diff --git a/ndn_utils/nlsr.conf b/ndn_utils/nlsr.conf
index 89fad50..1eb56de 100644
--- a/ndn_utils/nlsr.conf
+++ b/ndn_utils/nlsr.conf
@@ -131,6 +131,53 @@
       file-name "root.cert"
     }
   }
+
+  prefix-update-validator
+  {
+    rule
+    {
+      id "NLSR ControlCommand Rule"
+      for interest
+      filter
+      {
+        type name
+        regex ^<localhost><nlsr><prefix-update>[<advertise><withdraw>]<>$
+      }
+      checker
+      {
+        type customized
+        sig-type rsa-sha256
+        key-locator
+        {
+          type name
+          regex ^([^<KEY><%C1.Operator>]*)<%C1.Operator>[^<KEY>]*<KEY><ksk-.*><ID-CERT>$
+        }
+      }
+    }
+
+    rule
+    {
+      id "NLSR Hierarchy Rule"
+      for data
+      filter
+      {
+        type name
+        regex ^[^<KEY>]*<KEY><ksk-.*><ID-CERT><>$
+      }
+      checker
+      {
+        type hierarchical
+        sig-type rsa-sha256
+      }
+    }
+
+    trust-anchor
+    {
+      type any
+      file-name "site.cert"
+    }
+  }
+
   ; cert-to-publish "root.cert"  ; optional, a file containing the root certificate
                                  ; Only the router that is designated to publish the root cert
                                  ; needs to specify this