RELATED APPLICATION

[0001] The subject matter of this application is related to the subject matter in the following applications:

U.S. Patent Application No. 13/847,814, entitled "ORDERED-ELEMENT NAMING FOR NAME-BASED PACKET FORWARDING," by inventor Ignacio Solis, filed 20 March

2013 (hereinafter "U.S. Pat. App. No. 13/847,814"); and

U.S. Patent Application No. 12/338,175, entitled "CONTROLLI NG THE SPREAD OF I NTERESTS AND CONTENT I N A CONTENT CENTRIC NETWORK," by inventors Van L.

Jacobson and Diana K. Smetters, filed 18 December 2008 (hereinafter "U.S. Pat. App. No. 12/338,175");

U.S. Patent No. 8,204,060, entitled "METHOD AND SYSTEM FOR FACILITATI NG FORWARDING A PACKET I N A CONTENT-CENTRIC NETWORK," by inventors Van L. Jacobson and James D. Thornton, filed 17 December 2009 (hereinafter "U.S. Pat. No.

8,204,060");

U.S. Patent No. 8,386,622, entitled "METHOD AND APPARATUS FOR

FACILITATI NG COMMUN ICATION I N A CONTENT CENTRIC NETWORK," by inventor Van L. Jacobson, filed 11 December 2008 (hereinafter "U.S. Pat. No. 8,386,622"); and

U.S. Patent Application No. 14/334,530, entitled "I NTEREST RETURN CONTROL

MESSAGE," by inventors Marc E. Mosko, Ignacio Solis, and Ersin Uzun, filed 17 July

2014 (hereinafter "U.S. Pat. App. No. 14/334,530");

the disclosures of which are herein incorporated by reference in their entirety. BACKGROUND

Field

[0002] This disclosure is generally related to distribution of digital content. More specifically, this disclosure is related to a system for explicitly deleting content which is cached at intermediate routers in a CCN. Related Art

[0003] The proliferation of the Internet and e-commerce continues to create a vast amount of digital content. Content-centric network (CCN) architectures have been designed to facilitate accessing and processing such digital content. A CCN includes entities, or nodes, such as network clients and consumers, forwarders (e.g., routers), and content producers, which communicate with each other by sending interest packets for various content items and receiving content object packets in return. CCN interests and content objects are identified by their unique names, which are typically hierarchically structured variable length identifiers (HSVLI). An HSVLI can include contiguous name components ordered from a most general level to a most specific level. As an interest is routed through the network from a consumer to a producer, each intermediate CCN router adds an entry in its pending interest table (PIT) corresponding to the interest and forwards the interest to the next CCN router. When a matching content object is generated by and sent from the producer back to the consumer, the content object follows the reverse path of the interest. Each intermediate CCN router can cache a copy of the content object in a local content store (CS), which allows the router to fulfill a subsequent interest for the content from its cache.

[0004] In addition to interest and content object messages, a current CCN protocol also supports interest return messages. A first CCN node can forward an interest to a second CCN node. The second CCN node can receive the interest, encounter errors in processing the interest (such as no available route), and generate an interest return message. The interest return message conveys information to a requesting entity (e.g., the first CCN node or another downstream node) about a problem or condition that occurs while trying to retrieve the requested content object. The first CCN node (or other downstream entity) can use the interest return message to make local forwarding decisions, e.g., to find the desired content along another link. Interest return messages are described in U.S. Pat. No. 14/334,530.

However, the current CCN protocol does not provide for a message that is analogous to the interest return message, i.e., a message which conveys information to an upstream entity about a problem or condition that occurs while processing a received content object. SUMMARY

[0005] Aspects of the invention are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect may be applied to each aspect alone or in combination with other aspects.

[0006] One embodiment provides a system that communicates information about a previously received content object. During operation, the system generates, by a first computing device, an interest message which includes a name and a verification token which is a hash of a nonce, wherein a name is a hierarchically structured variable length identifier that includes contiguous name components ordered from a most general level to a most specific level. In response to transmitting the interest message to a second computing device, the system receives a content object message which includes a same name as the name for the interest message. In response to detecting a condition associated with the content object message, the system generates a content object return message which includes the nonce and a same name as the name for the content object message. The system forwards the content object return message to the second computing device, thereby facilitating the second computing device to process the content object return message.

[0007] In some embodiments, the system generates the nonce randomly, and computes the verification token by performing the hash on the nonce.

[0008] In some embodiments, in response to detecting the error condition, the system refrains from forwarding the content object to a downstream node, and refrains from storing the content object in a local cache of the first computing device.

