WO2023087590A1 - 网络抗重放方法、装置、电子设备及存储介质 - Google Patents

网络抗重放方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2023087590A1
WO2023087590A1 PCT/CN2022/082122 CN2022082122W WO2023087590A1 WO 2023087590 A1 WO2023087590 A1 WO 2023087590A1 CN 2022082122 W CN2022082122 W CN 2022082122W WO 2023087590 A1 WO2023087590 A1 WO 2023087590A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
replay
interval
packet number
current data
Prior art date
Application number
PCT/CN2022/082122
Other languages
English (en)
French (fr)
Inventor
张振丰
孙昊
李正祥
王坤
王赛
Original Assignee
深圳市中兴微电子技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市中兴微电子技术有限公司 filed Critical 深圳市中兴微电子技术有限公司
Publication of WO2023087590A1 publication Critical patent/WO2023087590A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of the present application relate to the field of communication transmission, and in particular to a network anti-replay method, device, electronic equipment, and storage medium.
  • the parameters required for packet encapsulation, encryption and decryption, and authentication are all obtained from the Security Association (Secure Association, SA), including parameters such as keys and identification numbers .
  • SA Security Association
  • user data is marked with a 32-bit packet number (Packet Number, PN) in a security tag (Security Tag, SecTAG), and is sent out after integrity or confidentiality protection with user data.
  • PN Packet Number
  • SecTAG Security Tag
  • IPsec Internet Protocol Security
  • the receiving side can receive sequentially, but in fact there is a network delay, and the path of each packet of data may be different, resulting in out-of-order data packets when they arrive at the receiving side. Therefore, the receiving side needs to provide a replay window, which can not only receive data packets within the out-of-order tolerance range, but also filter out delayed packets.
  • a third party intercepts the data packets on the sending side and repeatedly sends packets to the receiving side at shorter or longer intervals, thus causing network congestion on the receiving side .
  • IPsec IPsec
  • a Secure Channel (Secure Channel, SC) contains 4 SAs, and multiple SCs require Multiple 512Mbit RAMs are used to store flags; taking IPsec on the security gateway as an example, thousands of 128Mbit RAMs are required to store flag bits for thousands of connections, which is a huge overhead for chip area.
  • An embodiment of the present application provides a network anti-replay method, including: according to the current data packet number of the currently received data packet, determine the interval to which the current data packet number belongs in the replay window, wherein the replay window is divided into Multiple intervals, the interval is used to record the data packet numbers of the L received data packets belonging to the interval; L is less than T, and T is the total number of data packet numbers belonging to the interval; between the current data packet number and the determined interval In the case where the data packet number recorded in is not repeated, and the current data packet number is not the same as the data packet number of the last N data packets received in history, the integrity authentication of the currently received data packet is performed, and N is greater than 1 Natural number.
  • the embodiment of the present application also provides a network anti-replay device, including: an interval determination module, configured to determine the interval to which the current data packet number belongs within the replay window according to the current data packet number of the currently received data packet, wherein, The replay window is divided into a plurality of intervals, and the interval is used to record the data packet numbers of L received data packets belonging to the interval; L is less than T, and T is the total number of the data packet numbers belonging to the interval; the detection module uses In the case that the current data packet number and the data packet number recorded in the determined interval are not duplicated, and the current data packet number is not duplicated with the data packet numbers of the last N data packets received in the past, the currently received data Package integrity authentication, N is a natural number greater than 1.
  • the embodiment of the present application also provides an electronic device, including: at least one processor; and a memory connected in communication with the at least one processor; wherein, the memory stores information that can be executed by the at least one processor. Instructions, the instructions are executed by the at least one processor, so that the at least one processor can execute the above-mentioned network anti-replay method.
  • the embodiment of the present application also provides a computer-readable storage medium storing a computer program, and implementing the above-mentioned network anti-replay method when the computer program is executed by a processor.
  • Fig. 1 is the flowchart of the network anti-replay method provided in one embodiment of the present application
  • FIG. 2 is a schematic diagram 1 of a network anti-replay method provided in an embodiment of the present application
  • Fig. 3 is a schematic diagram 2 of a network anti-replay method provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram three of a network anti-replay method provided in an embodiment of the present application.
  • FIG. 5 is a schematic diagram 4 of a network anti-replay method provided in an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a network anti-replay device according to another embodiment of the present application.
  • Fig. 7 is a schematic structural diagram of an electronic device according to another embodiment of the present application.
  • An embodiment of the present application relates to a network anti-replay method.
  • the application scenarios of this embodiment may include but not limited to: Media Access Control Layer Security Protocol (Media Access Control Security, MACsec), Internet Security Protocol (Internet Protocol Security, IPsec) and other scenarios where anti-replay is required, the advantages are more significant under high-speed networks (100Gbps).
  • the network anti-replay process of this embodiment can be shown in Figure 1, including:
  • Step 101 according to the current data packet number of the currently received data packet, determine the interval to which the current data packet number belongs in the replay window, wherein the replay window is divided into a plurality of intervals, and the intervals are used to record the L within the interval.
