery procedure as long as all of the original data blocks are given correctly. In other words, a receiver performs the recovery procedure only when some original data blocks are lost. Such a coding scheme that includes the original input in the encoded output is calledsystematic code. Thus, we refer to the two procedures of our customized IDA asSystematicDispersal andSystematicRecovery, respectively, in the remainder of this paper.To achieve the above property, we adoptVandermonde matrix [13] as the encoding matrix of IDA. Let V=vijn×m be a n×m Vandermonde matrix (n≥m), where vij=xij-1 and all xi’s are nonzero elements of a finite field such as GF(28). V has the following properties [13]:(i)
Anym rows out of n rows in V are linearly independent.(ii)
Even if anym rows in V are substituted with the rows of an m×m identity matrix, the modified matrix still has the above property.LetData=b1,b2,…,bN be a chunk of N bytes, where bi represents the ith byte in Data (0≤bi≤255). For simplicity, we assume that N is a multiple of m, and all computations in our customized IDA are performed in GF(28).To customize IDA into a systematic code, we have to properly arrange the input data, so that the input data directly appears as the firstm encoded blocks. This leads to the customized encoding procedure SystematicDispersal(Data,m,n):(1)
The inputData is grouped into blocks of N/m bytes: Data=(b1,…,bN/m),(bN/m+1,…,bN/m+N/m),…, (b(m-1)N/m+1,…,b(m-1)N/m+N/m), and then it is arranged in an m×N/m matrix as follows: (1)M=b1⋯bN/mbN/m+1⋯bN/m+N/m⋮⋮bm-1N/m+1⋯bm-1N/m+N/m.Each row ofM corresponds to each block of N/m bytes in Data.(2)
Select the followingn×m Vandermonde matrix for encoding:(2)V=a1a2⋮amam+1⋮an=100⋯0010⋯0⋮⋮⋮⋮000⋯11xm+1xm+12⋯xm+1m-1⋮⋮⋮⋮1xnxn2⋯xnm-1,wherexi’s ((m+1)≤i≤n) are different nonzero elements of GF(28).(3)
EncodeData into n blocks (rows) EBi (1≤i≤n) as follows: (3)V·M=b1⋯bN/mbN/m+1⋯bN/m+N/m⋮⋮bm-1N/m+1⋯bm-1N/m+N/mpxm+1,1⋯pxm+1,Nm⋮⋮pxn,1⋯pxn,Nm=EB1EB2⋮EBmEBm+1⋮EBn,wherep(xi,j)=∑k=0m-1xikbj+kN/m. Each row of the resulting matrix corresponds to one encoded block. Therefore, the original Data is directly included in the first m encoded blocks. We refer to the first m blocks and the remaining (n-m) blocks asoriginal andredundant blocks, respectively.Given anym encoded blocks EBij (1≤ij≤n,1≤j≤m), we can perform SystematicRecoveryEBij∣1≤ij≤n,1≤j≤m,m,n to reconstruct any missing original data block(s):(1)
LetA be the m×m matrix composed of the m row vectors in {a1,…,an} which are used to generate the given encoded blocks (step 2 in SystematicDispersal). A is invertible because of the linear independence condition on ai(1≤i≤n). Compute A-1.(2)
Recover the original data using the givenm encoded blocks and A-1 as follows:(4)M=A-1EBi1EBi2⋮EBim.The systematic IDA allows us to tolerate up tomin⁡(m,n-m) original data block losses, and at the same time if all of the first m blocks are received correctly, the recovery procedure is no longer required. Moreover, if a network node receives some original data blocks correctly, it does not need to compute the corresponding rows in M (in step 2 of SystematicRecovery). This significantly reduces the computational cost at each receiver.Figure3 illustrates an example application of the systematic IDA to the given data that is composed of four data blocks. Calling SystematicDispersal(Data,4,6) generates the total of six encoded blocks: four original blocks EB1~EB4 and two redundant blocks EB5 and EB6. Even though two original blocks EB2 and EB4 are lost in transmission, they can be recovered from the four received encoded blocks by calling SystematicRecoveryEB1,EB3,EB5,EB6,4,6.Figure 3
Example application of the systematic IDA.Construction of Content Fragments.Now, we present the process to construct the proposed hash tree for a given CO, which is described in Algorithm 1. Figure 4 shows an example of the proposed hash tree constructed over CO which is composed of eight fragments. When IDA is not applied at height i (in lines 8–10 in Algorithm 1), mi=ni (e.g., m0=n0=8 in Figure 4), and ni fragments are constructed by splitting Data. In line 15, we compute the hash values of each fragment, respectively, at height i, and concatenate them together to produce Hi (i.e., Hi=FFrgi,0∥⋯∥F(Frgi,ni-1)). For simplicity, we assume that Hi is a multiple of f. Then Hi directly becomes Frgi+1,0~Frgi+1,mi+1-1 at the upper height i+1, where mi+1=Hi/f. Next, we generate additional redundant fragments Frgi+1,mi+1~Frgi+1,ni+1-1 at height i+1 by calling SystematicDispersal(Hi,mi+1,ni+1) in line 7. In Figure 4, for example, H0=F(Frg0,0)∥⋯∥F(Frg0,7)=Frg1,0∥Frg1,1, and calling SystematicDispersalH0,2=m1,4=n1 additionally generates Frg1,2 and Frg1,3 at height 1. The recovery of any missing original fragment (e.g., either Frg1,0 or Frg1,1) is possible with any two fragments among Frg1,0~Frg1,3. That is, we can tolerate up to two fragment losses. We repeat the same process for each height of the tree until the tree converges into a single node/fragment at a certain height (e.g., Frg2,0 at height 2). We compute the hash value of that single fragment and its signature, and these finally form the root (e.g., Frg3,0) of the tree (in line 12).Algorithm 1:Proposed hash tree construction.
(1)Data←CO, i←0, end←false
(2)while  end=false  do
(3)mi=Dataf
(4)Data←Data∥padding⊳Data=mif
(5)if  i>0and  mi>1  then
(6)ni←minmi/1-r,dmi-1⊳r: redundancy rate of IDA
(7)Encode Data into ni fragments Frgi,j(0≤j<ni) by
performing SystematicDispersal(Data,mi,ni).
(8)else
(9)ni=mi
(10)Split Data into ni fragments Frgi,j(0≤j<ni).
(11)if  ni-1=1  then
(12)Frgi,0←Data∥Sign(Data)∥padding
(13)end←true
(14)else
(15)Hi←F(Frgi,0)∥⋯∥F(Frgi,ni-1)
(16)Data←Hi
(17)i←i+1Figure 4
Proposed hash tree to authenticate eight content fragments.