[0009] In some embodiments, the system performs a signature verification of the content object. The system determines that the signature verification is unsuccessful. The system indicates in the content object return message that the signature verification is unsuccessful.

[0010] In some embodiments, the system performs a lookup in a pending interest table of the first computing device based on the name for the content object message. The system determines from the lookup that no corresponding entry exists in the pending interest table of the first computing device. The system indicates in the content object return message that no corresponding entry exists in the pending interest table of the first computing device. [0011] In some embodiments, the system determines a number incoming interfaces corresponding to an entry in a pending interest table of the first computing device based on the name for the interest message. The system indicates in the content object return message the number of incoming interfaces.

[0012] In some embodiments, the first computing device and the second computing device communicate via a respective forwarder associated with each computing device, and the second computing device is a next-hop node of the first computing device.

[0013] Another embodiment provides a system that communicates information about a previously received content object. During operation, the system receives, by a second computing device from a first computing device, an interest message which includes a name and a first verification token which is a hash of a first nonce, wherein a name is a hierarchically structured variable length identifier that includes contiguous name components ordered from a most general level to a most specific level. The system retrieves a content object message which includes a same name as the name for the interest message. The system stores in a local cache of the second computing device the content object message and the first verification token. In response to transmitting the content object message to the first computing device, the system receives a content object return message which includes the first nonce and a same name as the name for the content object message. The system processes the content object return message based on the name for the content object return message, the first nonce, and the stored first verification token.

[0014] In some embodiments, in response to determining that the second computing device has a local cache, the system performs the following operations: computes a second verification token which is a hash of a second nonce; replaces, in the interest message, the first verification token with the second verification token; stores in a data structure the name for the interest message, the first verification token, and the second verification token; and transmits the interest message to an upstream node. In response to determining that the second computing device does not have a local cache, the system transmits the interest message to an upstream node.

[0015] In some embodiments, the first verification token is associated with an incoming interface, and the second verification token is associated with an outgoing interface. [0016] In some embodiments, the system computes a third verification token by performing a hash on the first nonce included in the content object return message. The system determines whether the third verification token matches the first verification token included in the interest message.

[0017] In some embodiments, the content object return message indicates that a signature verification performed by the first computing device is unsuccessful or that no corresponding entry exists in a pending interest table of the first computing device based on the name for the content object message. The system processes the content object return message by one or more of: removing from the local cache the content object message; and shutting down a link associated with an upstream node from which the content object is received.

[0018] In some embodiments, the content object return message indicates a number of incoming interfaces corresponding to an entry in a pending interest table of the first computing device based on the name for the interest message. The system processes the content object return message by performing an action based on the number of incoming interfaces.

[0019] Corresponding methods and apparatus are also described herein including network nodes, computer programs, computer program products, computer readable media and logic encoded on tangible media for implementing the methods are also described.

BRIEF DESCRIPTION OF THE FIGURES

[0020] FIG. 1 illustrates an exemplary network that facilitates a node to indicate conditions associated with received content, in accordance with an embodiment of the present invention.

[0021] FIG. 2A presents a flow chart illustrating a method by a first computing device for indicating conditions associated with received content, in accordance with an

embodiment of the present invention.

[0022] FIG. 2B presents a flow chart illustrating a method by a first computing device for indicating conditions associated with received content, including exemplary detected conditions, in accordance with an embodiment of the present invention. [0023] FIG. 3A presents a flow chart illustrating a method by a second computing device for processing conditions associated with content received by a first computing device, in accordance with an embodiment of the present invention.

[0024] FIG. 3B presents a flow chart illustrating a method by a second computing device for processing conditions associated with content received by a first computing device, in accordance with an embodiment of the present invention.

[0025] FIG. 3C presents a flow chart illustrating a method by a second computing device for processing conditions associated with content received by a first computing device, in accordance with an embodiment of the present invention.

[0026] FIG. 4A illustrates an exemplary interest message, in accordance with an embodiment of the present invention.

[0027] FIG. 4B illustrates an exemplary content object message, in accordance with an embodiment of the present invention.

[0028] FIG. 4C illustrates an exemplary content object return message, in

accordance with an embodiment of the present invention.

[0029] FIG. 5 illustrates an exemplary computer and communication system that facilitates a node to indicate conditions associated with received content, in accordance with an embodiment of the present invention.

[0030] In the figures, like reference numerals refer to the same figure elements.