  • the data packet number of the received data packet L is less than T, and T is the total number of data packet numbers belonging to the interval;
  • Step 102 when the current data packet number does not overlap with the data packet number recorded in the determined interval, and the current data packet number does not overlap with the data packet numbers of the most recently received historical N data packets, the currently received Integrity authentication of data packets, N is a natural number greater than 1.
  • step 101 according to the current data packet number of the currently received data packet, determine the interval to which the current data packet number belongs in the replay window, wherein the replay window is divided into a plurality of intervals, and the intervals are used to record the intervals belonging to the interval.
  • the data packet numbers of the L received data packets L is less than T, and T is the total number of data packet numbers belonging to the interval. That is, the playback window is divided into a plurality of intervals, and the data packet numbers of the partially received data packets are recorded in each interval. After the current data packet is divided into intervals, it can Packet number for preliminary detection.
  • the current data packet number before determining the interval to which the current data packet number belongs within the replay window according to the current data packet number of the currently received data packet, it further includes: determining that the current data packet number is smaller than the window lower limit of the replay window. That is, the current data packet number can be screened according to the replay window first; if the current data packet number is less than the window lower limit of the replay window, it means that the current data packet may be a third party intercepting the data packet on the sending side, and the interval is longer. The message is repeatedly sent to the receiving side at a certain period, so it is discarded without further analysis such as dividing intervals, which can greatly reduce the amount of data calculation.
  • this step may be referred to as a first-level anti-replay check.
  • the current data packet number after determining the interval to which the current data packet number belongs within the replay window according to the current data packet number of the currently received data packet, it further includes: the data recorded in the current data packet number and the determined interval If the packet number is repeated, or the current data packet number is the same as the data packet number of the last N data packets received recently, the currently received data packet is discarded. That is, after the interval of the current data packet number is determined, the data packet number is compared with the data packet number recorded in the interval. If they are the same, it means that the current data packet is replay data and needs to be discarded.
  • This process can be It is called the second-level anti-replay check; if the same situation does not exist, compare the current data packet number with the data packet number of the most recently received historical data packet, and the number of recently received data packets can be N. If the received data packet numbers are the same, it also indicates that the current data packet is replay data and needs to be discarded.
  • the comparison process with the recently received historical data packet can be called a three-level anti-replay detection. That is, after the first-level anti-replay detection is passed, the second-level anti-replay detection is performed, and if the same data packet number does not exist, then the third-level anti-replay detection is performed. The detection of the current data packet number is performed step by step, and all historical data packet numbers do not need to be stored.
  • the replay window is divided into 2M intervals; where, the values of M, L and N are determined according to the type of replay attack to be defended.
  • the types of replay attacks to be defended include long-period replay attacks and short-period replay attacks.
  • the number of data packets recorded in each interval in the second-level anti-replay detection is small, so the same part may not be detected, but further enter the third-level anti-replay detection process
  • the replay data may be included in the data packets received in the recent history, that is, it is very easy to compare the third-level anti-replay detection with the last N data packets received The same part is detected; that is, for short-period replay attacks, the effect of the third-level anti-replay detection process is better than that of the second-level anti-replay detection process. At this time, the larger the value of N, the better.
  • the third-level anti-replay detection is compared with the most recently received data packets, but the replayed data in long-period replay attacks is the data before a long period, that is, the data packets received recently It is not easy to detect the similarity when comparing the received data packets.
  • the second-level anti-replay detection the data packets in multiple replay windows are compared with the current data packet.
  • the data packets in the second-level anti-replay detection Including historical data received before a long period of time, so it is easy to detect replay data before a long period of time; that is, for long-period replay attacks, the second-level anti-replay detection is more effective, in order to further optimize the second-level anti-replay
  • a larger value can be selected for M and a larger value for L, that is, the more intervals are divided, the more detailed the interval division of the current data packet is.
  • the more the data packet number content of the easier it is to detect the repetition of the data packet number in the corresponding interval, that is, to detect the replay data.
  • the current data packet number includes: a data packet number on MACsec or a data packet number on IPsec.
  • MACsec refers to the functions of encapsulation, integrity protection and confidentiality protection for data frames transmitted between sites in the Connectivity Association (CA) on the MAC layer.
  • CA Connectivity Association
  • IPsec which encapsulates, encrypts, decrypts, and authenticates data packets at the IP layer.
  • the replay window will be divided into 2 M intervals, and L historical PN values will be recorded in each interval.
  • nextPN is the next data packet number.
  • step 102 when the current data packet number is not repeated with the data packet number recorded in the determined belonging interval, and the current data packet number is not repeated with the data packet numbers of the last received historical N data packets, the Integrity authentication is performed on currently received data packets, and N is a natural number greater than 1.
  • the currently received data packet is sent to the algorithm core, and the integrity of the data packet is authenticated. If the authentication passes, it will enter other steps, such as returning the authentication result, etc.
  • integrity authentication refers to verifying the data packet through the authentication algorithm, generating a message authentication code of a specific length, and comparing it with the message authentication code carried in the data packet. If the comparison is the same, it means that the data packet has not been tampered with or lost. Pass integrity certification.
  • after performing the integrity authentication on the currently received data packet it further includes: updating the current data packet number to the determined interval when the currently received data packet passes the integrity authentication, and/or , update the data packet numbers of the historical N data packets according to the current data packet number. That is, the relevant parameters of the secondary anti-replay detection and the tertiary anti-replay detection are updated.
