Communication out-of-sync state protection method, device, medium and program product

Abstract

The application discloses a communication out-of-sync state protection method and device, a medium and a program product, and relates to the technical field of communication. The method comprises the following steps: after a transmission layer security protocol handshake is completed between a client and a server, receiving data packets transmitted by both parties; the sequence numbers in the data packets are generated according to a client initial sequence number and a server initial sequence number according to a set rule; the client initial sequence number and the server initial sequence number are both generated by a hash algorithm in combination with timestamp based on encryption negotiation information; the data packets are analyzed, the client sequence number and the server sequence number are extracted, and the absolute difference between the two is calculated; the absolute difference is compared with a preset threshold value, and the degree of the communication out-of-sync state of the client and the server is determined according to the comparison result, and a corresponding hierarchical compensation strategy is triggered. In this way, the communication out-of-sync risk can be quickly identified, the attack threat caused by the out-of-sync can be blocked in advance, and real-time detection and effective protection of the communication out-of-sync state can be realized.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, device, medium, and program product for protecting against communication out-of-synchronization. Background Technology

[0002] As network security demands increase, encryption protocols that ensure communication security are constantly evolving and upgrading. However, the fragmentation problem during the protocol upgrade process has led to the coexistence of two encryption implementation methods for a long time: one is to encrypt communication directly when the connection is established, and the other is to initiate encryption through a negotiation mechanism.

[0003] Most network protocols initially used plaintext transmission before introducing encryption mechanisms. This coexistence of two encryption methods creates security vulnerabilities. Attackers can exploit these vulnerabilities to launch attacks, creating discrepancies in understanding between the communicating parties, tricking the target into receiving malicious data, causing communication breakdowns, and ultimately compromising the integrity of the encrypted connection. Furthermore, there are attacks that exploit weaknesses in the encryption protocol's authentication mechanisms. By forwarding communication messages, the client and the actual communicating server may be running different protocols, leading to communication breakdowns and information leaks. Summary of the Invention

[0004] This invention provides a method, device, medium, and program product for protecting against communication out-of-sync states, which can realize real-time detection and effective protection against communication out-of-sync states.

[0005] This invention provides a method for protecting against communication out-of-sync states, comprising:

[0006] After the client and server complete the transport layer security protocol handshake, the system receives data packets transmitted by the client and server respectively. The sequence number in the data packet is generated according to a set rule based on the client's initial sequence number and the server's initial sequence number. Both the client's initial sequence number and the server's initial sequence number are generated by combining encrypted negotiation information with a timestamp using a hash algorithm.

[0007] The data packet is parsed to extract the client sequence number and the server sequence number, and the absolute difference between the client sequence number and the server sequence number is calculated.

[0008] The absolute difference is compared with a preset threshold, and the degree of communication breakdown between the client and the server is determined based on the comparison result, triggering the corresponding graded compensation strategy.

[0009] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described communication out-of-sync protection methods when executing the computer program.

[0010] The present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described communication out-of-sync state protection methods.

[0011] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any of the above-described communication out-of-sync state protection methods.

[0012] This invention, by receiving data packets transmitted by both parties in real time after the client and server complete the transport layer security protocol handshake, accurately extracts the client and server sequence numbers based on the encrypted negotiation information, the initial sequence number generated by the hash algorithm using the timestamp, and the data packet sequence number generated by the corresponding rules. This allows for rapid identification of potential communication out-of-sync risks, proactively blocking potential attack threats caused by out-of-sync issues, and achieving real-time detection of communication out-of-sync states that may trigger attacks. Furthermore, by comparing the absolute difference with a preset threshold, this method determines different degrees of communication out-of-sync states and triggers corresponding graded compensation strategies. This avoids excessive interference to network communication caused by using a single processing method. While accurately addressing out-of-sync problems, it minimizes the impact on normal network communication, ensuring the stability and security of the communication process and achieving effective protection against communication out-of-sync states.