DETAILED DESCRIPTION

[0031] The following description is presented to enable any person skilled in the art to make and use the embodiments, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present disclosure. Thus, the present invention is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein. Overview

[0032] Embodiments of the present invention provide a system that allows a content-requesting node to provide information about received content to upstream content-sending nodes (e.g., an upstream next-hop node), which allows the upstream nodes to take an appropriate action. Recall that in addition to interest and content object messages, a current CCN protocol also supports interest return messages. A first CCN node can forward an interest to a second CCN node. The second CCN node can receive the interest, encounter errors in processing the interest (such as no available route), and generate an interest return message. The interest return message conveys information to a requesting entity (e.g., the first CCN node or another downstream node) about a problem or condition that occurs while trying to retrieve the requested content object. The first CCN node (or other downstream entity) can use the interest return message to make local forwarding decisions, e.g., to find the desired content along another link. Interest return messages are described in U.S. Pat. No. 14/334,530. Thus, an interest return message allows a recipient of an interest to take action on the interest to retrieve the desired content object.

[0033] Similarly, a recipient of a content object may take action when it receives the content object, such as verifying the signature of the content object and forwarding the content object to all downstream links with matching PIT entries. While a forwarding decision made on a content object may not be meaningful to upstream routers, other actions such as verifying the signature may be meaningful to upstream routers. For example, a downstream router may perform a necessary computation (e.g., verify a signature of a content object) before an upstream router. Currently, there is no mechanism for the downstream router to inform upstream routers of the computation.

[0034] To solve this problem, embodiments of the present invention provide a CCN message that is a content object return message. The content object return message forms the last leg of a three-round handshake between two routers participating in an interest and content object exchange. A first node that sends an interest can receive a responsive content object from a second (adjacent and upstream) node. The first node can determine or detect a condition (such as an invalid signature or no matching PIT entry), generate a content object return message, and send the content object return message to the second node. This allows the second node (and any other upstream node that receives the content object return message) to take an action based on information indicated in the content object return message. For example, the second node may discard its cached copy of the associated content object and potentially shut down the upstream link upon which it was received. The protocol can also include elements of security relating to the authenticity of the content object return message.

[0035] Specifically, let R _A be the sender of an interest, and let R _B be the immediate upstream router which receives the interest. Furthermore, let l[N], CO[N], and CORM[N] be an interest, a content object, and a content object return message, respectively, with the name N. R _A can generate a random nonce x - {0,1} ²⁵⁶ and compute a verification token y = H(x), where H is a cryptographic hash function with a digest output of 256 bits. R _A can transmit l[N] with y to R _B . R _B can subsequently forward l[N] (using the same strategy as R _A ) and retrieve CO[N]. R _B can cache y with CO[N] and forward CO[N] to R _A . R _A can determine or detect a condition, generate CORM[N], and transmit CORM[N] with x to R _B . R _B , in possession of x, can authenticate the content object return message by computing yl = H(x) and verifying that the computed yl matches its cached version of y.

[0036] Note that this protocol defers trust in the content object return message to trust in the original interest. Thus, if R _B trusts interests from R _A 's link, R _B also implicitly trusts content object return messages from R _A 's link (after verification). Furthermore, the described protocol communication and exchange occurs between two adjacent devices, or between the forwarding engines of devices that are one hop away from each other. I n addition, in order to forward l[N], R _B can utilize the same strategy as R _A , as long as R _B has a cache. For example, if R _B does not have a cache, R _B can forward l[N] with y along to an upstream router. However, if R _B does have a cache, R _B can generate a new nonce x' and compute a new verification token y' = H(x'), and transmit l[N] with y' to an upstream router. Any router that generates or receives a nonce or verification token can cache the nonce or verification token.

[0037] Thus, embodiments of the present invention allow a first node (e.g., a content-requesting node) to provide information about received content to a second node (e.g., an upstream adjacent content-sending node), whereby the first node generates and sends a content object return message to the second node. This allows the second node to perform an action, which results in a more efficient system and may decrease the amount of network traffic (e.g., fewer invalid content objects passed downstream) and congestion (e.g., fewer invalid links used as active links). The present invention can also result in increased efficiency (e.g., fewer invalid content objects stored in local caches of intermediate routers).

[0038] Thus, these results provide improvements to the distribution of digital content, where the improvements are fundamentally technological. Embodiments of the present invention provide a technological solution (e.g., providing information via verifiable content object return messages to an upstream router, which allows the upstream router to take action, which results in a more efficient system) to the technological problem of the efficient and effective distribution of digital content.

