Abstract: One embodiment of the present invention provides a system for device registration and discovery in a content-centric network (CCN). During operation, the system receives, by a computer, an interest for registration of a client device. The Interest includes at least a unique identifier associated with the client device. In response to the interest, the system generates a content object, which includes at least a name assigned to the client device; and sends the content object to the client device, thereby enabling the client device to be discovered by other client devices in the CCN.

Abstract: One embodiment of the present invention provides a system for automatic configuration of a computing device in a content-centric network (CCN). During operation, the system sends, by the computing device on at least one of the computing device's faces, an interest in configuration information. The interest has a predetermined name prefix. The system then receives a content object in response to the interest. The content object includes at least a default name prefix, to which the computing device can send other interests. The system further configures the computing device based on the received content object.

Abstract: A client device that obtains a data object for a local user, and can detect a check-in requirement in the data object that instructs the client device to share demographic information with a content broker. The client device generates a check-in message that indicates the data object, and includes identifying information for the local user or the local client device. The client device sends the check-in message to the content broker to share the identifying information. The content broker can analyze the check-in message to determine the user's identifying information, and to determine the data object being consumed by the user. The media broker then stores or aggregates the user's demographic information in a repository, in association with the data object. The media broker generates a response packet that grants the client device access to the data object's contents, and returns the response packet to the client device.

Abstract: An ad-marketplace system manages an exchange for advertisement opportunities from a plurality of content brokers. Each advertising opportunity can include one or more attributes that describe advertisement slots during a broadcast of a data stream. The ad-marketplace system can receive one or more bids for an advertising opportunity associated with a media stream, and can select a matching bid from an advertiser for the advertising opportunity. Each bid can specify one or more advertising requirements that are to be satisfied by the advertising opportunity. When the ad-marketplace system selects the matching bid, the ad-marketplace system establishes a contract between the media broker, and places an initial payment from the advertiser in escrow. The ad-marketplace system can provide a payment to the media broker after confirming that a set of consumers have consumed the advertisement.

Abstract: A content broker can receive a request from a user's client device for access to a data stream, and determines whether the client device has a sufficient number of credits to consume the digital content. If the client device does not have a sufficient number of credits, the broker can provide the client device an opportunity to earn credits. The broker can send to the client device an advertisement stream, and a corresponding challenge query that includes a set of instructions for generating a challenge-response that proves the client device has consumed the advertisement stream. If the broker receives a valid challenge response from the client device, the broker can assign a predetermined number of credits to the user's account.

Abstract: A content-name-resolution (CNR) system can resolve IP addresses for named data objects (NDOs) based on their name. During operation, a CNR server can receive a query from a client device for a source to a named data object. The query can include at least a name prefix for the named data object. The CNR server can identify a cache server that corresponds to the named data object's name prefix, and determines one or more sources associated with the named data object's name prefix. The CNR server then returns, to the client device, a query response that includes a network address for the cache server, and includes a content record specifying the one or more sources.

Abstract: A client device that obtains a data object for a local user, and can detect a check-in requirement in the data object that instructs the client device to share demographic information with a content broker. The client device generates a check-in message that indicates the data object, and includes identifying information for the local user or the local client device. The client device sends the check-in message to the content broker to share the identifying information. The content broker can analyze the check-in message to determine the user's identifying information, and to determine the data object being consumed by the user. The media broker then stores or aggregates the user's demographic information in a repository, in association with the data object. The media broker generates a response packet that grants the client device access to the data object's contents, and returns the response packet to the client device.

Abstract: A data-publishing system facilitates broadcasting a data stream so that each client device obtains a personalized data stream. During operation, a publisher can generate an encoded data stream that does not include a reproducible version of the data stream's contents, and generates an encoding sauce to provide to at least one data-brokering system. When a broker receives a request from a client device for access to the data stream, the broker validates the client device's access to the data stream, and uses the encoding sauce to generate a secret sauce for the client device. The client device can process the encoded data stream using instructions in the secret sauce to produce a personalized data stream that includes a reproducible version of the data stream's contents.

Abstract: A device in an information-centric network or a named-data network can process commands from a packet on one or more local resources. During operation, the device can receive a packet that includes a name or name prefix, and additionally can include a header comprising one or more resource fields that each can include instructions that perform an operation on a corresponding resource. The device can select, from the packet, a resource field that includes instructions to be executed on a corresponding resource. The device can analyze the resource field to determine an instruction that corresponds to the resource, and executes the instruction to perform the operation on the resource. The device can also analyze access control information from the packet's header, and determines whether the access control information grants the packet permission to access the resource prior to performing the operation on the resource.