### 3.2. Transmitting and Verifying Fragments

Immediate verification of received fragments is an important capability for mitigating DoS attacks. To achieve this, ancestors in the hash tree must be received earlier than their children. One possible way to achieve this goal is to enable the sender to transmit the fragments at each height only after it confirms that the receiver has received a sufficient number (≥mi) of fragments at every upper height to recover the hash values there. In other words, the sender should wait for the acknowledgment of height i from the receiver before transmitting the fragments at the lower height (i-1). However, this approach may introduce some overheads (e.g., latency and message transmission) caused by the introduction of height-by-height acknowledgments.In CCN, every fragment of the same content is labeled with the same content name, and this increases the chance that the fragments of the same content are delivered through the same routing path [14]. In consequence, these fragments are likely to arrive in the same order as transmission. To leverage this property, we transmit the fragments at height i earlier than those at height i-1, and for the same height i we transmit Frgi,0 to Frgi,ni-1 in a sequential order. This transmission method increases the chance of immediate verification of fragments upon receipt. In addition, the use of IDA in our approach further increases the probability of immediate verification, even with the occurrence of fragment losses. Moreover, taking advantage of the systematic property of our customized IDA, as soon as receiving an original fragment with its hash value, it is possible to immediately verify any child fragments of the received fragment without performing the recovery procedure. This is also of benefit to increase the chance of immediate verification in out-of-order delivery situations.The root and its only child fragments (e.g.,Frg3,0 and Frg2,0) in the hash tree are critical points of failure, because missing any of these disables the immediate verification of all the remaining fragments. To make these resistant against fragment loss, we transmit 1/1-r-1 extra redundant copies for each of them. This can tolerate up to a fragment loss rate of r.Now, we describe the procedures to verify and forward received fragments. Notations summarizes the descriptions ofV, Vi, and W. For each incoming fragment Frgi,j, we first check if it contains a signature. If so, we verify the fragment through signature verification and append it to V only if it is valid. If Frgi,j contains no signature, then we check if its parent fragment Frgi+1,j/d is already in V. In that case, we compute the hash value of Frgi,j and compare it with the one stored at the parent fragment; F′(Frgi,j)=?(F(Frgi,j) in Frgi+1,j/d). If both hash values are the same, then we append Frgi,j to V. After adding each fragment to V, we also forward it to the next hop, while dropping all inauthentic fragments without forwarding and buffering. If the parent fragment of Frgi,j is not in V, Frgi,j cannot be verified right away. We refer to this kind of fragments asunverifiable fragments and will discuss how to handle unverifiable fragments later in this section.IfVi≥mi and some of Frgi,0~Frgi,mi-1 are missing, then we perform SystematicRecoveryFrgi,jk∣0≤jk<ni,0≤k<mi,mi,ni to recover those that are missing. After these are recovered, we also append them to V. In addition, if some of Frgi,mi~Frgi,ni-1 are missing, then we also regenerate the missing redundant fragments for further forwarding by performing SystematicDispersal(Frgi,0∥⋯∥Frgi,mi-1,mi,ni).In Figure4, for example, let us assume that Frg1,0 has arrived and Frg2,0∈V. In that case, it is possible to immediately verify Frg1,0 by computing its hash value F′(Frg1,0) and comparing it with F(Frg1,0) in Frg2,0. In addition, if only Frg1,0 and Frg1,2 are in V1, then we can recover Frg1,1 by calling SystematicRecoveryFrg1,0,Frg1,2,2,4. Now, we are ready to immediately verify any of Frg0,0~Frg0,7 upon receipt.Even though the proposed method increases the chance for immediate verification of fragments, unverifiable fragments can still occur in the proposed method. That is, incoming fragments can be categorized into the three groups (authentic,inauthentic, orunverifiable). To reduce the delay in processing unverifiable fragments, we proposed a strategy to make an adaptive decision on whether or not to buffer and/or further forward received unverifiable fragments based on the statistics of the authenticity of other recently received fragments.For this strategy to work in practice, we count the numbers (x, y, and z defined in Notations) of authentic, inauthentic, and unverifiable fragments, respectively, received within a specified time interval. With the probability of x/x+y+z, we forward the received unverifiable fragment to the next hop and then buffer it to W. In contrast, with the probability of y/x+y+z, we discard it without forwarding and buffering. Finally, with the probability of z/x+y+z, we only buffer it to W without forwarding. The principle behind this strategy is that, in benign environments, where almost every fragment is authentic, incoming unverifiable fragments are also highly likely to be authentic. Thus, it is reasonable to forward them rather than dropping them to avoid undesirable retransmissions and propagation delays. On the other hand, in hostile environments, unverifiable fragments are likely to be malicious, and so they should be filtered out with a high chance to prevent malicious fragments from being propagated over the network.In order for the fragments inW to eventually be verified, whenever a new fragment is added to V, we check if any of its child fragments is in W. If this is the case, we try to verify their authenticity recursively along the authentication path.


