Granted Patent B2

US 8,631,491 · App. 13/429,021 · Granted Jan 14, 2014

Abstract

Claims (50)

1. In a communication network including a sending node operably linked to a receiving node, the sending node operable to send data packets to the receiving node, a method comprising the sending node, in association with a packet index i:

generating a random number r i ;

retrieving a code sequence (h* i−1 );

generating a hash value h i based on the random number r i and the code sequence (h* i−1 );

formulating a packet with index i including h i , r i and data i ; and

sending the packet i to the receiving node; wherein h i and r i are retrievable by the receiving node for use in detecting replay attacks, the receiving node maintaining a code sequence (h* j ), generating a hash value (h j+1 ) based on the random number r i and the code sequence (h* j ), and declaring a replay attack if h i does not equal h j+1 .

2. The method of claim 1 , wherein the step of formulating a packet with index i comprises including h i and r i in a packet header of the packet i.

3. The method of claim 2 , further comprising the sending node encrypting the packet i, yielding an encrypted packet i, wherein the receiving node decrypts the encrypted packet i to retrieve h i and r i .

4. The method of claim 1 , wherein the code sequence (h* i−1 ) comprises the last s bits of a hash value (h i−1 ) of a previous packet index i−1.

5. The method of claim 4 , wherein s≦10.

6. The method of claim 4 , wherein s=5.

7. Apparatus for facilitating the detection of replay attacks, in accordance with a communication network including a sending node operably linked to a receiving node, the sending node operable to send data packets to the receiving node, the apparatus at the sending node comprising:

an input interface;

an output interface;

a memory; and

at least one processor operably coupled to the input interface, output interface and memory and configured, in association with a packet index i, to:

(a) generate a random number r i ;

(b) retrieve a code sequence (h* i−1 );

(c) generate a hash value h i based on the random number r i and the code sequence (h* i−1 );

(d) formulate a packet with index i including h i , r i and data i ;

(e) encrypt the packet i, yielding an encrypted packet i, and

(f) send the encrypted packet i to the receiving node; wherein the receiving node decrypts the encrypted packet i to retrieve h i and r i the receiving node maintaining a code sequence (h* j ), generating a hash value (h j+1 ) based on the random number r i and the code sequence (h* j ), and declaring a replay attack if h i does not equal h j+1 .

8. The apparatus of claim 7 , wherein step (d) comprises including h i and r i in a packet header of the packet i.

9. The apparatus of claim 8 , wherein the code sequence (h* i−1 ) comprises the last s bits of a hash value (h i−1 ) of a previous packet index i−1.

10. The apparatus of claim 9 , wherein s≦10.

11. The apparatus of claim 9 , wherein s=5.

12. In a communication network including a plurality of sending nodes operably linked to a receiving node, a method comprising the receiving node:

receiving a packet index i from a sending node, the packet i including a random number r i , a hash value h i and a data string (data i ), wherein the hash value h i is nominally based on a code sequence (h* i−1 ) associated with a previous packet index i−1;

retrieving the random number r i and hash value h i from packet i;

retrieving a code sequence (h* j ) associated with a previous packet index j;

generating a hash value (h j+1 ) based on the random number r, and the code sequence (h* j ); and

declaring a replay attack if h i does not equal h j+1 ; otherwise

accepting packet i if h i equals h j+1 .

13. The method of claim 12 , wherein the step of receiving a packet comprises receiving an encrypted packet i from the sending node, the receiving node decrypting the encrypted packet to retrieve h i and r i .

14. The method of claim 12 , wherein the code sequence (h* j ) comprises the last s bits of a hash value (h j ) of a previous packet index j.

15. The method of claim 14 , wherein s≦10.

16. The method of claim 14 , wherein s=5.

17. Apparatus for detecting replay attacks, in accordance with a communication network including a sending node operably linked to a receiving node, the apparatus at the receiving node comprising:

an input/output interface;

a memory; and

at least one processor operably coupled to the input/output interface and memory and configured to:

(a) receive a packet index i from a sending node, the packet i including a random number r i , a hash value h i and a data string (data i ), wherein the hash value h i is nominally based on a code sequence (h* i−1 ) associated with a previous packet index i−1;

(b) retrieve the random number r i and hash value h i from packet i;

(c) retrieve a code sequence (h* j ) associated with a previous packet index j;

(d) generate a hash value (h j+1 ) based on the random number r, and the code sequence (h* j ); and

(e1) declare a replay attack if h i does not equal h j+1 ; otherwise

(e2) accept packet i if h i equals h j+1 .

18. The apparatus of claim 17 , wherein the code sequence (h* j ) comprises the last s bits of a hash value (h j ) of a previous packet index j.

19. The apparatus of claim 18 , wherein s≦10.

20. The apparatus of claim 18 , wherein s=5.

Assignments (7)