System for efficiently handling cryptographic messages containing nonce values in a wireless connectionless environment without comprising security
View Patent ↗A secure communication module that accepts a cryptographic message if a nonce value for the received message is greater than the largest nonce value yet seen. If the received nonce value is not the largest nonce value yet seen, the secure communication module compares the received nonce value with a nonce acceptance window. If the nonce value falls outside the nonce acceptance window, the secure communication module rejects the received message and assumes a replay attack. Alternatively, if the nonce value falls within the nonce acceptance window, the secure communication module compares the received nonce value with a replay window mask. If comparison with the replay window mask indicates that the received nonce value has been seen before, the secure communication module rejects the received message and assumes a replay attack. Otherwise, the secure communication module accepts the message and adds the received nonce value to the replay window mask.
1. A method of processing out-of-order message packets, comprising:
obtaining a maximum largest nonce value;
comparing, at a receiving client device, a nonce value of a received out-of-order message packet with a largest nonce value yet received by said receiving device;
adjusting, at said receiving client device, a size of a range of acceptable nonce values within a single replay attack acceptance window based on said largest nonce value yet received;
comparing, at said receiving client device, said largest nonce value yet received with said maximum largest nonce value; and
in response to a determination that said largest nonce value yet received exceeds said maximum largest nonce value, resetting said largest nonce value yet received.
2. The method of processing out-of-order message packets according to claim 1 , wherein:
said maximum largest nonce value is associated with a first session.
3. The method of processing out-of-order message packets according to claim 2 , wherein:
said largest nonce value yet received is associate with a second session.
4. The method of processing out-of-order message packets according to claim 1 , further comprising:
in response to said determination that said largest nonce value yet received exceeds said maximum largest nonce value, generating a new cryptographic key.
5. The method of processing out-of-order message packets according to claim 1 , further comprising:
in response to a determination that said nonce value exceeds said largest nonce value yet received, designating said nonce value as said largest nonce value yet received.
6. The method of processing out-of-order message packets according to claim 1 , further comprising:
in response to a determination that said nonce value exceeds said largest nonce value yet received, replacing said largest nonce value yet received with said nonce value.
7. The method of processing out-of-order message packets according to claim 1 , further comprising:
in response to a determination that said nonce value exceeds said largest nonce value yet received, adjusting said single replay attack acceptance window.
8. The method of processing out-of-order message packets according to claim 1 , further comprising:
designating, at said receiving client device, said received out-of-order message packet as a replay attack.
9. The method of processing out-of-order message packets according to claim 1 , further comprising:
comparing, at said receiving client device, said nonce value to a window mask value if said nonce value falls within said single replay attack acceptance window; and
rejecting, at said receiving client device, said received out-of-order message packet if said nonce value is within said window mask value.
10. The method of processing out-of-order message packets according to claim 1 , further comprising:
designating, at said receiving client device, said received out-of-order message packet as part of a replay attack.
11. The method of processing out-of-order message packets according to claim 1 , further comprising:
comparing, at said receiving client device, said nonce value to a window mask value if said nonce value falls within said single replay attack acceptance window; and
accepting, at said receiving client device, said received out-of-order message packet if said nonce value is outside said single replay attach acceptance window.
12. The method of processing out-of-order message packets according to claim 1 , further comprising:
designating, with said secure communication module of said receiving client device, said nonce value as a largest nonce value yet received.
13. An apparatus for processing out-of-order message packets, said apparatus comprising:
a receiving communication physical device configured to receive a plurality of packets; and
a receiving physical hardware controller configured to:
obtain a maximum largest nonce value;
compare a nonce value of a received out-of-order message packet with a largest nonce value yet received by said receiving device;
adjust a size of a range of acceptable nonce values within a single replay attack acceptance window based on said largest nonce value yet received;
compare, at said receiving device, said largest nonce value yet received with said maximum largest nonce value; and
in response to a determination that said largest nonce value yet received exceeds said maximum largest nonce value, resetting said largest nonce value yet received.
14. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said maximum largest nonce value is associated with a first session.
15. The apparatus for processing out-of-order message packets according to claim 14 , wherein:
said largest nonce value yet received is associate with a second session.
16. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said receiving physical hardware controller is further configured, in response to said determination that said largest nonce value yet received exceeds said maximum largest nonce value, to generate a new cryptographic key.
17. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said receiving physical hardware controller is further configured, in response to said determination that said largest nonce value yet received exceeds said maximum largest nonce value, to designate said nonce value as said largest nonce value yet received.
18. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said receiving physical hardware controller is further configured, in response to a determination that said nonce value exceeds said largest nonce value yet received, to replace said largest nonce value yet received with said nonce value.
19. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said receiving physical hardware controller is further configured, in response to a determination that said nonce value exceeds said largest nonce value yet received, to adjust said single replay attack acceptance window.
20. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said receiving physical hardware controller is further configured to designate said received out-of-order message packet as part of a replay attack.
21. The apparatus for processing out-of-order message packets according to claim 13 , wherein said receiving physical hardware controller is further configured to:
compare said nonce value to a window mask value if said nonce value falls within a single replay attack acceptance window; and
reject said received out-of-order message packet if said nonce value falls outside said single replay attack acceptance window.
22. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said receiving physical hardware controller is further configured to designate said received out-of-order message packet as part of a replay attack.
23. The apparatus for processing out-of-order message packets according to claim 13 , wherein said receiving physical hardware controller is configured to:
compare said nonce value to a replay attack acceptance window value if said nonce value falls within said single replay attack acceptance window; and
accept said received out-of-order message packet if said nonce value falls within said single replay attack acceptance window.
24. The apparatus for processing out-of-order message packets according to claim 13 , wherein:
said receiving physical hardware controller is further configured to mark said nonce value as said largest nonce value yet received.