SRAN: Scaling Named Data Networking via Map-and-Encap

Source: arXiv:2607.20363 · Published 2026-07-22 · By Tianyuan Yu, Sirapop Theeranantachai, Lixia Zhang

TL;DR

Named Data Networking (NDN) faces a fundamental scalability challenge: forwarding state grows with an unbounded number of application name prefixes and multicast groups, causing state explosion in routers. This paper introduces SRAN, a scalable routing and forwarding architecture for NDN that applies the Map-and-Encap principle to separate prefix reachability from topological reachability. SRAN maps name prefixes to egress edge routers, allowing the network core to forward based solely on topological router identifiers rather than unbounded names. Multicast support is enabled by adapting Bit Index Explicit Replication (BIER), encoding multicast egress sets as bitstrings for stateless forwarding. SRAN is implemented atop the NDN substrate, leveraging native security and dataset synchronization for secure prefix-state dissemination without extra protocols.

Evaluation on representative topologies including the Rocketfuel AS 1755 network demonstrates that SRAN reduces core forwarding state from thousands of prefixes to near-topology size, bounding state growth by topology rather than application scale. Prefix updates converge in real-time with latency close to baseline NDN, while SRAN reduces control-plane packet overhead significantly (e.g., median announcement overhead reduced by ~40%). Forwarding tables in core routers shrink by over 90%, eliminating prefix state from the core, with edge routers maintaining the prefix-to-router mappings. The design secures routing through NDN's signature-based data authentication and trust-anchored policies to prevent prefix hijacking.

Key findings

• SRAN reduces median prefix announcement control overhead from 4.00 packets per link to 2.43 (39.3% reduction) on Sprint PoP topology.
• SRAN cuts median prefix migration control overhead from 8.02p to 7.29p (9.1% reduction) and Q3 from 10.81p to 7.29p (32.6%) on Sprint PoP.
• On Rocketfuel AS 1755 with 1000 unicast and 200 multicast prefixes, core routers reduce forwarding table entries from ~1380–1388 (baseline) to 172 entries with SRAN.
• SRAN achieves prefix-update convergence latency close to baseline: median announcement latency around 99ms vs 97ms baseline, and migration latency 125ms vs 112ms baseline on Sprint PoP.
• Forwarding Information Base (FIB) lookup table size in the network core is decoupled from application prefix count, scaling with topology size.
• SRAN's BIER-based prefix synchronization significantly reduces duplicate dissemination packets by implicit multicast trees.
• Local edge routers maintain Prefix Egress Tables (PET) of prefix-to-egress router mappings, enabling ingress encapsulation and egress decapsulation.
• Routing security leverages NDN's native signed Data framework; prefix announcements and PSD updates are cryptographically validated to prevent hijacking.

Threat model

The adversary is an external unauthorized attacker attempting to hijack prefix announcements or inject false routing state into the Prefix State Database. They cannot compromise the network trust anchor or routers' private keys, nor can they emit validly signed Data for prefixes they do not control. Active attacks against routing protocols or denial-of-service flooding from authorized entities fall outside the scope. The model assumes secure certificate bootstrapping and signature verification by edge routers to enforce prefix ownership and routing authenticity.

Methodology — deep read

Threat model and assumptions: The adversary is presumed external and unauthorized, incapable of compromising the network trust anchor or injecting valid prefix announcements without proper keys. SRAN assumes routers have already obtained reachability through an NDN routing protocol such as NLSR. It does not cover active attacks on routing protocols or denial-of-service from authorized entities.

Data: The evaluation uses two network topologies: the Sprint PoP topology with 52 routers (all-edge scenario) and Rocketfuel AS 1755 topology (111 core and 61 edge routers). Prefix announcements include 1000 unicast and 200 multicast prefixes, with multicast prefixes attached to 3 egress routers each. Simulations use ns-3 and Mini-NDN emulations on a high-end server with extensive CPU and RAM.

Architecture/Algorithm: SRAN introduces the Prefix Egress Table (PET) stored at edge routers mapping application name prefixes to sets of egress routers and local faces, along with delivery type (unicast/multicast). Core routers forward only based on router names or BIER bitstrings, maintaining topology-bound Forwarding Information Bases (FIBs) and Bit Index Forwarding Tables (BIFT). Multicast egress router sets are encoded as BitStrings per BIER, enabling stateless multicast forwarding in the core without per-group state. Mapping dispersal uses the Prefix State Database (PSD), a replicated distributed database synchronized among edge routers using NDN Sync protocols with BIER-encapsulated Interests.

Training regime: n/a (not ML-based). Implementation extends the Go-based NDNd forwarder and routing daemon with modules for PSD/PET management, NDNLPv2 encapsulation of Interests with egress router IDs or BIER bitstrings, and BIER forwarding logic. Router trust anchors and signatures enforce prefix announcement authenticity.

