Abstract: A CCN network node use reputation values for one or more interfaces to determine how to forward an Interest. During operation, the network node can receive an Interest or Content Object via a network interface, determines one or more candidate outbound faces for forwarding the Interest by performing a longest-prefix-matching lookup in a forwarding information base (FIB) using the Interest's name or name prefix as input. A respective FIB entry maps a name prefix to a forwarding rule that includes a corresponding outbound face for the name prefix. The node can determine a reputation value for each of the candidate outbound faces based on reputation information stored in association with the Interest's name or name prefix, and selects a candidate outbound face with a reputation value exceeding a first predetermined threshold. The node can then forward the received Interest via the selected outbound face.

Abstract: One embodiment of the present invention provides a system for retrieving a content collection over a network. During operation, the system determines additional information associated with the piece of content that is needed for consumption of the content collection; generates a plurality of Interests, which includes at least one Interest for a catalog of the content collection and at least one Interest for the additional information; and forwards, concurrently, the plurality of Interests, thereby facilitating parallel retrieval of the content collection and the additional information.

Abstract: A device can process commands from a remote device that manages the local device over a content centric network. During operation, the device can receive an Interest for managing a device resource, such that the Interest's name includes a name or a name prefix associated with the device resource, and includes a command for managing the resource. If the device determines that the name prefix corresponds to the local device, the device analyzes the Interest's command to determine a device resource and performs the resource-managing operation on the device resource. If the name prefix does not correspond to the local device, the device performs a longest-prefix-matching lookup using the Interest's name prefix to determine a destination for the Interest. If the Interest's destination corresponds to a component of the local device, the device forwards the Interest to the component or a local agent for the component.

Abstract: A set of Content Store nodes of an information-centric network (ICN) can cache data, and can processes an Interest for this data based on a domain assigned to the requested data. During operation, a CS node can receive a Content Object that is to be cached, and processes the Content Object by determining a domain associated with the Content Object. The CS node selects a storage repository associated with the domain, and stores the Content Object in the selected repository. The CS node can also receive an Interest for a piece of content, and processes the Interest by performing a lookup operation for a rule associated with the Interest's name. The rule can include a set of commands for performing a programmatic operation. Then, if the CS node finds a matching rule, the CS node can execute the rule's commands to perform the programmatic operation.

Abstract: One embodiment of the present invention provides a system for service discovery in a content-centric network (CCN). During operation, the system receives a registration interest associated with a service from a service provider, and generates a confirmation content object in response to the registration interest. The confirmation content object includes at least a name for the service and an admission token. The system then returns the confirmation content object to the service provider, thereby enabling the service provider to provide the service to the CCN.

Abstract: One embodiment provides a system that facilitates routers in verifying content objects in a cost-effective manner by aggregating content objects into a secure content catalog. During operation, a client computing device receives a secure content catalog, which indicates a set of content objects and their corresponding digests. The catalog is digitally signed with the private key of a producer of the catalog. The client computing device constructs an interest for a content object, where the interest indicates a name for the content object and the corresponding digest for the content object, which is based on the secure content catalog. The name for the request content object is a hierarchically structured variable length identifier (HSVLI) which comprises name components ordered from a most general level to a most specific level.

Abstract: One embodiment of the present invention provides a system for automatic configuration of a computing device in a content-centric network (CCN). During operation, the system sends, by the computing device on at least one of the computing device's faces, an interest in configuration information. The interest has a predetermined name prefix. The system then receives a content object in response to the interest. The content object includes at least a default name prefix, to which the computing device can send other interests. The system further configures the computing device based on the received content object.

Abstract: A client device that obtains a data object for a local user, and can detect a check-in requirement in the data object that instructs the client device to share demographic information with a content broker. The client device generates a check-in message that indicates the data object, and includes identifying information for the local user or the local client device. The client device sends the check-in message to the content broker to share the identifying information. The content broker can analyze the check-in message to determine the user's identifying information, and to determine the data object being consumed by the user. The media broker then stores or aggregates the user's demographic information in a repository, in association with the data object. The media broker generates a response packet that grants the client device access to the data object's contents, and returns the response packet to the client device.

Abstract: An ad-marketplace system manages an exchange for advertisement opportunities from a plurality of content brokers. Each advertising opportunity can include one or more attributes that describe advertisement slots during a broadcast of a data stream. The ad-marketplace system can receive one or more bids for an advertising opportunity associated with a media stream, and can select a matching bid from an advertiser for the advertising opportunity. Each bid can specify one or more advertising requirements that are to be satisfied by the advertising opportunity. When the ad-marketplace system selects the matching bid, the ad-marketplace system establishes a contract between the media broker, and places an initial payment from the advertiser in escrow. The ad-marketplace system can provide a payment to the media broker after confirming that a set of consumers have consumed the advertisement.

Abstract: One embodiment of the present invention provides a system for performing concurrent hashing of packet streams. During operation, the system receives a stream of packets at a controller. The controller then identifies types and parameters for a plurality of different hashing operations based on a received packet. The controller further sends the packet concurrently to corresponding different hashing modules to produce different hash values, which can be used to facilitate packet forwarding.