[0013] In addition, the present invention also provides corresponding electronic devices, computer-readable storage media and program products for the communication out-of-synchronization protection method, which have the same or corresponding technical features as the aforementioned communication out-of-synchronization protection method and have the same effect. Attached Figure Description

[0014] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 A flowchart of a communication out-of-sync protection method provided in an embodiment of the present invention;

[0016] Figure 2 This is one of the specific flowcharts of the communication out-of-sync state protection method provided in the embodiments of the present invention;

[0017] Figure 3 This is the second detailed flowchart of the communication out-of-sync protection method provided in the embodiments of the present invention;

[0018] Figure 4This is a schematic diagram of the communication out-of-synchronization protection device provided in an embodiment of the present invention. Detailed Implementation

[0019] The Opossum Attack is a type of security attack targeting application layer protocols such as Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP) where implicit TLS (Transport Layer Security) and opportunistic TLS coexist. Its core attack exploits a vulnerability in the protocol interaction when these two TLS encryption methods coexist. The Opossum Attack can compromise the integrity of an encrypted connection without relying on program errors in the specific implementation of the TLS protocol. Specifically, when there is a cognitive mismatch between the client and server regarding the encryption method used in communication—especially when one party expects to use opportunistic TLS (upgrading to a TLS connection midway through a plaintext session) while the other party actually uses implicit TLS (completing TLS negotiation before data exchange)—an attacker can create a state of communication synchronization failure between the two ends, inducing the target party to mistake its forged malicious response data for legitimate encrypted transmission content, ultimately achieving the attack objective of compromising data integrity or stealing sensitive information. To avoid the above situation, this invention provides a method for protecting against communication synchronization failures.

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0021] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0022] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] The specific application environment architecture or specific hardware architecture on which the communication out-of-sync state protection method depends is described here.

[0024] The embodiments of the present invention provide a method for protecting against communication out-of-sync states. The method is described in detail below in conjunction with the execution flow of the method for protecting against communication out-of-sync states. Figure 1 The flowchart of the communication out-of-sync state protection method provided in the embodiments of the present invention is as follows: Figure 1 As shown, the method includes:

[0025] S101. After the client and server complete the transport layer security protocol handshake, receive the data packets transmitted by the client and server respectively; wherein, the sequence number in the data packet is generated according to the client's initial sequence number and the server's initial sequence number according to the set rules; both the client's initial sequence number and the server's initial sequence number are generated by combining the encrypted negotiation information with the timestamp through a hash algorithm.

[0026] It's important to note that the sequence number in the data packets is dynamically generated according to predefined rules, based on the initial sequence number negotiated cryptographically between the client and server. For example, the sequence number of a data packet sent by the client starts with the client's initial sequence number and increments by a predefined value for each packet; the sequence number of a data packet sent by the server starts with the server's initial sequence number and increments by a predefined value for each packet. Both originate from the initial sequence number negotiated cryptographically during the TLS handshake phase. The sequence numbers of all subsequent data packets are generated incrementally based on the initial sequence number according to the predefined rules. The client's initial sequence number and the server's initial sequence number are the first sequence number (starting value) when each party sends a data packet: the first data packet sent by the client has the client's initial sequence number; the first data packet sent by the server has the server's initial sequence number. Each subsequent data packet sent by both parties can have its sequence number incremented based on the previous data packet's sequence number according to predefined rules (e.g., incrementing according to transmission order), forming a complete sequence number sequence.

[0027] Step S101 requires that the client and server complete a TLS handshake (data reception only begins after a secure connection is established). The mechanism for generating data packet sequence numbers is as follows: first, the encrypted negotiation information from the handshake phase is combined with a timestamp to generate initial sequence numbers for the client and server using a hash algorithm; then, the actual sequence number for each data packet is derived according to set rules. This ensures both the security and uniqueness of the initial sequence number and the orderly transmission of subsequent data packets, laying the foundation for communication synchronization verification.

[0028] It should be noted that the implementation entity of the above-mentioned communication out-of-synchronization protection method can be an application layer device. The application layer device receives the data packets transmitted by the client and the server respectively.

[0029] S102. Parse the data packet, extract the client sequence number and server sequence number, and calculate the absolute difference between the client sequence number and server sequence number.

[0030] It should be noted that both the client serial number and the server serial number are essentially values ​​based on their respective initial serial numbers incremented. In step S102, the application layer device ultimately calculates the absolute difference between these two, transforming the transmission progress difference between the two communicating parties into a quantifiable numerical indicator. This provides direct data for subsequent assessments of whether communication synchronization failures occur and the extent of such failures.

[0031] S103. Compare the absolute difference with a preset threshold, determine the degree of communication breakdown between the client and the server based on the comparison result, and trigger the corresponding graded compensation strategy.