### 3.3. Adjusting Fragment Size

In CCN, the fragments of some content stored in the intermediate node’s cache could be possibly delivered through a routing path whose MTU size does not match the fragment size. Letforig and fnew denote the original fragment size and the new fragment size for the new routing path, respectively. In the case that fnew>forig, if fnew≈cforig(c≥2), we could construct a larger fragment by merging adjacent c fragments at the same height of the hash tree. To support the case that fnew<forig, the one-way hash chain-based approach of FIGOA [5] can be integrated into our hash tree as follows: each fragment in our hash tree is further split into multiple smaller fragments, and a one-way hash chain is constructed over the smaller fragments as in FIGOA.


## 3.1. Content Fragmentation and Authentication

Given a content object (CO) to be transmitted, we first divide it into equal-sized fragments. For the fragment size f, we typically use the MTU size of the routing path via which CO will be delivered or if available the globally smallest MTU. Next, we construct a d-nary hash tree over the fragments of CO as described in Section 2.2. Each node in the hash tree corresponds to one fragment, and so we will use the terms “node” and “fragment” interchangeably hereafter. The hash tree illustrated in Figure 2 represents the case that CO consists of eight fragments, denoted as V0,0~V0,7, and each internal node can have up to four children’s hash values (d=f/F·=4).Unfortunately, in such a hash tree structure, any missing internal fragment results in the failure to construct the authentication path of all its child fragments. Thus, it becomes infeasible to immediately verify those child fragments upon receipt. To solve this problem, we integrate Rabin’s IDA into the hash tree construction to add some extra redundant fragments to the internal fragments at each height of the tree, ensuring that we can tolerate up to a certain degree of fragment losses.Systematic IDA.Directly applying Rabin’s IDA is not efficient due to the mandatory requirement of the recovery procedure. In other words, a receiver must always perform the recovery procedure in order to recover the original data from the received m or more packets. We propose customizing IDA such that the original data directly appears on the encoded blocks. As a result, it is possible to skip the recovery procedure as long as all of the original data blocks are given correctly. In other words, a receiver performs the recovery procedure only when some original data blocks are lost. Such a coding scheme that includes the original input in the encoded output is calledsystematic code. Thus, we refer to the two procedures of our customized IDA asSystematicDispersal andSystematicRecovery, respectively, in the remainder of this paper.To achieve the above property, we adoptVandermonde matrix [13] as the encoding matrix of IDA. Let V=vijn×m be a n×m Vandermonde matrix (n≥m), where vij=xij-1 and all xi’s are nonzero elements of a finite field such as GF(28). V has the following properties [13]:(i)
Anym rows out of n rows in V are linearly independent.(ii)
Even if anym rows in V are substituted with the rows of an m×m identity matrix, the modified matrix still has the above property.LetData=b1,b2,…,bN be a chunk of N bytes, where bi represents the ith byte in Data (0≤bi≤255). For simplicity, we assume that N is a multiple of m, and all computations in our customized IDA are performed in GF(28).To customize IDA into a systematic code, we have to properly arrange the input data, so that the input data directly appears as the firstm encoded blocks. This leads to the customized encoding procedure SystematicDispersal(Data,m,n):(1)
The inputData is grouped into blocks of N/m bytes: Data=(b1,…,bN/m),(bN/m+1,…,bN/m+N/m),…, (b(m-1)N/m+1,…,b(m-1)N/m+N/m), and then it is arranged in an m×N/m matrix as follows: (1)M=b1⋯bN/mbN/m+1⋯bN/m+N/m⋮⋮bm-1N/m+1⋯bm-1N/m+N/m.Each row ofM corresponds to each block of N/m bytes in Data.(2)