Abstract: A client device that obtains a data object for a local user, and can detect a check-in requirement in the data object that instructs the client device to share demographic information with a content broker. The client device generates a check-in message that indicates the data object, and includes identifying information for the local user or the local client device. The client device sends the check-in message to the content broker to share the identifying information. The content broker can analyze the check-in message to determine the user's identifying information, and to determine the data object being consumed by the user. The media broker then stores or aggregates the user's demographic information in a repository, in association with the data object. The media broker generates a response packet that grants the client device access to the data object's contents, and returns the response packet to the client device.

Abstract: A content broker can receive a request from a user's client device for access to a data stream, and determines whether the client device has a sufficient number of credits to consume the digital content. If the client device does not have a sufficient number of credits, the broker can provide the client device an opportunity to earn credits. The broker can send to the client device an advertisement stream, and a corresponding challenge query that includes a set of instructions for generating a challenge-response that proves the client device has consumed the advertisement stream. If the broker receives a valid challenge response from the client device, the broker can assign a predetermined number of credits to the user's account.

Abstract: A route-tracing application can measure the performance of a path in a named-data network using trace agents deployed across various network nodes. During operation, a network node can process a route-tracing Interest by performing a lookup operation in a forwarding information base (FIB) using the Interest's name, in which a respective FIB entry may map the name to a forwarding rule. If the FIB does not include an entry for the Interest's route-tracing name, a trace agent at the network node determines one or more outbound interfaces for the route-tracing operation based on the Interest's name, and creates new route-tracing FIB entries that each maps the Interest's name to a forwarding rule for the determined interfaces. The network node returns a Content Object that satisfies the Interest, in which the Content Object includes the names of the new FIB entries, as well as performance information for the path.

Abstract: A data-publishing system facilitates broadcasting a data stream so that each client device obtains a personalized data stream. During operation, a publisher can generate an encoded data stream that does not include a reproducible version of the data stream's contents, and generates an encoding sauce to provide to at least one data-brokering system. When a broker receives a request from a client device for access to the data stream, the broker validates the client device's access to the data stream, and uses the encoding sauce to generate a secret sauce for the client device. The client device can process the encoded data stream using instructions in the secret sauce to produce a personalized data stream that includes a reproducible version of the data stream's contents.

Abstract: A network device can process a payload in an Interest packet. During operation, the network device can receive an Interest packet that includes a name or a name prefix associated with one or more target entities for the Interest. If the network device determines that the Interest packet includes a payload, the network node can analyze the Interest's name and/or payload to determine an operation to perform for processing the payload. The network device then proceeds to process the payload by performing the determined operation.

Abstract: A device in an information-centric network or a named-data network can process commands from a packet on one or more local resources. During operation, the device can receive a packet that includes a name or name prefix, and additionally can include a header comprising one or more resource fields that each can include instructions that perform an operation on a corresponding resource. The device can select, from the packet, a resource field that includes instructions to be executed on a corresponding resource. The device can analyze the resource field to determine an instruction that corresponds to the resource, and executes the instruction to perform the operation on the resource. The device can also analyze access control information from the packet's header, and determines whether the access control information grants the packet permission to access the resource prior to performing the operation on the resource.

Abstract: An apparatus for controlling a target device including a first input device configured to provide a first input to the target device, a second input device configured to provide a second input to the target device, and a control mixer configured to generate an output using a policy, the first input and the second input, wherein the output comprises a feedback and a target device output, wherein the feedback comprises some function of the state of the target device, the policy, and the state of each input device connected to the control mixer.

Abstract: A method for managing object evolution in a distributed object store (DOS) involving requesting an update of an object, wherein the object includes an active globally unique identifier (AGUID) object and at least one version globally unique identifier (VGUID) object, wherein the at least one VGUID object includes a first generation number and a first serializer name, locating a first serializer using the first serializer name, wherein the first serializer is associated with the first generation number, obtaining an order of the update using the first serializer, and creating a new VGUID object, wherein the new VGUID object includes a new version number, the first generation number, and the first serializer name.

Abstract: Methods and systems consistent with the present invention provide dynamic security policies that change the granularity of the security at the node level, process level, or socket level. Specifically, a channel number and virtual address are associated with various processes included in a process table. Since a security policy is required for all processes, secure and insecure processes located on the same channel may communicate with one another. Moreover, processes located on different channels may communicate with one another by a gateway that connects both channels. This scalable blanketing security approach provides an institutionalized method for securing any process, node or socket by providing a unique mechanism for policy enforcement at runtime or by changing the security policies.

Abstract: The present invention uses a group key management scheme for admission control while enabling various conventional approaches toward establishing peer-to-peer security. Various embodiments of the invention can provide peer-to-peer confidentiality and authenticity, such that other parties, such as group members, can not understand communications not intended for them. A group key may be used in combination with known unicast security protocols to establish, implicitly or explicitly, proof of group membership together with bi-lateral secure communication.