PIT overload analysis in content centric networks

Abstract

Content Centric Networking represents a paradigm shift in the evolution and definition of modern network protocols. Many research efforts have been made with the purpose of proving the feasibility and the scalability of this proposal. Our main contribution is to provide an analysis of the Pending Interest Table memory requirements in real deployment scenarios, especially considering the impact of distributed denial of service attacks. In fact, the state that the protocol maintains for each resource request makes the routers more prone to resources exhaustion issues than in traditional stateless solutions. Our results are derived by using a full custom simulator and considering the different node architectures that have been proposed as valid reference models. The main outcomes point out differentiated weaknesses in each architecture we investigated and underline the need for improvements in terms of security and scalability.

Exploiting Path Diversity for Thwarting Pollution Attacks in Named Data Networking

“…For example, So et al [12] consider a hash flooding denial-of-service (DoS) attack in which an attacker maliciously introduces hash collisions to degrade an NDN router's performance. Virgilio et al [13] show that the PIT component in an NDN router is vulnerable to a distributed DoS (DDoS) attack that seeks to exhaust the PIT's memory with forged Interests.…”

Efficient multicasting in Content-Centric Networks using locator-based Forwarding state

“…This is accomplished using three tables: A content store (CS) lists the COs that are cached locally; a Pending Interest Table (PIT) keeps forwarding state for each forwarded Interest (i.e., a request for a CO or service) processed by a router; and a forwarding information base (FIB) lists the next hops to known name prefixes. The inherent limitations with this approach are the need to lookup very large FIBs and PITs [7], [18], [21], [22], [24] and vulnerabilities to DDoS (distributed denial of service) attacks introduced by PITs [24].…”

“…We have also shown [10], [11] that Interest aggregation combined with the Interest-loop detection mechanisms used in NDN and CCNx can lead to Interests being aggregated while traversing forwarding loops without such loops being detected. Furthermore, using PITs makes routers vulnerable to Interest-flooding attacks [22], [23], [24] in which malicious users can send malicious Interests aimed at making the size of PITs explode.…”

New Directions in Content Centric Networking

“…The large storage requirements of maintaining PITs in NDN or CCN deployments at Internet scale has been addressed by a number of authors [6], [15], [16]. By some estimates, the number of PIT entries needed for NDN and CCN to operate at Internet scale is O (10 6 ).…”

“…Interest flooding attacks [2], [16] can be mounted in which end users simply send Interests requesting valid or invalid content corresponding to routable content-name prefixes at rates that overload PITs.…”