Select the followingn×m Vandermonde matrix for encoding:(2)V=a1a2⋮amam+1⋮an=100⋯0010⋯0⋮⋮⋮⋮000⋯11xm+1xm+12⋯xm+1m-1⋮⋮⋮⋮1xnxn2⋯xnm-1,wherexi’s ((m+1)≤i≤n) are different nonzero elements of GF(28).(3)
EncodeData into n blocks (rows) EBi (1≤i≤n) as follows: (3)V·M=b1⋯bN/mbN/m+1⋯bN/m+N/m⋮⋮bm-1N/m+1⋯bm-1N/m+N/mpxm+1,1⋯pxm+1,Nm⋮⋮pxn,1⋯pxn,Nm=EB1EB2⋮EBmEBm+1⋮EBn,wherep(xi,j)=∑k=0m-1xikbj+kN/m. Each row of the resulting matrix corresponds to one encoded block. Therefore, the original Data is directly included in the first m encoded blocks. We refer to the first m blocks and the remaining (n-m) blocks asoriginal andredundant blocks, respectively.Given anym encoded blocks EBij (1≤ij≤n,1≤j≤m), we can perform SystematicRecoveryEBij∣1≤ij≤n,1≤j≤m,m,n to reconstruct any missing original data block(s):(1)
LetA be the m×m matrix composed of the m row vectors in {a1,…,an} which are used to generate the given encoded blocks (step 2 in SystematicDispersal). A is invertible because of the linear independence condition on ai(1≤i≤n). Compute A-1.(2)
Recover the original data using the givenm encoded blocks and A-1 as follows:(4)M=A-1EBi1EBi2⋮EBim.The systematic IDA allows us to tolerate up tomin⁡(m,n-m) original data block losses, and at the same time if all of the first m blocks are received correctly, the recovery procedure is no longer required. Moreover, if a network node receives some original data blocks correctly, it does not need to compute the corresponding rows in M (in step 2 of SystematicRecovery). This significantly reduces the computational cost at each receiver.Figure3 illustrates an example application of the systematic IDA to the given data that is composed of four data blocks. Calling SystematicDispersal(Data,4,6) generates the total of six encoded blocks: four original blocks EB1~EB4 and two redundant blocks EB5 and EB6. Even though two original blocks EB2 and EB4 are lost in transmission, they can be recovered from the four received encoded blocks by calling SystematicRecoveryEB1,EB3,EB5,EB6,4,6.Figure 3
Example application of the systematic IDA.Construction of Content Fragments.Now, we present the process to construct the proposed hash tree for a given CO, which is described in Algorithm 1. Figure 4 shows an example of the proposed hash tree constructed over CO which is composed of eight fragments. When IDA is not applied at height i (in lines 8–10 in Algorithm 1), mi=ni (e.g., m0=n0=8 in Figure 4), and ni fragments are constructed by splitting Data. In line 15, we compute the hash values of each fragment, respectively, at height i, and concatenate them together to produce Hi (i.e., Hi=FFrgi,0∥⋯∥F(Frgi,ni-1)). For simplicity, we assume that Hi is a multiple of f. Then Hi directly becomes Frgi+1,0~Frgi+1,mi+1-1 at the upper height i+1, where mi+1=Hi/f. Next, we generate additional redundant fragments Frgi+1,mi+1~Frgi+1,ni+1-1 at height i+1 by calling SystematicDispersal(Hi,mi+1,ni+1) in line 7. In Figure 4, for example, H0=F(Frg0,0)∥⋯∥F(Frg0,7)=Frg1,0∥Frg1,1, and calling SystematicDispersalH0,2=m1,4=n1 additionally generates Frg1,2 and Frg1,3 at height 1. The recovery of any missing original fragment (e.g., either Frg1,0 or Frg1,1) is possible with any two fragments among Frg1,0~Frg1,3. That is, we can tolerate up to two fragment losses. We repeat the same process for each height of the tree until the tree converges into a single node/fragment at a certain height (e.g., Frg2,0 at height 2). We compute the hash value of that single fragment and its signature, and these finally form the root (e.g., Frg3,0) of the tree (in line 12).Algorithm 1:Proposed hash tree construction.
(1)Data←CO, i←0, end←false
(2)while  end=false  do
(3)mi=Dataf
(4)Data←Data∥padding⊳Data=mif
(5)if  i>0and  mi>1  then
(6)ni←minmi/1-r,dmi-1⊳r: redundancy rate of IDA
(7)Encode Data into ni fragments Frgi,j(0≤j<ni) by
performing SystematicDispersal(Data,mi,ni).
(8)else
(9)ni=mi
(10)Split Data into ni fragments Frgi,j(0≤j<ni).
(11)if  ni-1=1  then
(12)Frgi,0←Data∥Sign(Data)∥padding
(13)end←true
(14)else
(15)Hi←F(Frgi,0)∥⋯∥F(Frgi,ni-1)
(16)Data←Hi
(17)i←i+1Figure 4
Proposed hash tree to authenticate eight content fragments.


