NDNCERT: universal usable trust management for NDN

The Named Data Networking (NDN) architecture builds the security primitives into the network layer: all retrieved data packets must be signed to ensure their integrity authenticity and provenance. To ensure that these primitives are used in a meaningful way without imposing undue burdens on NDN users, the management of cryptographic keys and certificates needs to work in a simple, secure, and user-friendly way. This poster introduces the NDN Trust Management system (NDNCERT) which is designed to fill this need. NDNCERT provides flexible mechanisms to delegate trust between certificates, either within a single device (managing permissions for local applications on a node to operate under a given namespace) or across devices/entities. NDNCERT features a modular design for security challenges that establish trust through out-of-band means for certificate issuing. Once a node or an application obtains a valid certificate for its namespace (or being configured with a self-signed certificate), it automatically becomes a certificate authority for its namespace, and can use the same NDNCERT protocol to produce certificates for the sub-namespaces.