NDN Security

Identity Management

Used for CS217B

Zhiyi Zhang
Apr 2020

Identity, Key, and Certificate

  • An identity is a name that is associated with a pair of public/private key pair.

    • E.g., /example is an identity
  • Each key pair also has a name

    • E.g., /example/KEY/123
      • example is identity name
      • KEY is a const component in all NDN key names
      • 123 is key ID
  • A certificate is an Data packet whose content is the public key bits and is signed by a CA

    • Show a real example

Their Relationship

  • A device can have multiple identities.

    • E.g., My laptop owns three identities /zhiyi-home/laptop, /ndn/edu/ucla/zhiyi, /ndn/edu/ucla/ndncert
  • An identity can have multiple keys.

    • E.g., My identity /ndn/edu/ucla/zhiyi has multiple keys because I keep renewing my key pair for best practice
  • Each key can have multiple certificates.

    • E.g., My key /ndn/edu/ucla/zhiyi/KEY/123 can have multiple certificates: a self-signed certificate, and a number of certificates issued by the NDN testbed CA.

Commonly Used Commands

  • List identities, keys, and certificates: ndnsec-ls-identity
  • Generate new identities, keys, and certificates: ndnsec-key-gen
  • Delete identities, keys, and certificates: ndnsec-delete
  • Signing a certificate for a key: ndnsec-sign-req, ndnsec-cert-gen, ndnsec-cert-install
  • Dump certificate: ndnsec-cert-dump
  • Transfer your private key: ndnsec-export, ndnsec-import

Review the Basic Concepts of Trust Schema

Trust schema is based on identities, keys, and certificates.

  • A rule matches Interest/Data packets with certain name
    • E.g., /home/<>*: /home/temperature, /home/bedroom/heater
  • The rule have a requirement of which identity's key is trustworthy to sign this packet
    • E.g., /home/zhiyi/KEY/<>: only Zhiyi's key can be used to sign these Interest/Data packets
  • The rule must contain a trust anchor certificate
    • Otherwise, an attacker can generate a key called /home/zhiyi/KEY/123 and impersonate me.
    • The trust anchor must be installed by all system users in a secure way.
  • Trust schema is a set of rules

A real example of trust schema rule

In ValidatorConfig's syntax that has been supported by ndn-cxx.
You can use it in your program 😄

  id "home data rule"
  for data
    type name
    name /home
    relation is-prefix-of
    type customized
    sig-type rsa-sha256
      type name
      name /home/zhiyi
      relation is-prefix-of
  type file
  file-name "anchor.cert"

Find more details from the NDN website.

Next Monday: Demonstrate the use of APIs of NDN security

  • Introduction of ndn-cxx's security modules
  • Straightforward signing and verification of Interest and Data packets using ndn-cxx
  • Use of trust schema with ndn-cxx