## 3.2. Transmitting and Verifying Fragments

Immediate verification of received fragments is an important capability for mitigating DoS attacks. To achieve this, ancestors in the hash tree must be received earlier than their children. One possible way to achieve this goal is to enable the sender to transmit the fragments at each height only after it confirms that the receiver has received a sufficient number (≥mi) of fragments at every upper height to recover the hash values there. In other words, the sender should wait for the acknowledgment of height i from the receiver before transmitting the fragments at the lower height (i-1). However, this approach may introduce some overheads (e.g., latency and message transmission) caused by the introduction of height-by-height acknowledgments.In CCN, every fragment of the same content is labeled with the same content name, and this increases the chance that the fragments of the same content are delivered through the same routing path [14]. In consequence, these fragments are likely to arrive in the same order as transmission. To leverage this property, we transmit the fragments at height i earlier than those at height i-1, and for the same height i we transmit Frgi,0 to Frgi,ni-1 in a sequential order. This transmission method increases the chance of immediate verification of fragments upon receipt. In addition, the use of IDA in our approach further increases the probability of immediate verification, even with the occurrence of fragment losses. Moreover, taking advantage of the systematic property of our customized IDA, as soon as receiving an original fragment with its hash value, it is possible to immediately verify any child fragments of the received fragment without performing the recovery procedure. This is also of benefit to increase the chance of immediate verification in out-of-order delivery situations.The root and its only child fragments (e.g.,Frg3,0 and Frg2,0) in the hash tree are critical points of failure, because missing any of these disables the immediate verification of all the remaining fragments. To make these resistant against fragment loss, we transmit 1/1-r-1 extra redundant copies for each of them. This can tolerate up to a fragment loss rate of r.Now, we describe the procedures to verify and forward received fragments. Notations summarizes the descriptions ofV, Vi, and W. For each incoming fragment Frgi,j, we first check if it contains a signature. If so, we verify the fragment through signature verification and append it to V only if it is valid. If Frgi,j contains no signature, then we check if its parent fragment Frgi+1,j/d is already in V. In that case, we compute the hash value of Frgi,j and compare it with the one stored at the parent fragment; F′(Frgi,j)=?(F(Frgi,j) in Frgi+1,j/d). If both hash values are the same, then we append Frgi,j to V. After adding each fragment to V, we also forward it to the next hop, while dropping all inauthentic fragments without forwarding and buffering. If the parent fragment of Frgi,j is not in V, Frgi,j cannot be verified right away. We refer to this kind of fragments asunverifiable fragments and will discuss how to handle unverifiable fragments later in this section.IfVi≥mi and some of Frgi,0~Frgi,mi-1 are missing, then we perform SystematicRecoveryFrgi,jk∣0≤jk<ni,0≤k<mi,mi,ni to recover those that are missing. After these are recovered, we also append them to V. In addition, if some of Frgi,mi~Frgi,ni-1 are missing, then we also regenerate the missing redundant fragments for further forwarding by performing SystematicDispersal(Frgi,0∥⋯∥Frgi,mi-1,mi,ni).In Figure4, for example, let us assume that Frg1,0 has arrived and Frg2,0∈V. In that case, it is possible to immediately verify Frg1,0 by computing its hash value F′(Frg1,0) and comparing it with F(Frg1,0) in Frg2,0. In addition, if only Frg1,0 and Frg1,2 are in V1, then we can recover Frg1,1 by calling SystematicRecoveryFrg1,0,Frg1,2,2,4. Now, we are ready to immediately verify any of Frg0,0~Frg0,7 upon receipt.Even though the proposed method increases the chance for immediate verification of fragments, unverifiable fragments can still occur in the proposed method. That is, incoming fragments can be categorized into the three groups (authentic,inauthentic, orunverifiable). To reduce the delay in processing unverifiable fragments, we proposed a strategy to make an adaptive decision on whether or not to buffer and/or further forward received unverifiable fragments based on the statistics of the authenticity of other recently received fragments.For this strategy to work in practice, we count the numbers (x, y, and z defined in Notations) of authentic, inauthentic, and unverifiable fragments, respectively, received within a specified time interval. With the probability of x/x+y+z, we forward the received unverifiable fragment to the next hop and then buffer it to W. In contrast, with the probability of y/x+y+z, we discard it without forwarding and buffering. Finally, with the probability of z/x+y+z, we only buffer it to W without forwarding. The principle behind this strategy is that, in benign environments, where almost every fragment is authentic, incoming unverifiable fragments are also highly likely to be authentic. Thus, it is reasonable to forward them rather than dropping them to avoid undesirable retransmissions and propagation delays. On the other hand, in hostile environments, unverifiable fragments are likely to be malicious, and so they should be filtered out with a high chance to prevent malicious fragments from being propagated over the network.In order for the fragments inW to eventually be verified, whenever a new fragment is added to V, we check if any of its child fragments is in W. If this is the case, we try to verify their authenticity recursively along the authentication path.