[0039] In CCN, each piece of content is individually named, and each piece of data is bound to a unique name that distinguishes the data from any other piece of data, such as other versions of the same data or data from other sources. This unique name allows a network device to request the data by disseminating a request or an interest that indicates the unique name, and can obtain the data independent from the data's storage location, network location, application, and means of transportation. The following terms are used to describe the CCN architecture:

[0040] Content Object (or "content object"): A single piece of named data, which is bound to a unique name. Content Objects are "persistent," which means that a Content Object can move around within a computing device, or across different computing devices, but does not change. If any component of the Content Object changes, the entity that made the change creates a new Content Object that includes the updated content, and binds the new Content Object to a new unique name.

[0041] Unique Names: A name in a CCN is typically location independent and uniquely identifies a Content Object. A data-forwarding device can use the name or name prefix to forward a packet toward a network node that generates or stores the Content Object, regardless of a network address or physical location for the Content Object. In some embodiments, the name may be a hierarchically structured variable-length identifier (HSVLI). The HSVLI can be divided into several hierarchical components, which can be structured in various ways. For example, the individual name components pare, home, ccn, and test.txt can be structured in a left-oriented prefix-major fashion to form the name

"/parc/home/ccn/test.txt." Thus, the name "/parc/home/ccn" can be a "parent" or "prefix" of "/parc/home/ccn/test.txt." Additional components can be used to distinguish between different versions of the content item, such as a collaborative document.

[0042] I n some embodiments, the name can include a non-hierarchical identifier, such as a hash value that is derived from the Content Object's data (e.g., a checksum value) and/or from elements of the Content Object's name. A description of a hash-based name is described in U.S. Pat. App. No. 13/847,814. A name can also be a flat label. Hereinafter, "name" is used to refer to any name for a piece of data in a name-data network, such as a hierarchical name or name prefix, a flat name, a fixed-length name, an arbitrary-length name, or a label (e.g., a Multiprotocol Label Switching (MPLS) label).

[0043] I nterest (or "interest"): A packet that indicates a request for a piece of data, and includes a name (or a name prefix) for the piece of data. A data consumer can disseminate a request or I nterest across an information-centric network, which CCN routers can propagate toward a storage device (e.g., a cache server) or a data producer that can provide the requested data to satisfy the request or Interest.

[0044] The methods disclosed herein are not limited to CCN networks and are applicable to other architectures as well. A description of a CCN architecture is described in U.S. Pat. App. No. 12/338,175.

Exemplary Network and Environment

[0045] FIG. 1 illustrates an exemplary network 100 that facilitates a node to indicate conditions associated with received content, in accordance with an embodiment of the present invention. Network 100 can include a content requesting device 116, a content producing device 118, and a router or other forwarding device at nodes 102, 104, 106, 108, 110, 112, and 114. A node can be a computer system, an end-point representing users, and/or a device that can generate interests or originate content. A node can also be an edge router (e.g., CCN nodes 102, 104, 112, and 114) or a core router (e.g., intermediate CCN routers 106, 108, and 110). During operation, client computing device 116 can generate and send an interest 130 with a name 130.1 of "/a/b" and a verification token 130.2 of "y." Verification token 130.2 may be the result of a hash function performed on a randomly generated nonce (e.g., "x"), such that y=H(x). Verification token 130.2 may be subsequently used by a node that receives an interest packet which includes verification token 130.2 to verify a content object return message. I nterest 130 can travel through a network (such as a CCN) via nodes or routers 102, 110, and 112, finally reaching content producing device or producer 118. Producer 118 can generate and transmit a responsive content object 140 with a name 140.1 of "/a/b" a nd a verification token 140.2 of "y." Note that token 140.2 can match token 130.2.

[0046] As content object 140 travels back to device 116, each intermediate router (e.g., 112, 110, and 102) can receive and cache content object 140, and determine whether it detects a condition which triggers generation of a content object return message to an upstream node. For example, upon receiving content object 140, node 102 can determine that a condition exists which triggers generation of a content object return message. The condition can include a determination of an invalid signature on the content object message or a lookup in the PIT of the node 102 that returns no matching entry based on the content object name. Node 102 can generate a content object return message 150 with a name 150.1 of "/a/b," a verification nonce 150.2 of "x," and a condition 150.3 of "l nvalid_Sig." Node 102 (or a forwarder associated with a computing device at node 102) can forward content object return message 150 to upstream node 110 (or a forwarder associated with a computing device at node 110), where node 102 and 110 are adjacent nodes, and their respective forwarders are adjacent forwarders.

