A blockchain-based architecture for secure vehicular Named Data Networks

Highlights

• A secure blockchain-based interest forwarding scheme is designed.

• A reputation-based blockchain caching placement strategy is designed.

• A lightweight secure neighbor discovery protocol is designed.

• The designed scheme allows only valid interest packets to be forwarded, and only trust data will be cached and delivered.

• Simulation results show the feasibility and efficiency.

Abstract

In vehicular networks, vehicles exchange a massive amount of information aiming at improving people’s safety. Most of this information is personal or sensitive in nature, which makes security and privacy indispensable tasks. Named Data Networking is a future Internet architecture that adopts content-based security and in-network caching features to improve content delivery. However, the use of Named Data Networking on top of vehicular networks brings various challenges, especially in security and trust levels. The use of the distributed and control-less in-network caching allows malicious users to use the built-in design to launch attacks at the cache-store. Moreover, a malicious node can serve invalid or unlimited Interests to start an Interest flooding attack. In this paper, we propose a reputation-based Blockchain mechanism to secure both of Interest and Data forwarding plane, and content caching. The simulation results exhibit that our solution forwards only valid Interest and caches only trust content.

Introduction

In Vehicular Ad-Hoc Network (VANET), a huge amount of information is exchanged between vehicles and the infrastructure aiming at improving driving and human safety. This information can vary from public to personal and sensitive data. On the other hand, the use of the Internet Protocol (IP) in a vehicular network is extremely challenging. For instance, the high mobility of vehicles, poor quality of wireless, and quick changes in network topology affect the content delivery and Quality of Service (QoS) [1]. Moreover, security and privacy is another major challenge in VANETs [2]. In contrast to generic Internet, attacks in VANET may have dire consequences because they directly involve human lives. Indeed, threats such as fake messages may not only compromise drivers’ private information but also cause vandalism and waste network resources by affecting communication and hence-forth leading to accidents. To mitigate such attacks, service and application providers must incorporate trust management, authentication mechanisms, resiliency, and real-time message at the network level.

In order to overcome these and other issues in the current communication model, Information-Centric Networking (ICN) [3] has been introduced as a novel communication model for the future Internet. ICN uses the name of the content as the building block for communication instead of the host address. In particular, the content name is used in most ICN functionalities such as routing, forwarding, security, and in-network caching.

Under the concept of ICN, different architectures have been implemented such as Named Data Networking (NDN) [4]. NDN is an active ICN project that uses hierarchical names to identify content in the network. In NDN, a unique name is associated with each content. Also, the use of a content-based security paradigm allows NDN to secure the content itself rather than the communication channel. This will guarantee security at the packet level, and protect user privacy by appending the signature and trust model at the network level. Besides, the in-network caching feature aims at enhancing the overall network performance and improve the QoS. NDN uses human-readable hierarchically names instead of IP addresses in order to forward and deliver content. NDN follows a request-response model and implements two types of packets [5]. Interest packet: as a form of a request to get content, and a Data packet: as a response for the Interest packet. Interest packet is triggered by a consumer asking for content by specifying its name, every router forwards the content request based on its name until reaching the original content producer or a replica node, then a Data packet that carries the content along with its name is delivered back to consumer(s) using the reverse symmetric path of Interest. Any NDN node can cache the content and serve it for future requests with the possibility to aggregate the same Interest [6]. Each NDN node uses three tables during the forwarding: Content Store (CS) in order to cache and store the content, Pending Interest Table (PIT) that used to keep trace of Interests, and Forwarding Interest Table (FIB) used to route the Interest packets.

Applying NDN on top VANET has several advantages [1]. By using the in-network caching feature, NDN simplifies the mobility support in VANETs by allowing vehicles to retrieve content from the most convenient cache-store or by re-issuing any unsatisfied or lost requests during the mobility. Also, NDN provides security at the packet level coupled with how/where data is received rather than securing the communication channel. However, applying a transparent and border-less caching at the network level may raise critical issues in terms of data security, user privacy, and copyrights. By allowing any node to cache content and serve it for future demands. A malicious user may use this build-in design to launch attacks at the cache-store such as Interest flooding attack, content poisoning attack, cache poisoning/pollution attack, etc. Moreover, any malicious node can act as a trusted node and serve invalid and unlimited Interest packets in order to start Denial of Service attack. Hence, congest the network, exhaust the node’s memory, change the cache distribution, decrease the QoS, and affect the data/user privacy. Therefore, the NDN layer should tackle these attacks at the network level, by validating the requested content name, allowing only valid content to be cached and served, and allowing only valid Interest to be served from trusted vehicles.

To overcome the aforementioned issues, we recommend using Blockchain technology as a secure plane for vehicular named network (VNDN) communication. Indeed, Blockchain has different advantages that make it a strong candidate to provide a secure platform for today’s networks and applications. The first advantage is that Blockchain provides a decentralized and distributed network that allows all nodes to participate in the communication without the need for any centralized entity, the second advantage is that Blockchain uses several cryptographic puzzles that are hard to be solved and changed over time.

Motivated by the advantages of Blockchain, we design a reputation-based Blockchain scheme for data forwarding and content caching in NDN-based vehicular networks. In this paper, we further complement our previous work [7] by designing a secure Blockchain-based Interest forwarding scheme and a reputation-based Blockchain caching placement strategy. The Blockchain is used as a decentralized network that stores the reputation of each vehicle and cache-store. These reputation values are increased and decreased according to the served Interest from the node and content from the cache-store. Indeed, Blockchain allows a secure transition of reputation value, and hence no one is allowed to change it over time. We also design a lightweight secure neighbor discovery protocol in order to provide a secure with less-overhead neighbor vehicle discovery process. The proposed scheme allows only valid Interest packets to be forwarded upstream, and only trust content will be cached and delivered back to consumers. We also evaluate the proposed schemes using ndnSIM. The obtained results show an outperformance of our solution.

The remainder of this paper is organized as follows. Section 2 reviews the Blockchain technology and the existing solutions in VANET. Section 3 presents an overview of the security and the trust in NDN over the vehicle environment. The proposed scheme is detailed in Section 4, we detail the system model, network architecture, and explain different processes for Interest forwarding and data caching. Section 5 provides the implementation details and evaluation results. Finally, Section 6 concludes the paper.