[0032] In implementation, this invention first compares the calculated absolute difference of the sequence number with a pre-set out-of-synchronization judgment threshold. By comparing the difference with the threshold, the specific degree of out-of-synchronization between the client and the server (e.g., slight, moderate, severe) can be determined. Then, based on different degrees of out-of-synchronization, corresponding graded compensation strategies are automatically triggered (e.g., inserting and filling acknowledgment packets with no data, reassembling and retransmitting data packets, terminating the connection and rebuilding the session). This achieves a precise match between the degree of out-of-synchronization and the countermeasures, which not only efficiently solves the out-of-synchronization problem but also avoids excessive interference with normal communication.

[0033] In the communication out-of-sync protection method provided in this embodiment of the invention, after the client and server complete the TLS handshake, the data packets transmitted by both parties are received in real time. Based on the encrypted negotiation information combined with the initial sequence number generated by the timestamp and the data packet sequence number generated by the corresponding rule, the client and server sequence numbers are accurately parsed and extracted, and the absolute difference is calculated. This allows for rapid identification of potential communication out-of-sync risks, early blocking of potential attack threats caused by out-of-sync, and real-time detection of communication out-of-sync states that may trigger attacks. Furthermore, by comparing the absolute difference with a preset threshold, this method determines different degrees of communication out-of-sync and triggers corresponding graded compensation strategies. This avoids excessive interference to network communication caused by using a single processing method. While accurately addressing the out-of-sync problem, it minimizes the impact on normal network communication, ensuring the stability and security of the communication process and achieving effective protection against communication out-of-sync states.

[0034] Furthermore, in specific implementation, in the communication out-of-sync state protection method provided in the above embodiments of the present invention, the process of generating the client initial sequence number and the server initial sequence number in step S101 may include: during the TLS handshake phase, obtaining the client random number and the server random number as encryption negotiation information, and concatenating the client random number and the server random number into a string; appending the current timestamp to the concatenated string to form the data to be hashed; using the master key negotiated in the TLS handshake as the encryption key, performing a hash operation on the data to be hashed to obtain a hash value; extracting bytes of a first predetermined length from the hash value at a preset position; using the extracted bytes as the base seed of the initial sequence number; performing a bitwise XOR operation on the base seed of the initial sequence number and a second predetermined length of bytes at the end of the client Internet Protocol (IP) address to generate the client initial sequence number; performing a bitwise XOR operation on the base seed of the initial sequence number and a third predetermined length of bytes of the server port number to generate the server initial sequence number.

[0035] In implementation, the initial sequence number can be generated during the TLS handshake phase by concatenating a client-side random number and a server-side random number, appending a microsecond-level timestamp, using the master key obtained through cryptographic negotiation as the key, and a hash value generated through hashing as the seed. This seed is then XORed bitwise with the client's IP address and bitwise with the server's port number. Specifically, the generation process can include: first, during the TLS handshake phase, generating client-side and server-side random numbers as cryptographic negotiation information, and concatenating them into a binary string. These two random numbers form the basis of the handshake negotiation, possessing high randomness and preventing seed duplication. Then, a current timestamp, accurate to the microsecond level, is appended to the concatenated random number string. The introduction of the timestamp further enhances the seed's timeliness; even with an extreme risk of random number duplication, the microsecond-level time difference ensures that the base string generated each time is different. Next, using the master key negotiated during the TLS handshake as the encryption key, a hash operation is performed on the concatenated string. This hash operation can use HMAC-SHA256 (Hash-Based Message Authentication Code - Secure Hash Algorithm 256-bit). The HMAC algorithm combines a hash function and a key, ensuring both the irreversibility of the operation result and, through the master key, ensuring that only the communicating parties can generate the same hash value, preventing third-party forgery. Finally, the leftmost three bytes (24 bits) of the hash value generated by the hash operation can be extracted as the base seed for the initial sequence number. This step simplifies subsequent processing by using a fixed-length truncation while preserving the high randomness of the hash value.

[0036] Based on the same fundamental seed, initial sequence numbers are generated by combining the unique information of both communicating parties, achieving bidirectional unique identification: a bitwise XOR operation is performed between the truncated 3-byte seed and the last 3 bytes of the client's IP address. The IP address is the client's network identifier; the XOR operation binds the seed to the client's identity, ensuring the uniqueness of the client's initial sequence number. Similarly, using the 3-byte fundamental seed, a bitwise XOR operation is performed with the 2 bytes of the server's port number (padding to 3 bytes if the port number is less than 3 bytes). The port number is the server's service identifier; the XOR operation binds the seed to the server's identity, ensuring the uniqueness of the server's initial sequence number. This design ensures that both parties' sequence numbers are based on the same negotiated seed while incorporating their respective unique information, maintaining both relevance and individual differences.

