PIT Overload Analysis in Content Centric Networks - Slides ICN '13

ACM SIGCOMM Workshop on Information-Centric Networking – 12/08/2013

1/16

PIT Overload Analysis in Content

Centric Networks

Matteo Virgilio, Guido Marchetto, Riccardo Sisto Department of Control and Computer Engineering

Politecnico di Torino


2/16

A stateful protocol: the Pending Interest Table

• Used to store all seen Interests

• One entry for each requested piece of content

• Multiple Interests for a single name are merged in a single

entry (Interest merging)

Name PendingInterfaces

/acm.org/papers/paperA.pdf/1 etho

/acm.org/papers/paperB.pdf/1 eth1

/acm.org/papers/paperA.pdf/2 eth0

/acm.org/papers/paperB.pdf/2 eth1

CCN Router PIT


3/16

Problem Description

• Malicious users could craft Interests for non existing

resources: Interest Flooding Attack (IFA)

– Very long random names

– possibly long lifetime values (even hundreads of seconds)

• Why do we have to consider so “long” requests? The

answer is long-polling!

• Supporting publish/subscribe paradigm may require to

store long (potentially unanswered) requests for a long

period of time

• No information about when the response will be generated

(routers cannot make any assumption)

• Simply dropping Interests with high lifetime is too simplistic


4/16

What has been done in recent literature?

• A wide part of the research activity focused on privacy and

data integrity issues

• What about the PIT?

– Some architecture proposals

• Bloom filter implementation of the PIT (DiPIT)

• Hash based PIT implementation with some interesting variants

(Name Prefix Tree encoding)

– Reactive algorithms for IFA handling:

• Statistics based reaction to attackers activity;

• Poseidon Framework (very recent)


5/16

Our contribution

• Simulation based approach

– we developed a full custom Java ccnSimulator

• Different target: evaluating attack impact on a real

topology

• Evaluate different PIT architectures in various network load

(and attack) scenarios


6/16

Simulation scenario

• Reference topology from Telecom Italia (the most prominent

Italian ISP)

• 9 milions of subscribers

• ADSL with 7Mbps/1Mbps(downlink/uplink)

• Zipf content distribution

• Metrics gathered

– Chunk retransmission rate

at the endpoints

• Fixed PIT size

– 1 GB


7/16

Attack model

• Distributed bot net

• Different simulation campaigns

1) Variable lifeTime

2) Variable bandwidth

• Different URI size

≈1000 bytes for the SimplePIT

case

20 bytes for the HashedPIT

case (SHA-1 as hashing

algorithm)


8/16

Attacker’s transmission efficiency

SimplePIT

Attack efficiency

HashedPIT, DiPIT

Attack efficiency

Interest Header(20 bytes)

Resource name(1000 bytes)

Interest Header(20 bytes)

Resource name(20 bytes)

%98)100020(

1000

bytes

bytes%50

)2020(

20

bytes

bytes


9/16

Simulation Results (1)

AttackSettings SimplePITRetransmissions /RAM usage

HashedPITRetransmissions/RAM usage

DiPITRetransmissions/RAM usage

Band = 100 Mbps

LifeTime= 4 sec0 49 MB 0 25 MB 0.01 % 1 GB

Band = 500 Mbps


Band = 2 Gbps


Band = 4 Gbps

LifeTime= 4 sec15 % FULL 83 % FULL 90 % 1 GB

Band = 100 Mbps

LifeTime= 60 sec0 735 MB 0 375 MB 21 % 1 GB

Band = 100 Mbps

LifeTime= 120 sec37 % FULL 0 750 MB 86 % 1 GB

Band = 100 Mbps

LifeTime= 180 sec52 % FULL ∞ FULL 88 % 1 GB


10/16





Band = 100 Mbps


Band = 500 Mbps


Band = 2 Gbps


Band = 4 Gbps


Band = 100 Mbps


Band = 100 Mbps


Band = 100 Mbps



11/16





Band = 100 Mbps


Band = 500 Mbps


Band = 2 Gbps


Band = 4 Gbps


Band = 100 Mbps


Band = 100 Mbps


Band = 100 Mbps



12/16





Band = 100 Mbps


Band = 500 Mbps


Band = 2 Gbps


Band = 4 Gbps


Band = 100 Mbps


Band = 100 Mbps


Band = 100 Mbps



13/16


• Settings: Band = 100 Mbps, LifeTime = 180 sec

• Settings: Band = 4 Gbps, LifeTime = 4 sec


14/16

Conclusion

• All the architectures work properly in normal network

conditions and also in presence of low intensity attack

• HashedPIT is the most affected PIT in our context

• Other scenarios could be designed to worsen SimplePIT too

– Distribute more zombies around the network;

– Combine both high bandwidth and high lifetime to maximize

the attack effectiveness;

– …

• Scalable and robust solutions are needed to ensure an

adequate level of confidence to the CCN paradigm.


15/16

Future contribution

• Very recent solutions have been proposed to mitigate the

impact of Interest Flooding Attacks

• Our plan for the future is to evaluate them in our scenarios

in terms of:

– Resilience

– CPU usage

– Memory usage


16/16

Thank you for the attention!

PIT Overload Analysis in Content Centric Networks - Slides ICN '13

Technology

acm sigcomm workshop

informationcentric networking

bytes bytes p

interfaces acm

bytes resource

pdf1 eth1 acm

pdf2 eth0 acm

pit implementation