Abstract: A network device can process a payload in an Interest packet. During operation, the network device can receive an Interest packet that includes a name or a name prefix associated with one or more target entities for the Interest. If the network device determines that the Interest packet includes a payload, the network node can analyze the Interest's name and/or payload to determine an operation to perform for processing the payload. The network device then proceeds to process the payload by performing the determined operation.

Abstract: One embodiment of the present invention provides a system for mitigating interest flooding attacks in content-centric networks (CCNs). During operation, the system receives, at a physical interface of a router, an interest packet; obtains current interest satisfaction statistics associated with the physical interface; and determines whether to forward or drop the interest packet based on the current interest satisfaction statistics.

Abstract: One embodiment of the present invention provides a system for resolving a name request in a network comprising a plurality of groups that use different name-resolution schemes. During operation, the system receives, at a first group, the name request; identifies a parent group of the first group, which is a member of the parent group; and in response to failing to resolve the name request within the first group, forwards the name request to the identified parent group.

Abstract: One embodiment of the present invention provides a system for tracing information leaks. The system introduces linguistic and syntactic changes to a document, and associates these changes with a user identifier, which facilitates identification of a user that may have leaked the document. During operation, the system receives a document. The system then determines a most similar original document based on the received document. The system determines difference between the most similar original document and the received document, and determines a user identifier based on the determined difference.

Abstract: One embodiment of the present invention provides a system for detecting insider attacks in an organization. During operation, the system collects data describing user activities. The system extracts information from the data that includes user information and user communications. The system then generates a topic-specific graph based on the extracted information. The system analyzes a structure of the graph to determine if one or more rules have been violated. The system may determine that a rule associated with the graph has been violated and signal an alarm in response to detecting the rule violation.

Abstract: One embodiment of the present invention provides a system for tracing information leaks. The system introduces linguistic and syntactic changes to a document, and associates these changes with a user identifier, which facilitates identification of a user that may have leaked the document. During operation, the system receives a document. The system then determines a most similar original document based on the received document. The system determines difference between the most similar original document and the received document, and determines a user identifier based on the determined difference.

Abstract: A content-dissemination system distributes, publishes, or makes available a content item to one or more target entities based on contextual information associated with the content item. When a user creates a new content item or the system detects a new content item for a local user, the system determines contextual information for the content item, and uses this contextual and previous historical contextual information to generate a set of structured names for the content item. The system also determines security and privacy polices for disseminating the content item from the determined contextual information and the historical contextual information. The system associates the set of structured names and the security and privacy policies with the content item, and can disseminate the content item to one or more target entities based on these structured names, the security and privacy policies, and the requirements and capabilities of the recipients.

Abstract: A power management apparatus is configured to manage a switch having line-cards with ports. The management apparatus includes a tracking module configured to track activity for each port in a line-card in the switch, and a control module configured to determine whether the line-card is to be disabled. The management apparatus also includes output module configured to initiate a deactivation process for the line-card if all the ports are inactive.

Abstract: The present disclosure includes a system and method for managing network and server power. In an example of managing network and server power according to the present disclosure, routing network traffic is routed onto a number of core networks based on core network statistics, capacity requirements are determined based on core network statistics for the number of core networks and for a number of servers operating a number of virtual machines on the number of core networks, wherein the number of core networks include a number of core switches and a number of edge switches, and the capacity is set for the number of core switches based on the capacity requirements for the number of core networks and for the number of servers based on the capacity requirements for the number of servers.

Abstract: A system for controlling power consumption of a network includes at least one terminal to receive a plurality of requests to route data from a plurality of data sources to a plurality of data sinks, where the data sources and the data sinks are connected to each other through a plurality of network nodes forming the network, and a network configuration unit. The network configuration unit includes a selection module configured to select a configuration of the network nodes that allows the network to have a lowest overall power consumption of the network among a plurality of configurations of the network, and an output module configured to output a plurality of instruction signals to the network nodes to perform the network configuration. A network path for transmitting a network flow is selected that does not allow the network flow to be split and flow through another network path.

Abstract: A switch (100) connected to a network is configured to have one or more components that can be placed in a deep sleep mode. The switch (100) includes a management circuit (150) that is configured to wake up the components in deep sleep mode. The management circuit (150) includes a port (151) that receives packets and a wake-up circuit (152) that determines whether a packet received via the port (151) is a magic packet including a unique ID for the port (151) or the switch (100). If the packet is the magic packet including the unique ID for the port (151) or the switch (100), the wake-up circuit (151) is configured to send a wake-up signal to components in the switch (100) to wake up from the deep sleep mode.