[0047] Upon receiving content object return message 150, node 110 can process content object return message 150 based on the information indicated in the content object return message. For example, when content return message 150 includes a condition 150.3 of "lnvalid_Sig," node 110 may remove the cached copy of content object 140 from its cache, or node 110 may shut down an upstream link (e.g., corresponding to node 112) from which content object 140 is previously received.

[0048] Thus, embodiments of the present invention provide a system that indicates conditions associated with received content. I n summary, a first node that requests and receives content can detect a condition associated with the received content, and, based on the detected condition, transmit a content object return message to a second node that sent the content. The second node can receive and process the content object return message based on the information indicated in the content object return message. This facilitates an efficient system which includes, in addition to the interest return message, a content object return message, which in turn provides bi-directional notification messages related to requests for content (i.e., interest return messages in response to interest messages) and responses to requests for content (i.e., content object return messages in response to content object messages).

Role of Content Requesting Device

[0049] FIG. 2A presents a flow chart 200 illustrating a method by a first computing device for indicating conditions associated with received content, in accordance with an embodiment of the present invention. During operation, a first computing device generates an interest message which includes a name and a verification token (y) which is a hash of a nonce (x) (operation 202). The first computing device can generate the nonce randomly, and compute the verification token by performing the hash on the nonce. The first computing device transmits the interest message to a second computing device (operation 204). The first computing device receives a content object message which includes a same name and verification token as the interest message (operation 206). The first computing device determines whether it detects a condition associated with the content object message (decision 208). For example, the first computing device can determine an invalid signature, no matching PIT entry, or other condition, as described below in relation to FIG. 2B. If the first computing device does not detect a condition associated with the content object message, the first computing device forwards the content object message to a previous-hop node based on a corresponding PIT entry (operation 210).

[0050] If the first computing device does detect a condition associated with the content object message, the first computing device generates a content object return message which includes the nonce and a same name as the content object message

(operation 212). Depending on a strategy of the first computing device and the detected condition, the first computing device can refrain from forwarding the content object message to a downstream node (operation 214). The first computing device can also refrain from storing the content object message in its local cache (operation 216). The first computing device forwards the content object return message to the second computing device, thereby facilitating the second computing device to process the content object return message (operation 218). [0051] FIG. 2B presents a flow chart 250 illustrating a method by a first computing device for indicating conditions associated with received content, including exemplary detected conditions, in accordance with an embodiment of the present invention. Similar to the operations described in relation to FIG. 2A, the first computing device receives a content object message which includes a same name and verification token as the interest message (operation 206), determines whether it detects a condition associated with the content object message (decision 208), and if not, forwards the content object message to a previous- hop node based on a corresponding PIT entry (operation 210). If it does detect a condition associated with the content object message, the first computing device generates a content object return message which includes the nonce and a same name as the content object message (operation 212).

[0052] The first computing device can detect several types of conditions. The first computing device can perform a signature verification of the content object message

(operation 252). For example, the first computing device can check a KeylD field or other signature information data in the content object message. The first computing device can determine that the signature verification is unsuccessful (operation 254), and indicate in the content object return message that the signature verification is unsuccessful (operation 256). The first computing device can also perform a lookup in the PIT based on the content object name (operation 258). The first computing device can determine that no matching PIT entry exists based on the content object name (operation 260) (i.e., that there is no currently pending interest for content by that name), and indicate in the content object return message that no matching PIT entry exists (operation 262). In the case of both of these conditions (invalid signature and no matching PIT entry), the first computing device can refrain from forwarding the content object to a downstream node and/or from storing the content object in its local cache (as described above in relation to operations 214 and 216, respectively, of FIG. 2A).

[0053] The first computing device can also determine a number of incoming interfaces corresponding to a matching PIT entry based on the interest name (operation 264). The first computing device can indicate in the content object return message the number of incoming interfaces (operation 266), which allows the second computing device to act based on that information. For example, the second computing device can be a caching server or service which may keep track of the number of outstanding interests for content based on a specific name, and can act accordingly based on that information as included in a content object return message. Subsequently, the first computing device forwards the content object return message to the second computing device (operation 216).

Role of Content Providing Device

[0054] FIG. 3A presents a flow chart 300 illustrating a method by a second computing device for processing conditions associated with content received by a first computing device, in accordance with an embodiment of the present invention. The received content is previously transmitted by the second computing device. During operation, the system receives, by a second computing device from a first computing device, an interest message which includes a name and a first verification token (y) which is a hash of a first nonce (x) (operation 302). The system determines whether the second computing device has a cache (decision 304). If it does not, the system stores in the PIT the interest name and the first verification token (operation 310). If the second computing device does have a cache, the system computes a second verification token which is a hash of a second nonce

(operation 306). The system replaces, in the first interest message, the first verification token with the second verification token (operation 308). The system stores in the PIT the interest name, the first verification token, and the second verification token (if computed) (operation 310). The first verification token can be associated with an incoming interface, and the second verification token can be associated with an outgoing interface.

