Security Analysis of a Future Internet Architecture
Zhe Chen, Hongbin Luo, Jianbo Cui, Mingshuang Jin
Sch. of Elec. and Info. Eng.
Beijing Jiaotong University
Beijing, China 100044
Email: {13111036, hbluo, 12120053, 13120082}@bjtu.edu.cn
Abstract—In this paper, we analyze the security threats of a
newly proposed future Internet architecture called CoLoR. In
particular, we describe how CoLoR defends against the most
prevalent attacks existing in both the current Internet and some
recently proposed information-centric networks such as named
data networking (NDN). We also present attacks that are specific
to CoLoR and discuss how to deal with them. Through our
analysis, we find that CoLoR is more secure than both the current
Internet and NDN.
Keywords—Network Architecture, Attacks, Security
I. INTRODUCTION
The current Internet has made great success in the past
few decades. However, with the rapid increase in the number
of users and applications, the current Internet exposes many
deficits that make it difficult to satisfy the requirements of
modern society. For example, the Internet faces serious secu-
rity risks and everyone on the Internet is vulnerable to cyber-
attacks. For instance, the traffic rate of a distributed denial
of service (DDoS) attack against Spamhaus in March 2013
reached 300 gigabits per second [1]. McAfee Inc. reported in
a recent study that cybercrime is costing the world approxi-
mately one trillion dollars every year [2].
Even worse, there is a growing consensus in the networking
community that these limitations cannot be remedied by incre-
mental changes to the current Internet and a clean slate design
is required. Toward this direction, many research programs
(e.g., FIND [3], FIA [4], FIRE [5]) are founded and a plethora
of future Internet architectures (e.g., CCN [6], DONA [7], and
PSIRP [8]) have been proposed in the past years.
In [9], we have proposed a new future Internet architec-
ture called CoLoR. The basic idea of CoLoR is to co
uple
service location with inter-domain routing, but to decouple
them from forwarding. CoLoR allows domains to use their
preferred network architectures. For example, domain A and
domain B may use IPv4 and IPv6 for intra-domain routing,
respectively. As a result, CoLoR makes it possible for different
network architectures and routing mechanisms to coexist and
contest, thus encouraging innovations of novel networking
technologies and network architectures. In addition, we have
presented a prototype implemented to study CoLoR’s fea-
sibility and provided results for evaluating its feasibility in
a large scale deployment. The results show that CoLoR is
promising since it is able to satisfy many requirements of a
future Internet including being information-centric, enhanced
security, encouraging innovation, efficient support for mobility,
multicast, middleboxes, and multi-homing.
In this paper, we analyze how CoLoR defends against the
most prevalent attacks existing in the current Internet and some
recently proposed information-centric networks such as named
data networking (NDN). We also describe attacks that are
specific to CoLoR and discuss how to deal with them. Through
our analysis, we find that CoLoR is more secure than both the
current Internet and NDN.
The rest of the paper is organized as follows. In Section
2, we outline the basic design of CoLoR in order to make
the paper self-contained. In Section 3 and Section 4, we
analyze the security threats of CoLoR and conclude the paper,
respectively.
II. OVERVIEW OF COLOR
In this section, we make an overview of CoLoR.
A. Network Topology
As the current Internet, CoLoR assumes that a future
Internet will continue to be organized around domains. In addi-
tion, domains also have domain-level provider/customer/peer
relationships. Every domain has a logical resource manager
(RM) which might be implemented by one or more physical
machines. For brevity, we use RM
X
to represent an RM as-
sociated with a domain X. Additionally, according to domain-
level relationships, RM
X
is the provider/customer/peer of
RM
Y
if domain X is the provider/customer/peer of domain Y .
Every RM maintains a registration table that stores the
reachability information of services. In addition, as an end
host knows its local DNS server in the current Internet, we
assume that every node in CoLoR knows the location of its
local RM via some local configurations.
B. Naming
CoLoR uses two global namespaces: service identifiers
(SIDs) and node identifiers (NIDs). Every service in CoLoR
has a persistent and unique SID that is not dependent on where
the service locates. By persistent, we mean that the name for
a service remains valid as long as the underlying service is
available. By unique, we mean that two services should have
different SIDs. While there are still debates on how to name
services, we use self-certifying SIDs as in DONA [7]. Node
identifiers are used to name nodes in the network. Every node
in the network has a unique and persistent NID that does not978-1-4799-1270-4/13/$31.00
c
2013 IEEE