## 3.3. Adjusting Fragment Size

In CCN, the fragments of some content stored in the intermediate node’s cache could be possibly delivered through a routing path whose MTU size does not match the fragment size. Letforig and fnew denote the original fragment size and the new fragment size for the new routing path, respectively. In the case that fnew>forig, if fnew≈cforig(c≥2), we could construct a larger fragment by merging adjacent c fragments at the same height of the hash tree. To support the case that fnew<forig, the one-way hash chain-based approach of FIGOA [5] can be integrated into our hash tree as follows: each fragment in our hash tree is further split into multiple smaller fragments, and a one-way hash chain is constructed over the smaller fragments as in FIGOA.


## 4. Analysis

In this section, we analyze the security and efficiency of the proposed approach and compare the results with FIGOA. We use the same notations as in Notations.Communication Overhead.To investigate the communication overhead introduced by using the systematic IDA and the hash tree, we analyze the total number of fragments generated from the proposed hash tree for a given content.Theorem 1.
Given a content object (CO), the total number of fragments generated from the proposed hash tree is N=∑i=0hni=CO/f+∑i=1h-2min⁡mi/1-r,dmi-1+2/1-r (see Notations for the meanings of h, d, mi, ni, r, and f).Proof.
For height0, m0=n0=CO/f. For each height i from 1 to (h-2), mi=ni-1/d and ni=min⁡mi/1-r,dmi-1; the term d(mi-1) is required to ensure that the hash tree eventually converges to the single root node. For both heights (h-1) and h, mh-1=mh=1 and nh-1=nh=1/1-r. In consequence, the total number of fragments generated from our hash tree is N=∑i=0hni=CO/f+∑i=1h-2min⁡mi/1-r,dmi-1+2/1-r.Computation Overhead.We analyze the computation cost required to verify a content object. For the entire hash tree constructed over the content object, a single signature verification is required to verify the root fragment. For all the remaining fragments, a single hash operation is required to verify each of them. Thus, at most, ∑i=0h-1ni hash operations are required in total.Consider the computation cost to recover missing fragments. Recovery operations may be required for each heighti from h-2 to 1 of the hash tree. Let li denote the number of missing original fragments at height i. Recovering li fragments first requires a single matrix inversion operation that costs O(mili2) [13]. Next, the cost to reconstruct li fragments is O(mili), and this cost typically dominates the cost of matrix inversion because the single matrix inversion cost is amortized over li fragments [13]. li depends on network condition, and when the packet loss rate is p, li=mip in the average case, and li=min⁡(mi,ni-mi)in the worst case. As a result, the cost of recovery operations is determined by mi. In our experiments shown in Figure 5, for example, 2≤mi≤5 over all the test cases, and the cost of recovery operations is low for such small values of mi.Figure 5
Comparison between our approach and FIGOA by varying content size, fragment size, and fragment loss rate.
(a)
Varying content sizes with the fixed fragment size of 1500 bytes
(b)
Varying fragment sizes with the fixed content size of 16K bytesImmediate Verification Probability.Immediate verification of received fragments can mitigate DoS attacks. Thus, in the following, we analyze the probability that each fragment in the proposed hash tree can be verified immediately upon receipt. Let (1-p) denote the probability that any fragment is received correctly without any error or loss.Theorem 2.
Upon receiving a fragmentFrgi,j at height i (0≤i≤h), the probability f(i) that Frgi,j is immediately verifiable is ∏u=i+1h1-p∑v=0mu-1nu-1v1-pvpnu-1-vfor 0≤i<h, and f(h)=1 (see Notations for the meanings of h, mi, ni, and p).Proof.
In order forFrgi,j to be immediately verifiable, at least one of the following two conditions should be satisfied for every height u(u≥i+1) on the authentication path from the node corresponding to Frgi,j to the root:(i)
The fragment at heightu has been received correctly.(ii)
Otherwise, at leastmu out of the remaining nu-1 fragments have been received correctly.
The probability that at least one of the above two conditions is satisfied for heightu is (1-p∑v=0mu-1nu-1v1-pvpnu-1-v). Therefore, the probability f(i) that Frgi,j is immediately verifiable upon receipt is ∏u=i+1h1-p∑v=0mu-1nu-1v1-pvpnu-1-v.Theorem 3.
The expected probability that any fragment in the proposed hash tree is immediately verifiable upon receipt is∑i=0hf(i)ni/N (see Notations for the meanings of h, ni, and N).Proof.
LetX be a random variable representing the probability that each fragment from the proposed hash tree is immediately verifiable upon receipt. Then, the set of all possible values that X can take is f(i)∣0≤i≤h. The probability Pr(X=f(i)) is ni/N. Therefore, the expected probability that any fragment in the proposed hash tree is immediately verifiable upon receipt is ∑i=0hf(i)ni/N.Based on the derived formulas, we compared our approach with FIGOA in terms of the number of fragments and the immediate verification probability. Figures5(a) and 5(b) show the results when varying the content size, fragment size, and fragment loss rate, respectively. To investigate the impact of the fragment loss rate, we used four different loss rates: p=0.02 (2%), 0.04 (4%), 0.08 (8%), and 0.16 (16%). We set F·=32 and r=0.2 for all of the test cases. To summarize the results, our approach provides a 52% higher immediate verification probability than FIGOA on average, while requiring 14% more fragments. Moreover, our approach achieved a high average immediate verification probability of 98.2% over all the test cases.Effects of Buffer Replacement Policies.Because receivers have a fragment buffer of limited size, buffer replacement policies may affect the performance. The following are buffer replacement policies when Frgi,j has been received under the condition that no empty slot is available in the buffer. We try to find a slot to replace with Frgi,j in the following order of the policies described below:(i)