Evaluation protocol: Measures prefix announcement and migration convergence latencies, control-plane packet overhead (packets/link traversals), and forwarding state table sizes comparing SRAN against a baseline deploying all prefixes in each router's FIB. Experiments run 50 repetitions for statistical reliability. Forwarding state snapshots are analyzed on Sprint PoP and Rocketfuel topologies. ns-3 used for large-scale simulation; Mini-NDN emulation used for smaller topologies.

Reproducibility: The implementation is a Golang-based prototype on NDNd forwarder. The paper doesn't explicitly mention public code release or frozen weights. Topologies used are publicly documented Rocketfuel and Sprint PoP models. Exact simulation scripts and parameter sets are not stated in the excerpt.

Concrete example: In a unicast Interest forwarding scenario, an ingress edge router queries PET to map application prefix to candidate egress routers, then selects the lowest cost router and encapsulates the Interest in an NDNLPv2 header with the egress router's name. Core routers forward the encapsulated Interest based solely on router identifiers in the header. The egress edge router decapsulates and delivers the Interest locally, binding the application prefix to a local face. This separates prefix mapping from forwarding in the core and bounds state by topology.

Technical innovations

• Applying the Map-and-Encap routing paradigm to Named Data Networking to separate application prefix reachability from core topological routing.
• Adaptation of Bit Index Explicit Replication (BIER) for stateless multicast forwarding of NDN Interests by encoding multicast egress routers as bitstrings.
• Design and implementation of a synchronized distributed Prefix State Database (PSD) using NDN dataset synchronization (Sync) with BIER-encapsulated Interests to efficiently disseminate prefix-to-egress router mappings.
• Leveraging NDN's native cryptographic Data authentication and trust-anchored security policies to secure routing state without additional routing-security protocols.

Datasets

• Sprint PoP topology — 52 routers, 84 links — emulated in Mini-NDN
• Rocketfuel AS 1755 topology — 172 routers (111 core, 61 edge) — ns-3 simulation, public dataset

Baselines vs proposed

• Baseline (NDNd routing with application prefixes in all FIBs): median prefix announcement overhead = 4.00 packets/link vs SRAN = 2.43 packets/link
• Baseline: median prefix migration overhead = 8.02 packets/link vs SRAN = 7.29 packets/link
• Baseline Sprint PoP: FIB entries per router = 1260–1273 vs SRAN: core FIB = 52 entries (topology size)
• Baseline Rocketfuel AS 1755: FIB entries ~1380-1388 per router vs SRAN core routers FIB size limited to 172 (router topology) entries

Limitations

• The threat model excludes active routing protocol attacks and denial-of-service attacks by authorized entities, focusing on prefix announcement authenticity only.
• Evaluation uses static and emulated topologies without experiments under highly dynamic network failure or churn scenarios beyond controlled prefix migration.
• The prototype extends NDNd in Golang but the paper does not report open-source release or reproducibility details such as full configurations or scripts.
• Multicast scalability benefits rely on BIER forwarding, whose practical deployment and scaling beyond evaluated topologies require further validation.
• The approach assumes trust anchors and stable, authenticated certificate distribution in the network which may be complex in multi-administrative domains.
• SRAN does not remove per-Interest Pending Interest Table (PIT) state, which still grows with interest volume and multicast group size.

Open questions / follow-ons

• How does SRAN perform under large-scale network failures or topology churn, and what are its convergence properties under such stress?
• Can the Map-and-Encap and BIER-based approach be extended to multi-domain NDN deployments with independent trust anchors and inter-domain routing policies?
• What are the performance and security implications when scaling SRAN to Internet-scale or highly dense multicast groups with dynamic membership?
• How can PIT state explosion be addressed or mitigated in conjunction with SRAN to improve overall NDN forwarding scalability?

Why it matters for bot defense

For bot-defense and CAPTCHA engineers, SRAN illustrates a principled approach to scaling stateful, name-based routing by decoupling logical identifiers from topological forwarding state. This design reduces per-node state growth in networks carrying large numbers of application-level prefixes or multicast groups, a challenge analogous to preventing state exhaustion in bot detection or challenge distribution networks. The Map-and-Encap principle and stateless multicast forwarding via BIER could inspire scalable challenge dissemination schemes where core nodes handle only compact topological state rather than application-specific identifiers.

The security integration using cryptographically-signed prefix announcements aligned with trust anchors highlights the importance of authenticating routing or distribution control state to prevent spoofing or hijacking—a critical requirement for preserving integrity in CAPTCHA distribution or bot challenge frameworks. However, SRAN’s reliance on stable trust anchors and synchronization protocols suggests careful management of trust and synchronization is essential in real-world deployments. Overall, the paper offers a foundational architecture relevant to any system requiring scalable, secure routing and multicast delivery of named or classified content.

Cite

@article{arxiv2607_20363,
  title={ SRAN: Scaling Named Data Networking via Map-and-Encap },
  author={ Tianyuan Yu and Sirapop Theeranantachai and Lixia Zhang },
  journal={arXiv preprint arXiv:2607.20363},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.20363}
}

Read the full paper

• arXiv:2607.20363 (abstract)
• arXiv:2607.20363 (PDF)