  • the currently received data packet is sent to the algorithm core for integrity authentication.
  • the authentication is passed, store the PN value of the data packet into the history record, refresh the record table, and overwrite the earliest PN history value, that is, update the data packet number of N data packets in the history, that is, update the third-level anti-replay detection Parameters, as shown in Figure 4; when the attacker intercepts the message and conducts a replay attack at a short interval, then the local record can detect this type of replay, thereby resisting the replay attack.
  • the replay window is divided into 1024 intervals, and two historical PN values are recorded in each interval.
  • the PN value is stored in interval 3, covering the oldest of the two historical PNs. That is, the parameters selected in the secondary anti-replay detection process are updated.
  • the recent historical records cannot detect the replay attack, but the global PN record (that is, the interval data in the second-level anti-replay detection) will send each The historical PN value in the interval is recorded, and the long-period replay attack is resisted by comparing the global PN record value. If the attacker intercepts many packets and the PN values of the replayed packets are different, you can set a larger L to increase the amount of stored data in each interval to defend against it.
  • the integrity authentication after performing the integrity authentication on the currently received data packet, it further includes: when the currently received data packet passes the integrity authentication, and the current data packet number is greater than or equal to the window upper limit of the replay window, Refresh the replay window. That is, compared with the upper limit of the replay window, namely the next PN (NextPN), if it is less than NextPN, the window will not move; if it is not less than NextPN, the upper limit of the replay window will be refreshed to PN+1, and LowestPN will also be refreshed synchronously.
  • NextPN next PN
  • the replay window is divided into 1024 intervals, and the calculated interval value exceeds 1024, indicating that the PN falls on the right side of the replay window, that is, it does not belong to the current replay window, then it is directly passed to The next level is to refresh the record value in interval 1024 after the authentication is passed.
  • the execution process of the network anti-replay method is shown in Figure 5, wherein refreshing the global PN is to update the data packet number of the window in the second-level anti-replay detection process, and refreshing the local PN record table is to update the third-level anti-replay The data packet number of the historical N data packets during the detection process.
  • the required storage size is ( 2M *L+N)*32bit.
  • M is set to 10
  • L is set to 2
  • N is set to 2+ 17
  • the storage size consumed is 4Mbit, which is 30 times lower than that of the full record.
  • the replay window is divided, and the current data packet number of the currently received data packet is identified by the interval to which it belongs, and the repetition detection is performed in the interval to which it belongs, or further combined with the most recently received historical N data Packets are checked for repetition to determine whether the received data packets are replay data. Since there is no need to mark and store all the historical data packets received, the storage resources required for the replay window in the anti-replay process are greatly reduced, and it can also reduce the demand for RAM and reduce the cost of chip area .
  • An embodiment of the present application relates to a network anti-replay device, as shown in FIG. 6 , including:
  • the interval determination module 201 is configured to determine the interval to which the current data packet number belongs within the replay window according to the current data packet number of the currently received data packet, wherein the replay window is divided into a plurality of intervals, so The interval is used to record the data packet numbers belonging to the L received data packets in the interval; the L is less than T, and the T is the total number of the packet numbers belonging to the interval;
  • the detection module 202 is configured to not repeat the current data packet number and the data packet number recorded in the determined interval, and the current data packet number is the same as the data packet number of the most recently received historical N data packets In the case of no repetition, integrity authentication is performed on the currently received data packet, and the N is a natural number greater than 1.
  • the interval determination module 201 before determining the interval to which the current data packet number belongs in the playback window according to the current data packet number of the currently received data packet, it also includes: determining the current The data packet number is less than the window lower limit of the replay window.
  • the currently received data packet after determining the interval to which the current data packet number belongs in the replay window according to the current data packet number of the currently received data packet, it further includes: comparing the current data packet number with the determined If the data packet number recorded in the interval to which it belongs is duplicated, or the current data packet number is duplicated with the data packet numbers of the most recently received historical N data packets, the currently received data packet is discarded.
  • the replay window is divided into 2M intervals; wherein, the values of the M, the L and the N are determined according to the type of replay attack to be defended against.
  • the current data packet number includes: a MACsec data packet number or an IPsec data packet number.
  • the detection module 202 after performing the integrity authentication on the currently received data packet, it further includes: if the currently received data packet passes the integrity authentication, The current data packet number is updated to the determined interval, and/or, the data packet numbers of the historical N data packets are updated according to the current data packet number.
  • after performing the integrity authentication on the currently received data packet it further includes: after the currently received data packet passes the integrity authentication, and the current data packet number is greater than or equal to In the case of the window upper limit of the replay window, refresh the replay window.
  • the replay window is divided, and the current data packet number of the currently received data packet is identified by the interval to which it belongs, and the repetition detection is performed in the interval to which it belongs, or further combined with the most recently received historical N data Packets are checked for repetition to determine whether the received data packets are replay data. Since there is no need to mark and store all the historical data packets received, the storage resources required for the replay window in the anti-replay process are greatly reduced, and it can also reduce the demand for RAM and reduce the cost of chip area .
  • this embodiment is a system embodiment corresponding to the above embodiment, and this embodiment can be implemented in cooperation with the above embodiment.
