Information processing apparatus and method for authenticating message
View Patent ↗An information processing apparatus includes a shared information generation unit for generating shared information via a network, a communication unit configured to receive a message, a shared information verification unit configured to compare shared information in the message with the information generated by the shared information generation unit, and verify validity of the shared information in the message based on the comparison, a security code generation unit for generating a security code based on the shared information, a security code verification unit configured to compare a security code in the message with the security code generated by the security code generation unit, and verify correctness of the shared information in the message based on the comparison, and a processing determination control unit configured to determine normality of the message on the based on the verification by the shared information verification unit and the verification by the security code verification unit.
1. An information processing apparatus that protects a computer network against replay attacks, the information processing apparatus comprising:
a communication interface that is communicatively coupled to other information processing apparatus via a network;
a memory; and
a processor that is communicatively coupled to the communication interface and the memory; wherein the processor:
receives, using the communication interface, a message transmitted from the other information processing apparatus, wherein the message includes shared information and a security code;
verifies validity of the shared information by comparing the shared information with generated shared information stored in the memory;
generates a generated security code based on the shared information, wherein the generated security code is an error detecting code for detecting an error in the shared information and a correction range of the error correcting code is set according to a communication quality of the network;
verifies correctness of the shared information by comparing the security code with the generated security code; on a condition that the validity of the message is verified, identifies the message as a normal message;
on a condition that the validity and the correctness of the message are not verified, identifies the message as an error message; and
on a condition that the validity of the message is not verified and the correctness of the message is verified, identifies the message as a replay attack message and causes the information processing apparatus to enter a countermeasure mode.
2. The information processing apparatus according to claim 1 , wherein when the message is identified as the error message, the processor:
corrects the shared information to formed corrected shared information based on the error correcting code, and
re-verifies the validity of the shared information by comparing the corrected shared information with the generated shared information generated.
3. The information processing apparatus according to claim 1 , wherein when the message is identified as the normal message the processor:
generates a generated tampering detection code for detecting tampering with data; and
identifies the message as a tampered message by comparing a tampering detection code included in the message with the generated tampering detection code.
4. The information processing apparatus according to claim 1 , wherein the memory further stores:
a counter value to be used to determine the normality of the message,
wherein when the message is identified as the normal message, the processor further:
updates the counter value, and
determines whether the message is due to an illegal attack by comparing the counter value with a predetermined threshold value to.
5. The information processing apparatus according to claim 1 , wherein the processor further:
reproduces, when the message is divided into a plurality of divided messages and transmitted by the other information processing apparatus, the message before division by accumulating the plurality of divided messages received up to an original message length.
6. An information processing system that protects a computer network against replay attacks, the information processing system comprising:
a plurality of information processing apparatus that are communicatively coupled via a network, wherein each of the plurality of information processing apparatus include:
a communication interface that is communicatively coupled to the network;
a memory; and
a processor that is communicatively coupled to the communication interface and the memory;
wherein the processor of each respective information processing apparatus from the plurality of information processing apparatus:
generates shared information;
generates a security code based on the shared information, wherein the generated security code is an error detecting code for detecting an error in the shared information and a correction range of the error correcting code is set according to a communication quality of the network;
generates an outgoing message including the shared information and the security code;
transmits, using the communication interface, the outgoing message to the plurality of information processing apparatus;
receives, using the communication interface, an incoming message that includes incoming shared information and an incoming security code;
verifies validity of the incoming shared information by comparing the incoming shared information with the shared information
verifies correctness of the incoming shared information by comparing the incoming security with the security code;
on a condition that the validity of the incoming message is verified, identifies the incoming message as a normal message;
on a condition that the validity and the correctness of the incoming message are not verified, identifies the incoming message as an error message; and
on a condition that the validity of the incoming message is not verified and the correctness of the incoming message is verified, identifies the incoming message as a replay attack message and causes the respective information processing apparatus to enter a countermeasure mode.
7. The information processing apparatus according to claim 6 , wherein the processor further:
divides and transmits the outgoing message, and
at least either one of information amounts obtained by individually adding up the shared information and the security code included in each divided outgoing message when the outgoing message is divided and transmitted is less than an information amount of the shared information or an information amount of the security code included in the outgoing message when the outgoing message is transmitted without being divided.
8. A method for authenticating a message to protect a computer network against replay attacks the method comprising:
receiving a message transmitted from an other information processing apparatus, wherein the message includes shared information and a security code;
verifying validity of the shared information by comparing the shared information with generated shared information stored in a memory;
generating a generated security code based on the shared information, wherein the generated security code is an error detecting code for detecting an error in the shared information and a correction range of the error correcting code is set according to a communication quality of the network;
verifying correctness of the shared information by comparing the security code with the generated security code; on a condition that the validity of the message is verified, identifies the message as a normal message;
on a condition that the validity and the correctness of the message are not verified, identifying the message as an error message; and
on a condition that the validity of the message is not verified and the correctness of the message is verified, identifying the message as a replay attack message and causing an information processing apparatus to enter a countermeasure mode.