System for efficiently handling cryptographic messages containing nonce values in a wireless connectionless environment
A secure communication module that accepts a cryptographic message if a nonce value for the received message is greater than the largest nonce value yet seen. If the received nonce value is not the largest nonce value yet seen, the secure communication module compares the received nonce value with a nonce acceptance window. If the nonce value falls outside the nonce acceptance window, the secure communication module rejects the received message and assumes a replay attack. Alternatively, if the nonce value falls within the nonce acceptance window, the secure communication module compares the received nonce value with a replay window mask. If comparison with the replay window mask indicates that the received nonce value has been seen before, the secure communication module rejects the received message and assumes a replay attack. Otherwise, the secure communication module accepts the message and adds the received nonce value to the replay window mask.
1. A method of processing out-of-order data packets, comprising:
obtaining a largest nonce value from among a plurality of nonce values of previous data packets;
adjusting, at a receiving device, a size of a range of acceptable nonce values within an acceptance window based around said largest nonce value;
accepting, at said receiving device, a newly received out-of-order data packet including a newly received nonce value when said newly received nonce value is within said acceptance window; and
resetting said largest nonce value to said newly received nonce value when said accepted, newly received nonce value exceeds said largest nonce value.
2. The method of processing out-of-order data packets according to claim 1 , further comprising:
adjusting said size of said range of acceptable nonce values within said acceptance window based on said reset largest nonce value.
3. The method of processing out-of-order message packets according to claim 1 , wherein:
said largest nonce value is associated with a first session.
4. The method of processing out-of-order message packets according to claim 1 , wherein:
said largest nonce value is associated with a second session.
5. The method of processing out-of-order message packets according to claim 1 , further comprising:
generating a new cryptographic key.
6. A method of processing out-of-order data packets, comprising:
obtaining a largest nonce value from among a plurality of nonce values of previous data packets;
adjusting, at a receiving device, a size of a range of acceptable nonce values within an acceptance window based around said largest nonce value;
accepting, at said receiving device, a newly received out-of-order data packet including a newly received nonce value when said newly received nonce value is within said acceptance window; and
adjusting said size of said range of acceptable nonce values within said acceptance window when said accepted, newly received nonce value exceeds said largest nonce value.
7. The method of processing out-of-order data packets according to claim 6 , further comprising:
resetting said largest nonce value to said newly received nonce value when said accepted, newly received nonce value exceeds said largest nonce value.
8. The method of processing out-of-order message packets according to claim 6 , wherein:
said largest nonce value is associated with a first session.
9. The method of processing out-of-order message packets according to claim 6 , wherein:
said largest nonce value is associated with a second session.
10. The method of processing out-of-order message packets according to claim 6 , further comprising:
generating a new cryptographic key.
11. A method of rejecting a replay attack in out-of-order data packets, comprising:
obtaining a largest nonce value from among a plurality of nonce values of previous data packets;
adjusting, at a receiving device, a size of a range of acceptable nonce values within an acceptance window based around said largest nonce value; and
rejecting, at said receiving device, a newly received out-of-order data packet including a newly received nonce value when said newly received nonce value is outside of said acceptance window.
12. The method of rejecting a replay attack in out-of-order data packets according to claim 11 , further comprising:
designating said newly received out-of-order data packet as a replay attack.