  • the relevant technical details mentioned in the foregoing implementation manners are still valid in this implementation manner, and will not be repeated here in order to reduce repetition.
  • the relevant technical details mentioned in this implementation manner may also be applied in the foregoing implementation manners.
  • modules involved in this embodiment are logical modules.
  • a logical unit can be a physical unit, or a part of a physical unit, or multiple physical units. Combination of units.
  • units that are not closely related to solving the technical problems proposed in the present application are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.
  • FIG. 7 Another embodiment of the present application relates to an electronic device, as shown in FIG. 7 , including: at least one processor 301; and a memory 302 communicatively connected to the at least one processor 301; wherein, the memory 302 stores Instructions that can be executed by the at least one processor 301, the instructions are executed by the at least one processor 301, so that the at least one processor 301 can execute the network anti-replay method in the foregoing embodiments.
  • the memory and the processor are connected by a bus
  • the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors and various circuits of the memory together.
  • the bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein.
  • the bus interface provides an interface between the bus and the transceivers.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium.
  • the data processed by the processor is transmitted on the wireless medium through the antenna, further, the antenna also receives the data and transmits the data to the processor.
  • the processor is responsible for managing the bus and general processing, and can also provide a variety of functions, including timing, peripheral interfacing, voltage regulation, power management, and other control functions. Instead, memory can be used to store data that the processor uses when performing operations.
  • Another embodiment of the present application relates to a computer-readable storage medium storing a computer program.
  • the above method embodiments are implemented when the computer program is executed by the processor.
  • a storage medium includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例涉及通信传输领域，特别涉及一种网络抗重放方法、装置、电子设备及存储介质。其中，网络抗重放方法包括：根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间，其中，重放窗口被划分为多个区间，区间用于记录属于区间内的L个已接收的数据包的数据包号；L小于T，T为属于区间内的数据包号的总数；在当前数据包号与确定的所属区间内记录的数据包号不重复，且当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对当前接收的数据包进行完整性认证，N为大于1的自然数。

Description

网络抗重放方法、装置、电子设备及存储介质
交叉引用
本申请基于申请号为“202111370631.9”、申请日为2021年11月18日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请实施例涉及通信传输领域，特别涉及一种网络抗重放方法、装置、电子设备及存储介质。
背景技术