[0037] Furthermore, in a specific implementation, in the communication out-of-sync state protection method provided in the above embodiments of the present invention, before executing step S102 to parse the data packet, it may also include: adding extended fields to both the client handshake request message and the server handshake response message, and using the extended fields to exchange the client initial sequence number and the server initial sequence number.

[0038] In implementation, the client's initial sequence number can be carried in the extended fields of the client handshake request message (ClientHello), and the server's initial sequence number can be carried in the server handshake response message (ServerHello). In the final stage of the TLS handshake between the client and server, the client's initial sequence number and the server's initial sequence number are exchanged through the extended fields. At this point, the handshake is nearly complete, core parameters such as the master key have been determined, and the sequence numbers, after being exchanged, can be directly used in subsequent data transmission phases.

[0039] This invention utilizes the extended mechanism of the TLS 1.3 protocol to complete sequence number exchange, ensuring synchronized recognition between both parties: a custom extended field is added to the client handshake request message and server handshake response message of the TLS 1.3 protocol. This extended field is a flexible design feature of the TLS protocol, allowing the addition of custom functionality without compromising the core protocol.

[0040] It should be noted that the initial sequence number is dynamically generated with each connection and bound to time, IP address, and port. This indirectly links the sequence number to the network identities of both communicating parties, enhancing the protocol's anti-forgery capabilities and making it difficult for attackers to reuse historical data packets for replay attacks. The sequence number is a crucial parameter for the TLS record layer to verify data integrity. This invention ensures that both parties agree on the order and legitimacy of data packets after exchanging sequence numbers. This is achieved through binding IP address and port to the seed.

[0041] Furthermore, in a specific implementation, in the communication out-of-sync state protection method provided in the embodiments of the present invention, step S102 parses the data packet, extracts the client sequence number and server sequence number, and calculates the absolute difference between the client sequence number and the server sequence number. Specifically, this may include: according to the record format defined by TLS, performing structured decomposition of the data packet, and sequentially parsing out the record header and record payload; after the record header is successfully verified, extracting the client sequence number and server sequence number encapsulated in the record payload; calculating the difference between the client sequence number and the server sequence number and taking the absolute value to obtain the absolute difference between the client sequence number and the server sequence number.

[0042] In implementation, this invention performs structured decomposition of data packets by adhering to the TLS standard record format. This allows for precise separation of the record header and record payload. First, the record header is verified to ensure the legitimacy of the basic data packet structure. Then, the client and server sequence number fields are reliably extracted. Finally, the absolute difference between the two is calculated to transform the transmission progress difference between the communicating parties into a quantifiable indicator. This ensures the accuracy of sequence number extraction and provides objective and accurate data for subsequent judgments on whether communication has lost synchronization and the degree of synchronization loss. It avoids misjudgments of synchronization loss due to format parsing deviations or field extraction errors, laying a reliable foundation for the effective triggering of subsequent hierarchical compensation strategies.

[0043] Furthermore, in a specific implementation, in the communication out-of-sync protection method provided in the embodiments of the present invention, step S103 compares the absolute difference with a preset threshold, determines the degree of communication out-of-sync between the client and the server based on the comparison result, and triggers a corresponding graded compensation strategy. Specifically, it may include: when the absolute difference is greater than a first preset threshold and less than or equal to a second preset threshold, determining that the communication out-of-sync between the client and the server is in a first state (such as a slight out-of-sync state), and triggering a first-level compensation strategy; the first-level compensation strategy includes generating an acknowledgment packet without data and inserting the acknowledgment packet into the communication stream; the acknowledgment packet occupies a Transmission Control Protocol (TCP) window position; when the absolute difference is greater than a second preset threshold and less than or equal to a third preset threshold, determining that the communication out-of-sync between the client and the server is in a second state (such as a moderate out-of-sync state), and triggering a second-level compensation strategy; the second-level compensation strategy includes reading valid messages within a set time period from the cache and reorganizing the data packets according to the valid information; the degree of communication out-of-sync in the second state is greater than the degree of communication out-of-sync in the first state.

[0044] In the above steps, the data packet is restructured based on the valid information. Specifically, this may include: retaining the headers of the Internet Protocol layer and Transmission Control Protocol layer in the data packet; removing some application layer data from the data packet; and filling the original positions of the application layer data with valid messages so that the valid messages replace some application layer data, thereby generating a restructured data packet.