[0055] Thus, the second computing device participates in the content exchange protocol by generating a new verification token to provide to an adjacent device (e.g., an upstream router). That is, a forwarder of the second computing device generates and provides a new verification token to a forwarder of an adjacent device or next-hop node of the second computing device. This allows a node (e.g., the second computing device) that receives a responsive content object to provide sufficient authentication information back downstream to another node (e.g., the first computing device), which can generate a content object return message, which is transmitted back to the second computing device, all the while exchanging sufficient authentication information, as described above in relation to FIG. 1. [0056] Returning to FIG. 3A, the system transmits the interest message to an upstream node (operation 312). Subsequently, the system receives a content object message which includes a same name as the interest message (operation 314). Note that the received content object message may also include the first verification token. The system stores in a local cache of the second computing device the content object message and the first or second verification token (operation 316). For example, if the interest is transmitted without replacing the verification token (e.g., the second computing device has no cache), the system can store the first verification token. If the interest is transmitted by replacing the verification token (e.g., the second computing device does have a cache), the system can store the second verification token. The operation then continues as described at Label A of FIG. 3B.

[0057] FIG. 3B presents a flow chart 320 illustrating a method by a second computing device for processing conditions associated with content received by a first computing device, in accordance with an embodiment of the present invention. The received content is previously transmitted by the second computing device. During operation, the system transmits, by the second computing device, the content object message to the first computing device (operation 322). Subsequently, the system receives a content object return message which includes the first nonce and a same name as the content object name (operation 324). The system processes the content object return message based on the name for the content object return message, the first nonce, and the stored first verification token (operation 326). The system computes a comparison token by performing a hash on the first nonce which was included in the content object return message (operation 328). The system determines whether the comparison token matches the previously stored first verification token (decision 330). If it does not, the system can discard the message

(operation 332). If the comparison token does match the first verification token, the operation continues as described at Label B of FIG. 3C.

[0058] FIG. 3C presents a flow chart 350 illustrating a method by a second computing device for processing conditions associated with content received by a first computing device, in accordance with an embodiment of the present invention. The received content is previously transmitted by the second computing device. If the system does not indicate an unsuccessful verification or no matching PIT entry (decision 352), or if the system does not indicates a number of incoming interfaces corresponding to a PIT entry (decision 358), the system performs an action based on additional information indicated in the content object return message.

[0059] If the content object return message does indicate either an unsuccessful signature verification or no matching PIT entry (decision 352), the system can optiona lly remove from the local cache the content object message (operation 354), and can also optionally shut down a link associated with an upstream node from which the content object is received (operation 356). If the content object return message does indicate a number of incoming interfaces corresponding to a PIT entry (decision 358), the system can perform an action based on the number of incoming interfaces (operation 360). The system can also perform an action based on additional information indicated in the content object return message (operation 362).

Role of Router or Intermediate Node

[0060] Note that the operations described in relation to FIGs. 2A and 2B can be performed by a content requesting device (such as device 116 in FIG. 1), or by any

intermediate router that is acting as a content requesting node (such as node 102 in FIG. 1). I n addition, the operations described in relation to FIGs. 3A, 3B, and 3C can be performed by any content providing device (such as device 118 in FIG. 1), or by any intermediate router that is acting as a content providing node or a content sending node (such as node 110 I n FIG. 1).

Exemplary Interest, Content Object, and Content Object Return Message

[0061] FIG. 4A illustrates an exemplary interest message 430, in accordance with an embodiment of the present invention. I nterest 430 can include a name 430.1 of "/a/b," a type 430.2 of "TJ NTEREST," a verification token 430.3 with a value of "y," and a payload 430.4 of "<data>." Verification token 430.3 may be the result of a hash function performed on a randomly generated nonce (e.g., "x"), such that y=H(x). Verification token 430.3 may be subsequently used by a node that receives an interest packet which includes verification token 430.3 to verify a content object return message, which includes the nonce, x. I nterest 430 may be generated by client computing device 116 of FIG. 1, and transmitted or forwarded by device 116 or any of nodes 102, 110, and 112 of FIG. 1. [0062] FIG. 4B illustrates an exemplary content object message 440, in accordance with an embodiment of the present invention. Content object 440 can include a name 440.1 of "/a/b," a type 440.2 of "T_CONTENT," a verification token 440.3 with a value of "y," and a payload 440.4 of "<data>." Content object 440 may be generated by content producing device 118 of FIG. 1, and transmitted or forwarded by device 118 or any of nodes 112, 110, and 102.