在介质访问控制层安全协议(Media Access Control Security,MACsec)中，报文封装、加解密和认证所需要的参数均从安全联盟(Secure Association,SA)中得到，包括密钥、识别号等参数。在发送侧，用户数据将32-bit的数据包号(Packet Number,PN)标记在安全标签(Security Tag,SecTAG)中，与用户数据一起做完整性或机密性保护后发出。每发送一帧数据PN自动加一，实现顺序、流水标记。在互联网安全协议(Internet Protocol Security,IPsec)中称为序列号(Sequence Number，SN)，与PN等价。理想状态下接收侧能够顺序接收，但实际上存在网络延迟，同时每包数据经过的路径可能不相同，导致到达接收侧时数据包会发生乱序。因此，接收侧需要提供一个重放窗口，既能接收乱序容忍范围内的数据包，又能过滤掉延迟包。除此之外，在发送到接收的过程中还会存在重播攻击，即第三方截获发送侧的数据包，隔较短或较长的周期向接收侧重复发送报文，从而造成接收侧网络拥塞。假如重播报文的PN落后于重放窗口则可以被过滤掉，但如果恰好落在重放窗口内，则需要识别并过滤重播报文。IPsec中的方法是对接收的SN进行标记，从而能够识别重播报文并丢弃 处理。
近些年来通信技术发展迅速，在高速网络下，乱序和延迟导致重放窗口所需占用的资源空间越来越大。例如，在100Gbps的流量下，对于256B的典型包长，假设允许2s的延迟，则最大可能有(100Gbps*2s)/(256*8bit)＝97M的数据包乱序，相当于需要设置2 27bit容量的重放窗口。如果全部标记，单个SA需要128Mbit的随机存取存储器(Random Access Memory，RAM)来存储标记位，以MACsec为例，一条安全通道(Secure Channel，SC)上包含4个SA，多条SC则需要多个512Mbit的RAM来存储标记；以安全网关上的IPsec为例，上千条连接数则需要上千个128Mbit的RAM来存储标记位，这对于芯片面积的开销是巨大的。
发明内容
本申请实施例提供了一种网络抗重放方法，包括：根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间，其中，重放窗口被划分为多个区间，区间用于记录属于区间内的L个已接收的数据包的数据包号；L小于T，T为属于区间内的数据包号的总数；在当前数据包号与确定的所属区间内记录的数据包号不重复，且当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对当前接收的数据包进行完整性认证，N为大于1的自然数。
本申请实施例还提供一种网络抗重放装置，包括：区间确定模块，用于根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间，其中，重放窗口被划分为多个区间，区间用于记录属于区间内的L个已接收的数据包的数据包号；L小于T，T为属于区间内的数据包号的总数；检测模块，用于在当前数据包号与确定的所属区间内记录的数据包号不重复，且当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对当前接收的数据包进行完整性认证，N为大于1的自然数。
本申请实施例还提供了一种电子设备，包括：至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至 少一个处理器能够执行上述的网络抗重放方法。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现上述的网络抗重放方法。
附图说明
图1是本申请一个实施例中所提供的网络抗重放方法的流程图；
图2是本申请一个实施例中所提供的网络抗重放方法的示意图一；
图3是本申请一个实施例中所提供的网络抗重放方法的示意图二；
图4是本申请一个实施例中所提供的网络抗重放方法的示意图三；
图5是本申请一个实施例中所提供的网络抗重放方法的示意图四；
图6是根据本申请另一个实施例中提供的一种网络抗重放装置的示意图；
图7是根据本申请另一个实施例的电子设备的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施例进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施例中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施例的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请的一个实施例涉及一种网络抗重放方法，本实施例的应用场景可以包括但不限于：介质访问控制层安全协议(Media Access Control Security,MACsec)、互联网安全协议(Internet Protocol Security,IPsec)等需要使用抗重放的场景中，在高速网络(100Gbps)下优势更加显著。本实施例的网络抗重放的流程可以如图1所示，包括：
步骤101，根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间，其中，重放窗口被划分为多个区间，区间用于记录属于区间内的L个已接收的数据包的数据包号；L小于T，T为属于区间内的数 据包号的总数；
步骤102，在当前数据包号与确定的所属区间内记录的数据包号不重复，且当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对当前接收的数据包进行完整性认证，N为大于1的自然数。
下面对本实施例的网络抗重放方法的实现细节进行具体的说明，以下内容仅为方便理解提供的实现细节，并非实施本方案的必须。
在步骤101中，根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间，其中，重放窗口被划分为多个区间，区间用于记录属于区间内的L个已接收的数据包的数据包号；L小于T，T为属于区间内的数据包号的总数。即，重放窗口被划分为多个区间，每个区间中记录部分已接收的数据包的数据包号，在对当前数据包进行区间划分后，能够根据所属区间中所记录的部分已接收的数据包号，进行初步检测。
在一个例子中，在根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间之前，还包括：确定当前数据包号小于重放窗口的窗口下限。即，可以先根据重放窗口对当前数据包号进行筛查；若当前数据包号小于重放窗口的窗口下限，则表示当前数据包可能是第三方截获发送侧的数据包，并且隔较长的周期向接收侧重复发送的报文，所以对其进行丢弃处理，不需要进行进一步划分区间等分析，很大程度上能够降低数据计算量。
例如，将当前数据包号与重放窗口的下限，即最低可接受PN(LowestPN)进行比较，若小于则丢弃执行处理，若不小于则根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间。其中，该步骤可以称之为一级抗重放检查。