[0045] Furthermore, in a specific implementation, in the communication out-of-sync protection method provided in the embodiments of the present invention, step S103 compares the absolute difference with a preset threshold, determines the degree of communication out-of-sync between the client and the server based on the comparison result, and triggers a corresponding graded compensation strategy. Specifically, it may also include: when the absolute difference is greater than a third preset threshold, determining that the communication out-of-sync between the client and the server is in the third state (such as a severe out-of-sync state), and triggering a three-level compensation strategy; the three-level compensation strategy includes terminating the current TLS connection and sending an alarm message to the client and the server to enable the client and the server to re-establish the session; the degree of communication out-of-sync in the third state is greater than the degree of communication out-of-sync in the second state. When the absolute difference is less than a first preset threshold, determining that there is no communication out-of-sync between the client and the server.

[0046] In implementation, when the application layer device detects a loss of synchronization between the client and the server, it triggers a corresponding tiered compensation strategy based on different ranges of the absolute difference in sequence numbers. The tiered compensation strategy is based on a comparison between the absolute difference in sequence numbers and a preset threshold. Figure 2 This is one of the specific flowcharts of the communication out-of-sync state protection method provided in an embodiment of the present invention. For example... Figure 2 As shown, the application layer device continuously parses data packets, tracks the change in the absolute difference between the client's sequence number and the server's sequence number, and combines this with the correlation pattern between the number of out-of-synchronization steps and the difference summarized in actual tests. For example, by setting the first preset threshold to 1, the second preset threshold to 2, and the third preset threshold to 3, the severity of the current communication out-of-synchronization is determined, and corresponding compensation measures are triggered. Based on different ranges of the absolute difference, the compensation mechanism is divided into three levels, with the intervention intensity increasing progressively at each level.

[0047] When the absolute difference exceeds 1 but does not exceed 2, it indicates a slight misalignment in communication, such as the server's processing progress lagging slightly behind the client's sending pace. The compensation measure triggered in this case is as follows: the application layer device proactively generates an acknowledgment (ACK) packet without actual data and inserts it into the communication stream. This ACK packet occupies a TCP window position, making the client believe that the current window is partially occupied, thereby slowing down the sending pace of subsequent data packets. This gives the server time to catch up and gradually eliminate the misalignment. This measure naturally corrects the misalignment by adjusting the sending pace, minimizing the impact on normal communication.

[0048] When the difference exceeds 2 but does not exceed 3, it indicates that the loss of synchronization has deepened, such as the server losing some data or the client sending data too quickly, causing a sequence break. The compensation measure triggered at this time is as follows: the application layer device reads the most recent valid message (such as historical data without anomalies) from the cache, restructures the data packets, retains the original IP / TCP header, ensures consistency between network layer and transport layer information, replaces the application data portion with the valid content in the cache, overwrites any potentially abnormal data, and then retransmits. This measure directly repairs the data transmission break by replacing abnormal data and supplementing valid content, avoiding error accumulation.

[0049] When the difference exceeds 3, it indicates a severe loss of synchronization in communication, such as a complete disconnect between the server and client states, or numerous gaps or anomalies in the data sequence. The compensation measure triggered at this point is as follows: the application layer device actively terminates the current TLS connection and simultaneously sends a TLS alarm message to both communicating parties, informing them that the connection was abnormally terminated due to loss of synchronization, and requesting the client and server to re-establish the session. This measure eliminates all abnormal states by rebuilding the connection when the loss of synchronization cannot be recovered through adjustment or repair, thus preventing more serious data leaks or errors.

[0050] The above-described tiered strategy, employing mild adjustment, moderate repair, and severe reset, prioritizes measures with minimal impact on communication, terminating connections only when necessary to maximize business continuity. Precise intervention is provided for different degrees of desynchronization (from slight lag to severe disconnection) to avoid resource waste. By adjusting the ACK timing through ACK padding, retransmitting valid data to cover anomalies, and terminating connections to mitigate risks, the strategy aims to reduce data tampering, loss, or corruption caused by desynchronization at its source, ensuring the security of TLS communication.

[0051] Furthermore, in specific implementation, the communication out-of-sync state protection method provided in the embodiments of the present invention may further include: constructing a logistic regression model using key indicators in network communication; the key indicators include handshake efficiency, transmission rhythm, data randomness, window stability, and timing regularity; using the trained logistic regression model to determine the degree of communication out-of-sync state between the client and the server, and triggering the corresponding graded compensation strategy.

