Method for implementing IPSEC resistance of replay aggression

Abstract

The invention provides a method for realizing IPSec anti-replay attack, wherein, a plurality of sliding-windows are utilized to distinguish whether a received message is new in a system providing the IPSec service. For a multi-core architecture, the IPSec anti-replay attack function is perfected by utilizing the multi-sliding window technique, thereby avoiding the technical problem that system performance decreases badly caused by single sliding windows and lock mechanism. In the method, the message with specific type is dispatched to an appointed IPSec processing unit through a pretreatment module according to a plaintext serial-number on an IPSec message header, thereby leading the anti-replay attack detection to be more accurate.

Description

technical field [0001] The invention relates to network communication technology, in particular to a method for realizing IPSEC anti-replay attack under a multi-core framework. Background technique [0002] IPSec (IP Security) protocol is an industry standard network security protocol, which provides transparent security services for IP network communication, protects Transmission Control Protocol (Transmission Control Protocol, TCP) / IP communication from eavesdropping and tampering, and can effectively resist network attacks , while maintaining ease of use. IPSec plays a role at the network layer, protecting and authenticating IP packets, and an open framework independent of standard algorithms, providing data confidentiality, data integrity, and source authentication functions. As a security protocol implemented at the network layer, IPSec has many advantages such as ensuring the reliability of data sources, protecting data integrity, ensuring data confidentiality, preven...

AI Technical Summary

Problems solved by technology

Because according to the "misplaced" bitmap to "identify" whether the packet is a replay attack, normal packets may be discarded

[0015] Although the use of synchronization primitives can ensure the consistency of the serial number and make the window "slide" correctly, so as to achieve the purpose of "identifying" the replay attack packet, a processing unit is setting the corresponding bitmap of the "sliding" window, When updating the serial number, the stored serial number is guaranteed to be the largest, which is convenient for outbound (OUTBOUNT) use. The other processing unit can only wait for the completion of the previous processing unit operation before continuing to operate. This kind of waiting, this is a high-performance multi-core platform. will cause severe performance degradation

Images