在一个例子中，在根据当前接收的数据包的当前数据包号，确定当前数据包号在重放窗口内的所属区间之后，还包括：在当前数据包号与确定的所属区间内记录的数据包号重复，或当前数据包号与最近收到的历史N个数据包的数据包号重复的情况下，丢弃当前接收的数据包。即，在对当前数据包号的所述区间完成确定之后，将该数据包号与区间中记录的数据包号进行比较，相同则表示当前数据包为重放数据，需要进行丢弃，该过程可称为二级抗重放检查；如果不存在相同情况，则将当前数据包号与最近收到的历史数据包的数据包号 进行比较，最近收到数据包可以为N个，若与最近收到的数据包号相同，则也表示当前数据包为重放数据，需要进行丢弃操作，该与最近收到的历史数据包的比较过程可称为三级抗重放检测。也就是在一级抗重放检测通过后，进行二级抗重放检测，若不存在相同数据包号，则接着进行三级抗重放检测。分步执行对于当前数据包号的检测，不需要存储所有的历史数据包号。
在一个例子中，重放窗口被划分为2 M个区间；其中，M，L和N的取值根据待抵御的重放攻击的类型确定。其中，待抵御的重放攻击类型包括长周期的重放攻击和短周期的重放攻击。
例如，对于短周期重放攻击，二级抗重放检测中的每个区间中所记录的数据包号含量少，所以有可能会检测不到相同部分，但进一步进入三级抗重放检测过程后，由于是短周期重放攻击，所以重放数据可能包含在近期历史接收到的数据包中，也就是在三级抗重放检测与最近所收到的N个数据包进行比较时极易检测到相同部分；即，对于短周期重放攻击，三级抗重放检测过程的效果优于二级抗重放检测，此时，N的数值取越大越好。对于长周期重放攻击，三级抗重放检测中由于是与最近收到的数据包进行比较，但长周期重放攻击中的重放数据为较长周期之前的数据，也就是与最近收到的数据包进行比较时不容易检测到相似，然而对于二级抗重放检测，采用多个重放窗口中的数据包与当前数据包进行比较，在二级抗重放检测中的数据包包括较长时间周期之前收到的历史数据，所以对于较长周期之前的重放数据容易检测出来；即，对于长周期重放攻击，二级抗重放检测更有效，为了进一步优化二级抗重放检测对于长周期重放攻击的效果，可以对M取较大值，对L也取较大值，也就是使得划分的区间越多，则对当前数据包的区间划分更细致，区间中的数据包号含量越多，则能够更容易在所属区间中检测到数据包号重复，也就是检测出重放数据。
在一个例子中，当前数据包号包括：MACsec上的数据包号或IPsec上的数据包号。其中，MACsec指在MAC层上，为安全连接联盟(Connectivity Association,CA)内站点间传输的数据帧，提供封装、完整性保护和机密性保护的功能。具有相同能力的还有IPsec，在IP层上对数据报文进行封装、加解密和认证。
如图2所示，以MACsec为例，在二级抗重放检测中，会将重放窗口划分 为2 M个区间，每个区间内记录L个历史PN值。当收到数据包时首先根据PN值判断位于哪一个区间，然后与该区间内的L个历史PN值对比，如果相同则将所收到的数据包丢弃处理，如果不同则通过二级抗重放检查。举例如下，假如重放窗口数据量为2 27，取M＝10、L＝2，将重放窗口划分为1024个区间，每个区间内记录2个历史PN值。收到新数据包时，首先判断PN值位于哪一个区间，即1024*(PN-LowestPN)/(NextPN-LowestPN)后向上取整，比如结果为3，那么将PN值与区间3中的2个历史PN值进行比较，如果相同则表示数据包曾经接收过，为重放包并丢弃处理，如果不同则进行三级抗重放检测过程。在三级抗重放检测过程中，会记录历史N个PN值。当接收到PN后，会与历史的N个PN值进行对比，如果相同则丢弃处理，如果不同则通过三级抗重放检测。其中，NextPN为下一个数据包号。
另外，当重放窗口数据量为2 27，取M＝10，即将重放窗口划分为1024个区间时，T＝2 17。
在步骤102中，在当前数据包号与确定的所属区间内记录的数据包号不重复，且当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对当前接收的数据包进行完整性认证，N为大于1的自然数。在通过二级抗重放检测和三级抗重放检测后，将当前接收的数据包送入算法核，数据包进行完整性认证，如果认证通过则进入其他步骤，例如将认证结果返回等，如图3所示。其中，完整性认证是指通过认证算法对数据包进行校验，产生特定长度的消息认证码，与数据包携带的消息认证码进行比对，比对相同则表示数据包未被篡改或丢失，通过完整性认证。
在一个例子中，在对当前接收的数据包进行完整性认证之后，还包括：在当前接收的数据包通过完整性认证的情况下，将当前数据包号更新至确定的所属区间，和/或，根据当前数据包号更新历史N个数据包的数据包号。也就是更新二级抗重放检测和三级抗重放检测的相关参数。
例如，在通过二级抗重放检测和三级抗重放检测后，将当前接收的数据包发送给算法核进行完整性认证。当认证通过后，将数据包的PN值存储进历史记录中，刷新记录表，覆盖最早的PN历史值，也就是更新历史N个数据包的数据包号，即更新三级抗重放检测的参数，如图4所示；当攻击方截获报文后， 隔较短的周期进行重放攻击，那么局部记录可以检测出这种类型的重放，从而抵御重放攻击。
此外，当重放窗口数据量为2 27，取M＝10、L＝2，重放窗口划分为1024个区间，每个区间内记录2个历史PN值。收到新数据包判断PN值位于区间3的情况下；对当前接收的数据包进行检测并认证通过后，将PN值存储进所属区间3中，覆盖2个历史PN中最老的一个。也就是更新二级抗重放检测过程所选取的参数。当攻击方截获报文后，隔较长的周期重播发送，此时近期的历史记录无法检测出重放攻击，但全局PN记录(即二级抗重放检测中的区间数据)会将每个区间内的历史PN值记录下来，通过比较全局PN记录值来抵御较长周期的重放攻击。如果攻击方截获报文较多，重播报文的PN值不相同，可以通过设置更大的L，提高每个区间内的存储数据量来抵御。
在一个例子中，在对当前接收的数据包进行完整性认证之后，还包括：在当前接收的数据包通过完整性认证，且当前数据包号大于或等于重放窗口的窗口上限的情况下，刷新重放窗口。即，与重放窗口的上限，即下一个PN(NextPN)进行比较，如果小于NextPN则窗口不动，如果不小于NextPN，则将重放窗口上限刷新为PN+1，LowestPN也同步刷新。
在一个具体实现中，如果重放窗口划分为1024个区间，所计算出的区间值超过1024，表明PN落在重放窗口的右侧，也就是不属于当前重放窗口内，那么直接传给下一级，认证通过后刷新区间1024的记录值。此外，该网络抗重放方法的执行过程如图5所示，其中刷新全局PN即更新二级抗重放检测过程中所属窗口的数据包号，刷新局部PN记录表即更新三级抗重放检测过程中历史N个数据包的数据包号。
另外，使用本实施方式所提供的方法，需要占用的存储大小为(2 M*L+N)*32bit。比如，当M取10，L取2，N取2 17时，可以抵御截获2包以内的重播数据包，花费的存储大小为4Mbit，相比全纪录降低了30倍。
在本实施方式中，对重放窗口进行划分，通过对当前接收的数据包的当前数据包号进行所属区间识别，在所属区间中进行重复性检测，或者进一步与最近收到的历史N个数据包进行重复性检测，以判断所接收到的数据包是否为重放数据。由于不需要对于收到的所有历史数据包进行标记存储，极大程度上减 少了抗重放过程中重放窗口所需要占用的存储资源，同时也能降低对于RAM的需求，减少芯片面积的开销。