[0052] In implementation, this invention can construct a logistic regression model by selecting key network communication indicators such as handshake efficiency, transmission rhythm, data randomness, window stability, and timing regularity. This model can comprehensively cover the core dimensions related to out-of-sync during communication, avoiding the one-sidedness of judging by a single indicator. Then, the trained model is used to accurately determine the specific degree of out-of-sync communication between the client and the server, thereby triggering a corresponding hierarchical compensation strategy. This not only achieves scientific quantification and accurate identification of out-of-sync status, but also allows compensation measures to be efficiently matched with the degree of out-of-sync. While effectively solving the out-of-sync problem, it minimizes interference with normal network communication and ensures the stability and security of communication.

[0053] Furthermore, in specific implementation, in the communication out-of-sync state protection method provided in the embodiments of the present invention, before determining the degree of communication out-of-sync state between the client and the server using the trained logistic regression model, it may specifically include: calculating target data including handshake time, data packet interval time, entropy value of consecutive data packets, sliding window analysis of consecutive data packets and unexpected time sequence under different degrees of communication out-of-sync, and organizing the target data into feature values; inputting the feature values ​​into the logistic regression model for training, so as to output the corresponding communication out-of-sync state probability value.

[0054] In practice, handshake time is the total time consumed by the client and server to execute the handshake protocol to establish a connection, and it is a key indicator for measuring the efficiency and stability of network connection establishment. Packet interval reflects the rhythmic stability of data transmission; when synchronization is lost, the packet transmission interval may fluctuate irregularly. The entropy value of consecutive packets measures the randomness of data content; in a state of synchronization loss, the packet content may exhibit abnormal entropy values ​​due to abnormal transmission. Continuous packet sliding window analysis captures the stability of the transmission sequence by calculating the variance of the data within the sliding window; synchronization loss will cause an abnormal increase in the window variance. Unexpected timing (i.e., abnormal timing) directly characterizes the degree of disorder in the packet transmission / reception order, such as sequence number jumps, duplications, or loss—explicit timing problems. These characteristics quantify the communication state from different perspectives and together constitute the feature matrix for judging synchronization loss. This invention calculates target data such as handshake time, data packet interval time, continuous data packet entropy, sliding window analysis results, and unexpected timing under different degrees of communication out-of-sync, and transforms them into feature values. Then, it outputs the probability value of the out-of-sync state through logistic regression model training. This can quantify the characteristic performance of communication out-of-sync from multiple dimensions. The machine learning model realizes accurate probability assessment of the out-of-sync state, which not only overcomes the limitations of single indicator judgment, but also provides data support for subsequent formulation of differentiated protection strategies based on probability values, thus improving the scientificity and accuracy of communication out-of-sync detection.

[0055] Furthermore, in a specific implementation, in the above-mentioned communication out-of-sync state protection method provided in the embodiments of the present invention, the feature values ​​are input into the logistic regression model for training, which may specifically include: using the logistic regression model to combine the feature values ​​into a linear function according to the weights; introducing an activation function into the logistic regression model, and using the activation function to map the value of the linear function into a communication out-of-sync state probability value.

[0056] In implementation, the training process for the logistic regression model in this invention can include two steps: linear combination and probability transformation. First, the extracted feature values ​​are combined into a linear function according to their weights:

[0057] z = β0 + β1 * TLS handshake time + β2 * packet interval time + β3 * entropy value + β4 * sliding window variance + β5 * timing anomaly;

[0058] Where z is the linear prediction value, β0 is the bias term, and β1 to β5 are the weight coefficients of each feature (obtained by fitting the training data, reflecting the degree of influence of different features on the step loss judgment). The larger the z value, the higher the probability of step loss.

[0059] Secondly, to convert linear results into probability values, the logistic regression model can introduce the Sigmoid function: P(x) = 1 / (1+ez). This function maps the z value to the probability output of the out-of-step state; the closer the value is to 1, the higher the probability of the out-of-step state.

[0060] In the training of the logistic regression model, multi-dimensional feature values ​​are first combined into a linear prediction value z by weights using a linear function. Then, the sigmoid function is used to map z into a probability value P(x) in the 0-1 interval. This approach integrates the impact of various features on communication out-of-step through linear combination, forming a unified quantitative benchmark for features with different dimensions. Furthermore, the non-linear transformation of the sigmoid function converts the abstract linear result into an intuitive and interpretable probability of out-of-step. This satisfies the logistic regression model's requirement for probability output and provides an easy-to-understand and reliable quantitative basis for accurately judging the risk of out-of-step and triggering tiered compensation strategies based on probability. It avoids the problem that simple linear results are difficult to directly correlate with the actual risk level.

