Information-Centric Networking (ICN)

The primary architectural realization of ICN where communication is driven by named data rather than IP addresses. A consumer sends an Interest packet containing a hierarchical name prefix, and the network routes this request toward a data producer. Any node with a matching Data packet in its Content Store can satisfy the request, enabling opportunistic caching. NDN uses two packet types—Interest and Data—and maintains state in the Pending Interest Table (PIT) to aggregate requests and ensure symmetric routing back to the consumer.

The in-network cache embedded within every ICN router that stores passing Data packets for future reuse. Unlike traditional CDN caches placed at specific overlay locations, the Content Store is a universal, transparent caching layer integrated into the forwarding plane. When an Interest packet arrives, the router first checks its CS. On a cache hit, the router immediately returns the cached Data packet and discards the Interest, preventing upstream propagation. The CS implements a cache replacement policy—such as LRU or LFU—to manage limited storage, and its effectiveness is measured by the cache hit ratio.

A critical stateful forwarding structure unique to ICN that records each forwarded Interest packet along with the interface it arrived on. The PIT serves three essential functions:- Request aggregation: Multiple consumers requesting the same content have their Interests collapsed into a single upstream request.- Loop detection: Duplicate Interests arriving on different interfaces are identified and discarded.- Reverse path forwarding: When a matching Data packet returns, the PIT entry dictates which downstream interfaces to forward it to, then the entry is removed.Unlike IP's stateless forwarding, the PIT introduces soft state with finite lifetimes, requiring careful management to prevent resource exhaustion under DDoS attacks.

The name-based routing table that maps content name prefixes to one or more outgoing interfaces. Unlike IP FIBs that use fixed-length numerical addresses, the ICN FIB performs longest prefix matching on hierarchical, variable-length names—similar to URL path routing. A single prefix may have multiple next-hops, enabling adaptive forwarding where the router can dynamically select the best path based on observed performance metrics like round-trip time or packet loss. The FIB is populated by a name-based routing protocol such as Named-data Link State Routing (NLSR), which disseminates reachability information for content prefixes rather than host addresses.

ICN names are hierarchically structured, human-readable, and application-defined, typically resembling file system paths or URLs. For example, /com/example/videos/cat.mp4/v3/s1 identifies a specific segment of a video. This structure enables:- Aggregation: Routers can collapse state for related content under a common prefix.- Versioning and segmentation: Names embed version identifiers and segment numbers natively, allowing consumers to request specific fragments.- Security binding: The name is cryptographically bound to the content itself, not to a server location, enabling data-centric security where trust originates from the publisher's signature on the Data packet rather than from the channel. The naming convention is opaque to the network; only the application and the consumer need to understand the semantics.

ICN secures the content itself rather than the communication channel. Each Data packet carries a digital signature binding the content name, payload, and publisher's identity. Consumers can verify the signature regardless of where the data was retrieved—from the origin server, a neighbor's cache, or an intermediate router. This model provides:- Provenance verification: The consumer cryptographically confirms the original publisher.- Integrity assurance: Any modification to the cached content invalidates the signature.- Fine-grained trust: Applications define their own trust models using trust schemas that specify which keys are authorized to sign which name prefixes.Unlike TLS, which secures a point-to-point pipe, ICN security persists through the entire content distribution chain, enabling safe opportunistic caching without trusting intermediate nodes.