本申请一个实施方式涉及一种网络抗重放装置，如图6所示，包括：
区间确定模块201，用于根据当前接收的数据包的当前数据包号，确定所述当前数据包号在重放窗口内的所属区间，其中，所述重放窗口被划分为多个区间，所述区间用于记录属于所述区间内的L个已接收的数据包的数据包号；所述L小于T，所述T为属于所述区间内的数据包号的总数；
检测模块202，用于在所述当前数据包号与确定的所述所属区间内记录的数据包号不重复，且所述当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对所述当前接收的数据包进行完整性认证，所述N为大于1的自然数。
对于区间确定模块201，在一个例子中，在所述根据当前接收的数据包的当前数据包号，确定所述当前数据包号在重放窗口内的所属区间之前，还包括：确定所述当前数据包号小于所述重放窗口的窗口下限。
在一个例子中，在所述根据当前接收的数据包的当前数据包号，确定所述当前数据包号在重放窗口内的所属区间之后，还包括：在所述当前数据包号与确定的所述所属区间内记录的数据包号重复，或所述当前数据包号与最近收到的历史N个数据包的数据包号重复的情况下，丢弃所述当前接收的数据包。
在一份例子中，所述重放窗口被划分为2 M个区间；其中，所述M，所述L和所述N的取值根据待抵御的重放攻击的类型确定。
在一个例子中，所述当前数据包号包括：MACsec的数据包号或IPsec的数据包号。
对于检测模块202，在一个例子中，在所述对所述当前接收的数据包进行完整性认证之后，还包括：在所述当前接收的数据包通过所述完整性认证的情况下，将所述当前数据包号更新至确定的所述所属区间，和/或，根据所述当前数据包号更新所述历史N个数据包的数据包号。
在一个例子中，在所述对所述当前接收的数据包进行完整性认证之后，还包括：在所述当前接收的数据包通过所述完整性认证，且所述当前数据包号大于或等于所述重放窗口的窗口上限的情况下，刷新所述重放窗口。
在本实施方式中，对重放窗口进行划分，通过对当前接收的数据包的当前数据包号进行所属区间识别，在所属区间中进行重复性检测，或者进一步与最近收到的历史N个数据包进行重复性检测，以判断所接收到的数据包是否为重放数据。由于不需要对于收到的所有历史数据包进行标记存储，极大程度上减少了抗重放过程中重放窗口所需要占用的存储资源，同时也能降低对于RAM的需求，减少芯片面积的开销。
不难发现，本实施方式为与上述实施方式相对应的系统实施例，本实施方式可与上述实施方式互相配合实施。上述实施方式中提到的相关技术细节在本实施方式中依然有效，为了减少重复，这里不再赘述。相应地，本实施方式中提到的相关技术细节也可应用在上述实施方式中。
值得一提的是，本实施方式中所涉及到的各模块均为逻辑模块，在实际应用中，一个逻辑单元可以是一个物理单元，也可以是一个物理单元的一部分，还可以以多个物理单元的组合实现。此外，为了突出本申请的创新部分，本实施方式中并没有将与解决本申请所提出的技术问题关系不太密切的单元引入，但这并不表明本实施方式中不存在其它的单元。
本申请另一个实施例涉及一种电子设备，如图7所示，包括：至少一个处理器301；以及，与所述至少一个处理器301通信连接的存储器302；其中，所述存储器302存储有可被所述至少一个处理器301执行的指令，所述指令被所述至少一个处理器301执行，以使所述至少一个处理器301能够执行上述各实施例中的网络抗重放方法。
其中，存储器和处理器采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器和存储器的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器。
处理器负责管理总线和通常的处理，还可以提供各种功能，包括定时，外 围接口，电压调节、电源管理以及其他控制功能。而存储器可以被用于存储处理器在执行操作时所使用的数据。
本申请另一个实施例涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域的普通技术人员可以理解，上述各实施方式是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (10)

  1. 一种网络抗重放方法，包括：
    根据当前接收的数据包的当前数据包号，确定所述当前数据包号在重放窗口内的所属区间，其中，所述重放窗口被划分为多个区间，所述区间用于记录属于所述区间内的L个已接收的数据包的数据包号；所述L小于T，所述T为属于所述区间内的数据包号的总数；
    在所述当前数据包号与确定的所述所属区间内记录的数据包号不重复，且所述当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对所述当前接收的数据包进行完整性认证，所述N为大于1的自然数。
  2. 根据权利要求1所述的网络抗重放方法，其中，在所述根据当前接收的数据包的当前数据包号，确定所述当前数据包号在重放窗口内的所属区间之前，还包括：
    确定所述当前数据包号小于所述重放窗口的窗口下限。
  3. 根据权利要求1或2所述的网络抗重放方法，其中，在所述根据当前接收的数据包的当前数据包号，确定所述当前数据包号在重放窗口内的所属区间之后，还包括：
    在所述当前数据包号与确定的所述所属区间内记录的数据包号重复，或所述当前数据包号与最近收到的历史N个数据包的数据包号重复的情况下，丢弃所述当前接收的数据包。
  4. 根据权利要求1至3中任一项所述的网络抗重放方法，其中，在所述对所述当前接收的数据包进行完整性认证之后，还包括：
    在所述当前接收的数据包通过所述完整性认证的情况下，将所述当前数据包号更新至确定的所述所属区间，和/或，根据所述当前数据包号更新所述历史N个数据包的数据包号。
  5. 根据权利要求1至4中任一项所述的网络抗重放方法，其中，在所述对所述当前接收的数据包进行完整性认证之后，还包括：
    在所述当前接收的数据包通过所述完整性认证，且所述当前数据包号大于或等于所述重放窗口的窗口上限的情况下，刷新所述重放窗口。
  6. 根据权利要求1至5中任一项所述的网络抗重放方法，其中，所述重放窗口被划分为2 M个区间；
    其中，所述M，所述L和所述N的取值根据待抵御的重放攻击的类型确定。
  7. 根据权利要求1至6中任一项所述的网络抗重放方法，其中，所述当前数据包号包括：介质访问控制层安全协议MACsec上的数据包号或互联网安全协议IPsec上的数据包号。
  8. 一种网络抗重放装置，包括：
    区间确定模块，用于根据当前接收的数据包的当前数据包号，确定所述当前数据包号在重放窗口内的所属区间，其中，所述重放窗口被划分为多个区间，所述区间用于记录属于所述区间内的L个已接收的数据包的数据包号；所述L小于T，所述T为属于所述区间内的数据包号的总数；
    检测模块，用于在所述当前数据包号与确定的所述所属区间内记录的数据包号不重复，且所述当前数据包号与最近收到的历史N个数据包的数据包号不重复的情况下，对所述当前接收的数据包进行完整性认证，所述N为大于1的自然数。