[0061] Furthermore, in specific implementation, in the communication out-of-sync state protection method provided in the embodiments of the present invention, the degree of communication out-of-sync state between the client and the server is determined by a trained logistic regression model, and a corresponding hierarchical compensation strategy is triggered. Specifically, it may include: when the probability value of the communication out-of-sync state is greater than a first preset probability value and less than or equal to a second preset probability value, the communication out-of-sync state between the client and the server is determined to be a first state, and a first-level compensation strategy is triggered; the first-level compensation strategy includes generating an acknowledgment packet without data and inserting the acknowledgment packet into the communication stream; the acknowledgment packet occupies a transmission control protocol window position; when the absolute difference is greater than a second preset probability value and less than or equal to a third preset probability value, the compensation strategy is triggered. When the value is greater than the first state, the communication out-of-sync state between the client and server is determined to be the second state, triggering the second-level compensation strategy. The second-level compensation strategy includes reading valid messages within a set time period from the cache and reconstructing the data packets according to the valid information. The degree of communication out-of-sync in the second state is greater than that in the first state. When the absolute difference is greater than the third set probability value, the communication out-of-sync state between the client and server is determined to be the third state, triggering the third-level compensation strategy. The third-level compensation strategy includes terminating the current TLS connection and sending alarm messages to the client and server to enable them to re-establish the session. The degree of communication out-of-sync in the third state is greater than that in the second state.

[0062] It should be noted that this invention can analyze data packets based on different network conditions and, combined with different network loads, adaptively adjust the set probability values, including a first set probability value, a second set probability value, and a third set probability value. The set probability values ​​are the critical values ​​for the model to determine whether it has entered a state of communication out of sync. When the set probability values ​​are properly adjusted, if the communication out-of-sync probability value output by the model is less than or equal to the first set probability value, it is determined that there is no communication out-of-sync state between the client and the server; if the communication out-of-sync probability value output by the model exceeds the first set probability value, then the compensation phase begins.

[0063] The appropriate tiered compensation measures (such as inserting ACK packets, retransmitting data, or terminating the connection) are invoked. Conversely, if the threshold is not reached, monitoring continues without intervention.

[0064] Figure 3 This is the second detailed flowchart of the communication out-of-sync protection method provided in this embodiment of the invention. Figure 3 As shown, the first set probability value can be set to 30%, the second set probability value can be set to 60%, and the third set probability value can be set to 90%. The application layer device obtains the probability value of communication out-of-sync state through the trained logistic regression model.

[0065] When the probability of communication synchronization failure exceeds 30% but does not exceed 60%, it indicates a slight synchronization failure. The compensation measure triggered in this case is as follows: the application layer device actively generates an ACK packet without actual data and inserts it into the communication stream. This ACK packet occupies a TCP window position, making the client believe that the current window is partially occupied, thus delaying the sending pace of subsequent data packets. This measure naturally corrects the synchronization failure by adjusting the sending pace, minimizing the impact on normal communication.

[0066] When the probability of communication synchronization failure exceeds 60% but does not exceed 90%, it indicates a deepening of the synchronization failure, such as the server losing some data or the client sending data too quickly, causing a sequence break. The compensation measure triggered at this time is as follows: the application layer device reads the most recent valid message from the cache, restructures the data packets, retains the original IP / TCP header, ensures consistency between the network layer and transport layer information, partially replaces the application data with the cached valid content, overwrites any potentially abnormal data, and then retransmits. This measure directly repairs the data transmission break by replacing abnormal data and supplementing valid content, preventing error accumulation.

[0067] When the probability of communication loss of synchronization exceeds 90%, it indicates a severe loss of synchronization. The compensation measure triggered at this point is as follows: the application layer device actively terminates the current TLS connection and simultaneously sends a TLS alarm message to both communicating parties, informing them that the connection was abnormally terminated due to loss of synchronization and requesting the client and server to re-establish the session. This measure eliminates all abnormal states by rebuilding the connection when synchronization loss cannot be recovered through adjustment or repair, thus preventing more serious data leaks or errors.