[0063] FIG. 4C illustrates an exemplary content object return message 450, in accordance with an embodiment of the present invention. Content object return message 450 can include a name 450.1 of "/a/b," a type 450.2 of "T_CONTENT_RETURN," a verification nonce 450.3 with a value of "x," a condition 450.4 of "lnvalid_Sig," and a payload 450.5 of "<data>." Condition 450.4 can indicate information that is the result of a computation or lookup, such as, respectively, an invalid signature (e.g., "lnvalid_Sig") or no matching PIT entry (e.g., "No_PIT_Entry"). Condition 450.4 can also include information that a receiving upstream node may use to perform an action, such as a number of incoming interfaces corresponding to a PIT entry based on a name (e.g., "Numj ncj nterf = 5").

[0064] Verification nonce 450.3 can be a nonce randomly generated by a content requesting device that transmitted interest 430 (e.g., device 116 or any of nodes 102, 110, and 112 of FIG. 1). Verification nonce 450.3 can also be used by an upstream content sending device (e.g., node 110 as an upstream router of node 102) to verify the authenticity of content object return message 450.3. For example, node 110 can receive content object return message 450, which includes verification nonce 450.3, and compute a comparison verification token by performing a hash on verification nonce 450.3 (i.e., y'=H(x)). Node 110 can subsequently compare with verification token 430.3 y, which was previously received as part of interest 430 and stored by node 110 in its local cache as associated with name 430.1. If there is a match, node 110 can proceed to process content object return message 450 accordingly. If there is no match, match 110 can discard content object return message 450.

[0065] Note that while content object return message 450 is depicted as including verification nonce 450.3 and condition 450.4 as fields, this information can also be included in a pre-pended header, an encapsulation header, an appended tail header, or other method. Exemplary Computer System

[0066] FIG. 5 illustrates an exemplary computer and communication system 502 that facilitates indicating conditions associated with received content, in accordance with an embodiment of the present invention. Computer and communication system 502 includes a processor 504, a memory 506, and a storage device 508. Memory 506 can include a volatile memory (e.g., RAM) that serves as a managed memory, and can be used to store one or more memory pools. Furthermore, computer and communication system 502 can be coupled to a display device 510, a keyboard 512, and a pointing device 514. Storage device 508 can store an operating system 516, a content-processing system 518, and data 532.

[0067] Content-processing system 518 can include instructions, which when executed by computer and communication system 502, can cause computer and

communication system 502 to perform methods and/or processes described in this disclosure. Specifically, content-processing system 518 may include instructions for generating, by a first computing device, an interest message which includes a name and a verification token which is a hash of a nonce (packet-generating module 522). Content- processing system 518 can include instructions for, in response to transmitting the interest message to a second computing device, receiving a content object message which includes a same name as the name for the interest message (communication module 520). Content- processing system 518 can include instructions for, in response to detecting a condition associated with the content object message (condition-detecting module 528), generating a content object return message which includes the nonce and a same name as the name for the content object message (content object return message-managing module 524).

Content-processing system 518 can include instructions for forwarding the content object return message to the second computing device (communication module 520).

[0068] Content-processing system 518 can also include instructions for generating the nonce randomly and computing the verification token by performing the hash on the nonce (packet-generating module 522). Content-processing system 518 can include instructions for refraining from forwarding the content object to a downstream node and refraining from storing the content object in a local cache of the first computing device (condition-detecting module 528). [0069] Content-processing system 518 can further include instructions for performing a signature verification of the content object and determining that the signature verification is unsuccessful (condition-detecting module 528). Content-processing system 518 can include instructions for indicating in the content object return message that the signature verification is unsuccessful (content object return message-managing module 524). Content- processing system 518 can also include instructions for performing a lookup in a pending interest table of the first computing device based on the name for the content object message, and determining from the lookup that no corresponding entry exists in the pending interest table of the first computing device (condition-detecting module 528). Content- processing system 518 can include instructions for indicating in the content object return message that no corresponding entry exists in the pending interest table of the first computing device (content object return message-managing module 524). Content- processing system 518 can additionally include instructions for determining a number of incoming interfaces corresponding to an entry in a pending interest table of the first computing device based on the name for the interest message (condition-detecting module 528), and for indicating in the content object return message the number of incoming interfaces (content object return message-managing module 524).