  9. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至7中任一项所述的网络抗重放方法。
  10. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至7中任一项所述的网络抗重放方法。
PCT/CN2022/082122 2021-11-18 2022-03-21 网络抗重放方法、装置、电子设备及存储介质 WO2023087590A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111370631.9 2021-11-18
CN202111370631.9A CN116137573A (zh) 2021-11-18 2021-11-18 网络抗重放方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2023087590A1 true WO2023087590A1 (zh) 2023-05-25

Family

ID=86333161

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/082122 WO2023087590A1 (zh) 2021-11-18 2022-03-21 网络抗重放方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN116137573A (zh)
WO (1) WO2023087590A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104038505A (zh) * 2014-06-24 2014-09-10 杭州华三通信技术有限公司 一种IPSec防重放的方法和装置
CN105791219A (zh) * 2014-12-22 2016-07-20 华为技术有限公司 抗重放方法和装置
CN105791218A (zh) * 2014-12-22 2016-07-20 华为数字技术（苏州）有限公司 抗重放方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104038505A (zh) * 2014-06-24 2014-09-10 杭州华三通信技术有限公司 一种IPSec防重放的方法和装置
CN105791219A (zh) * 2014-12-22 2016-07-20 华为技术有限公司 抗重放方法和装置
CN105791218A (zh) * 2014-12-22 2016-07-20 华为数字技术（苏州）有限公司 抗重放方法和装置

Also Published As

Publication number Publication date
CN116137573A (zh) 2023-05-19

Similar Documents

Publication Publication Date Title
US8813189B2 (en) System and method for capturing network traffic
CN100583737C (zh) 一种基于用户的安全访问控制的方法及装置
US7386725B2 (en) Node device and communication control method for improving security of packet communications
US20160191568A1 (en) System and related method for network monitoring and control based on applications
KR101256284B1 (ko) 전자 라벨 인증 방법 및 시스템
US20060098649A1 (en) System, apparatuses, methods, and computer-readable media for determining security realm identity before permitting network connection
US10805187B2 (en) Logging of traffic in a computer network
US20230216867A1 (en) Information security protection method and apparatus
CN104796261A (zh) 一种网络终端节点的安全接入管控系统及方法
US20120066764A1 (en) Method and apparatus for enhancing security in a zigbee wireless communication protocol
CN103647772A (zh) 一种对网络数据包进行可信访问控制的方法
CN106992984A (zh) 一种基于电力采集网的移动终端安全接入信息内网的方法
WO2016202007A1 (zh) 一种设备运维方法及系统
CN104837150B (zh) IPv6无线传感网安全测试系统
US20180013646A1 (en) Attributing network address translation device processed traffic to individual hosts
CN111314381A (zh) 安全隔离网关
CN103051616A (zh) 一种基于rssp--ii协议的数据报传输方法
WO2023087590A1 (zh) 网络抗重放方法、装置、电子设备及存储介质
CN104660584A (zh) 基于网络会话的木马病毒分析技术
CN108881447A (zh) 违规外联数据上报方法和装置
Wang A collaborative detection method of wireless mobile network intrusion based on cloud computing
CN112640392A (zh) 一种木马检测方法、装置和设备
Bianchi et al. Towards privacy-preserving network monitoring: Issues and challenges
CN114401112B (zh) 旁路部署针对tls加密的恶意流量实时深度包检测方法
Li Computer network security system construction based on QoS analysis and intelligent total identification

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22894136

Country of ref document: EP

Kind code of ref document: A1