Replacing unnecessary fragments (RUNF): if we have all mk original fragments (Frgk,0~Frgk,mk-1) for any height k, then we no longer need to keep any redundant fragment (Frgk,mk~Frgk,nk-1) of height k. In addition, any fragment at upper heights (>k) is no longer required because we have finished using the hash values included in those fragments. Thus we replace such a fragment in the buffer with Frgi,j.(ii)
Replacing unverified fragments (RUVF): if any unverified fragment exists in the buffer, we replace it with Frgi,j because it can sometimes be inauthentic one.(iii)
Replacing fragments that will be less utilized (RFLU): if we fail to find any slot by following RUNF and RUVF, then we prefer to pick any slot with a fragment that belongs to any lower height (<i) but is not a descendant of Frgi,j. If there is no such a slot, then we search for fragments at the same height as Frgi,j in the buffer, pick the one with the largest number of child fragments that have been received, and replace it with Frgi,j.To investigate the impact of the above policies on immediate verification of fragments, we performed simulation studies of the following four strategies. Instrategy 1, we applied all three policies (RUNF, RUVF, and RFLU) sequentially. Instrategy 2, we applied the first two policies (RUNF and RFLU) only; if there is no buffer slot that is empty or occupied with unverified fragments, we pick a random slot and replace it with Frgi,j. Instrategy 3, we applied RUNF only; if there is no buffer slot that is empty or occupied with unverified fragments, we pick a random slot and replace it with Frgi,j. Instrategy 4, we did not apply any policies and pick a random slot and replace it with Frgi,j.Figure6 shows the simulation results. The x-axis shows the size of buffer, and the y-axis shows the ratio of the number of immediately verified fragments to the total number of received fragments. We used the following parameter settings: CO=16K bytes, f=700 bytes, F·=32, p=0.16, and r=0.2. To investigate the impact of buffer size, we used four different buffer sizes: 25f, 50f, 75f, and 100f. Note that 25f(=(m0+m1)f) is the minimum required buffer size according to RUNF. Among the four strategies, strategies 1, 2, and 3 (about 0.94) outperformed strategy 4 (about 0.91). Hence, it is our recommendation to use strategy 3 (RUNF only) because it can simplify the process of buffer replacement. Interestingly, as shown in Figure 6, the buffer size made little impact on the ratio of immediately verified fragments when the buffer size is sufficiently large (at least 25f).Figure 6
Simulation results of three different buffer replacement strategies (f: fragment size).Resistance to DoS Attacks.Now we discuss the DoS resistance of our approach. The only strategy DoS attackers can take against our adaptive fragment forwarding mechanism is to inject a large number of immediately unverifiable fake fragments, hoping that they will be propagated over the network. Suppose that the victim node receives an unverifiable fake fragment from the attacker. According to our adaptive forwarding strategy, the fake fragment can be forwarded to the next node with a probability of rx=x/x+y+z. However, as the victim continuously receives such unverifiable fake fragments in the DoS attack situation, the rz=z/x+y+z value for the victim increases, and this leads to a decrease in the value of rx(=1-rz-ry). That is, the probability that fake fragments can be propagated decreases. As a result, it is impossible for the attacker’s fake fragments to be continuously forwarded to the next node. As an additional countermeasure, we can monitor the ratio of immediately unverifiable fragments received from each neighbor. If for any neighbor node the ratio is lower than the expected immediate verification probability, then we can suspect the neighbor to be abnormal.Authenticity of Fragments.For a computationally bounded adversary running in a polynomial time, it is infeasible to generate fragments that can pass the verification process of our approach. The adversary could try to construct a hash tree over his own forged content and then digitally sign the hash value associated with the root node, pretending to be a trusted content publisher. Without the knowledge of the trusted publisher’s private key, however, it is computationally infeasible to forge the trusted publisher’s signature if we use a secure digital signature algorithm (e.g., RSA and ECDSA).As an alternative strategy, given a fragmentFrg0,j of a valid content object from a trusted source, the attacker may attempt to find Frg0,j′ that satisfies HFrg0,j′=HFrg0,j. As long as the attacker finds such Frg0,j′, it will pass our verification process while being misidentified as a fragment of the given content from the trusted source. However, since the cryptographic hash function F(·) used (e.g., SHA-2) is (weak) collision-resistant, it is also computationally infeasible to find such Frg0,j′ different from Frg0,j.