[0070] Content-processing system 518 can further include instructions for receiving, by a second computing device from a first computing device, an interest message which includes a name and a first verification token which is a hash of a first nonce (communication module 520). Content-processing system 518 can include instructions for retrieving a content object message which includes a same name as the name for the interest message

(communication module 520). Content-processing system 518 can include instructions for storing in a local cache of the second computing device the content object message and the first verification token (cache-managing module 530). Content-processing system 518 can include instructions for, in response to transmitting the content object message to the first computing device, receiving a content object return message which includes the first nonce and a same name as the name for the content object message (communication module 520). Content-processing system 518 can include instructions for processing the content object return message based on the name for the content object return message, the first nonce, and the previously stored first verification token (content object return message-managing module 524).

[0071] Content-processing system 518 can include instructions for, in response to determining that the second computing device has a local cache (cache-managing module 530): computing a second verification token which is a hash of a second nonce (packet- generating module 522); replacing, in the interest message, the first verification token with the second verification token (packet-generating module 522); storing in a data structure the name for the interest message, the first verification token, and the second verification token (packet-generating module 522); and transmitting the interest message to an upstream node (communication module 520). Content-processing system 518 can also include instructions for, in response to determining that the second computing device does not have a local cache (cache-managing module 530), transmitting the interest message to an upstream node (communication module 520).

[0072] Content-processing system 518 can include instructions for computing a third verification token by performing a hash on the first nonce included in the content object return message (token-processing module 526). Content-processing system 518 can also include instructions for determining whether the third verification token matches the first verification token included in the interest message (token-processing module 526). Content- processing system 518 can include instructions for removing from the local cache the content object message (cache-managing module 530), and shutting down a link associated with an upstream node from which the content object is received (content-object return message- processing module 524). Content-processing system 518 can include instructions for performing an action based on a number of incoming interfaces corresponding to an entry in a pending interest table of the first computing device based on the name for the interest message (content-object return message-processing module 524).

[0073] Data 532 can include any data that is required as input or that is generated as output by the methods and/or processes described in this disclosure. Specifically, data 532 can store at least: a packet that corresponds to an interest, a content object, or a content object return message; a name; a name for an interest, a content object, or a content object return message; a notification message; a hierarchically structured variable length identifier; a condition associated with a content object; a signature for a content object; a random nonce; a token; a hash function; a verification token which is the result of a hash function; a data structure; a pending information table (PIT); a forwarding information base (FIB); a cache or content store (CS); a link or other information which indicates an upstream router, a next- hop node, a downstream router, or a previous-hop node; a forwarder; an indication or indicator that a signature verification is invalid or that no matching PIT entry exists for a given name; an entry in a PIT; a number of incoming interfaces corresponding to a PIT entry; and an indication or indicator of the number of incoming interfaces.

[0074] In summary, one embodiment provides a system that indicates conditions associated with received content. During operation, the system generates, by a first computing device, an interest message which includes a name, wherein the interest message further includes a verification token which is a hash of a nonce. In response to transmitting the interest message to a second computing device, the system receives a content object message which includes a same name as the name for the interest message. In response to detecting a condition associated with the content object message, the system generates a content object return message which includes the nonce and a same name as the name for the content object message. The system forwards the content object return message to the second computing device, thereby facilitating the second computing device to process the content object return message.

[0075] The data structures and code described in this detailed description are typically stored on a computer-readable storage medium, which may be any device or medium that can store code and/or data for use by a computer system. The computer- readable storage medium includes, but is not limited to, volatile memory, non-volatile memory, magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs), DVDs (digital versatile discs or digital video discs), or other media capable of storing computer-readable media now known or later developed.

[0076] The methods and processes described in the detailed description section can be embodied as code and/or data, which can be stored in a computer-readable storage medium as described above. When a computer system reads and executes the code and/or data stored on the computer-readable storage medium, the computer system performs the methods and processes embodied as data structures and code and stored within the computer-readable storage medium. [0077] Furthermore, the methods and processes described above can be included in hardware modules or apparatus. The hardware modules or apparatus can include, but are not limited to, application-specific integrated circuit (ASIC) chips, field-programmable gate arrays (FPGAs), dedicated or shared processors that execute a particular software module or a piece of code at a particular time, and other programmable-logic devices now known or later developed. When the hardware modules or apparatus are activated, they perform the methods and processes included within them.

[0078] The foregoing descriptions of embodiments of the present invention have been presented for purposes of illustration and description only. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.