## 5. Related Work

There exist a number of studies on CCN-based vehicular networking. Several data naming approaches were developed for efficient data management and retrieval in CCN-based vehicular networks (e.g., [2, 6, 8, 15]). In particular, the authors in [6] proposed a naming scheme to describe a valid spatial and temporal scope of a given content. The authors in [15] proposed another naming scheme to indicate the popularity and cacheability properties of a given content. The authors in [8] developed a hybrid naming scheme that integrates hierarchical and flat naming.CCN-based vehicular networking typically adopts interest and content flooding to enable fast content discovery, and thus it is critical to reduce the overhead introduced by flooding. In [10, 16], the authors proposed selective flooding approaches such that an intermediate node determines whether or not it floods the received interest according to its knowledge of any node having the requested content or the distance from itself to the known content provider. Several papers discussed randomizing and suppressing transmissions of interest and content messages to avoid potential collisions in shared wireless medium (e.g., [3, 9, 10, 16]). The authors in [7] suggested using cellular network for CCN signaling and short-range communication for content distribution, when multiple radio interfaces are available on network nodes.Several other groups of researchers developed in-network caching and forwarding algorithms of contents, which are optimized for vehicular network environments (e.g., [6–10]). The key idea common to all these approaches is caching and forwarding overheard unsolicited contents as well as solicited contents in order to maximize the effectiveness of overhearing in wireless communication. In [6], based on the proposed naming scheme that represents a valid spatial and temporal scope of a content, the authors proposed an approach to selectively cache the contents within valid spatial and temporal ranges.It is also crucial to protect CCN from malicious attacks. In particular, several groups of researchers proposed techniques to deal with illegal contents in CCN environments. In [17, 18], the authors developed a naming scheme to include the hash value of a content in the content name, so that an intermediate node can identify an invalid content by comparing the hash value of the received content with the hash value in the requested content name. In [19, 20], the hash value of the public key of a content publisher is included in an interest message in order for the receiver to check that the received content is from the actual owner of the public key. Several approaches were developed to take advantage of users’ feedback of data authenticity in order to filter out invalid contents (e.g., [18, 21, 22]).Several other approaches were developed to protect in-network caches from malicious attacks. In [23], an intermediate node probabilistically selects some of the received contents, verifies the selected contents, and caches only the correct contents. In [24], the authors proposed selective caching of contents according to their popularity in order to prevent cache pollution attacks that aim to intentionally replace popular contents currently stored in the caches with unpopular contents to degrade the effectiveness of in-network caching. In [25], the authors proposed a method to identify cache pollution attacks by analyzing incoming interests.Finally, we provide an overview of erasure codes. There are two categories of erasure codes:fixed rate andrateless. Given m original data blocks, a fixed rate erasure code generates a limited number (n) of encoded blocks, where n should be determined prior to encoding, and the recovery of the original data blocks is guaranteed if a certain number (m) of encoded blocks are given. Besides Rabin’s IDA [12], Reed-Solomon code [26], Low-Density Parity-Check code [27], and Tornado code [28] belong to this category. On the other hand, a rateless erasure code can generate a potentially unlimited number of encoded blocks on demand, and if a certain number of encoded blocks are given, the original data blocks can be recovered with a certain probability, where the probability increases as the number of given encoded blocks increases. Luby Transform code [29] and Raptor code [30] are examples of rateless erasure codes.In our approach, we used Rabin’s IDA because of the following requirements. Our approach requires that generating all the encoded fragments in the proposed hash tree should be completed before the content publisher signs the root node of the hash tree in order to accommodate the immediate verification of encoded fragments. In addition, the recovery of any missing original fragment at any heighti of the hash tree should be guaranteed if at least mi encoded fragments out of the total of ni fragments are received. Rabin’s IDA meets these two requirements.


## 6. Conclusion

In this paper, we presented the design and analysis of a secure and DoS-resilient fragment authentication technique for CCN-based vehicular networks. Our approach not only guarantees the authenticity of fragments but also provides high resistance to DoS attacks through the immediate verification of incoming fragments and the adaptive forwarding strategy for immediately unverifiable fragments. The results of our analysis showed that the proposed approach provides much stronger security than FIGOA without imposing a significant overhead. Specifically, our approach achieves a high immediate verification probability of 98.2% on average over all the test cases in the experiments. In comparison with FIGOA, our approach also achieves on average 52% higher immediate verification probability, while requiring 14% more fragments than FIGOA.



---

*Source: 8071267-2018-02-06.xml*