[0068] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0069] Embodiments of the present invention also provide a communication out-of-synchronization protection device. Figure 4 This is a schematic diagram of the communication out-of-synchronization protection device provided in an embodiment of the present invention. This embodiment is based on the perspective of functional modules, such as… Figure 4 As shown, the device includes:

[0070] The data receiving module 10 is used to receive data packets transmitted by the client and the server respectively after the client and the server complete the TLS handshake; wherein, the sequence number in the data packet is generated according to the client's initial sequence number and the server's initial sequence number according to a set rule; both the client's initial sequence number and the server's initial sequence number are generated by combining the encrypted negotiation information with the timestamp through a hash algorithm;

[0071] The parsing and calculation module 11 is used to parse the data packet, extract the client sequence number and the server sequence number, and calculate the absolute difference between the client sequence number and the server sequence number.

[0072] The graded compensation module 12 is used to compare the absolute difference with a preset threshold, determine the degree of communication synchronization failure between the client and the server based on the comparison result, and trigger the corresponding graded compensation strategy.

[0073] In the communication out-of-sync protection device provided in this embodiment of the invention, through the interaction of the four modules, after the client and server complete the TLS handshake, the data packets transmitted by both parties are received in real time. Based on the encrypted negotiation information combined with the initial sequence number generated by the hash algorithm using the timestamp and the data packet sequence number generated by the corresponding rules, the client and server sequence numbers are accurately parsed and extracted, and the absolute difference is calculated. This allows for the rapid identification of potential communication out-of-sync risks, and the early blocking of potential attack threats caused by out-of-sync issues, achieving real-time detection of communication out-of-sync states that may trigger attacks. Furthermore, by comparing the absolute difference with a preset threshold, different degrees of communication out-of-sync states are determined, and corresponding graded compensation strategies are triggered. This avoids excessive interference to network communication caused by using a single processing method. While accurately addressing the out-of-sync problem, it minimizes the impact on normal network communication, ensuring the stability and security of the communication process, and achieving effective protection against communication out-of-sync states.

[0074] Since the embodiments of the communication out-of-synchronization protection device and the communication out-of-synchronization protection method correspond to each other, the descriptions of the features in the embodiments corresponding to the communication out-of-synchronization protection device can be found in the relevant descriptions of the embodiments corresponding to the communication out-of-synchronization protection method, and will not be repeated here. Furthermore, it has the same beneficial effects as the communication out-of-synchronization protection method mentioned above.

[0075] Furthermore, in a specific implementation, in the communication out-of-sync state protection device provided in the embodiments of the present invention, the parsing and calculation module 11 can be specifically used to perform structured decomposition of data packets according to the record format defined by TLS, and sequentially parse out the record header and record payload; after the record header is successfully verified, the client sequence number and server sequence number encapsulated in the record payload are extracted; the difference between the client sequence number and the server sequence number is calculated and the absolute value is taken to obtain the absolute difference between the client sequence number and the server sequence number.

[0076] Furthermore, in a specific implementation, in the communication out-of-sync state protection device provided in the embodiments of the present invention, the graded compensation module 12 can be specifically used to determine the communication out-of-sync state between the client and the server as the first state when the absolute difference is greater than the first preset threshold and less than or equal to the second preset threshold, and trigger a first-level compensation strategy; the first-level compensation strategy includes generating an acknowledgment packet without data and inserting the acknowledgment packet into the communication stream; the acknowledgment packet occupies the Transmission Control Protocol window position; when the absolute difference is greater than the second preset threshold and less than or equal to the third preset threshold, determine the communication out-of-sync state between the client and the server as the second state, and trigger a second-level compensation strategy; the second-level compensation strategy includes reading valid messages within a set time period from the cache and reorganizing the data packets according to the valid information; the degree of communication out-of-sync in the second state is greater than the degree of communication out-of-sync in the first state; when the absolute difference is greater than the third preset threshold, determine the communication out-of-sync state between the client and the server as the third state, and trigger a third-level compensation strategy; the third-level compensation strategy includes terminating the current TLS connection and sending an alarm message to the client and the server so that the client and the server can re-establish the session; the degree of communication out-of-sync in the third state is greater than the degree of communication out-of-sync in the second state.

[0077] Furthermore, in specific implementation, the communication out-of-sync state protection device provided in the embodiments of the present invention may further include: a model building module, used to build a logistic regression model using key indicators in network communication; the key indicators include handshake efficiency, transmission rhythm, data randomness, window stability and timing regularity; and a model inference module, used to determine the degree of communication out-of-sync state between the client and the server using the trained logistic regression model, and trigger the corresponding graded compensation strategy.

[0078] Furthermore, in specific implementations, the communication out-of-sync state protection device provided in the embodiments of the present invention may further include: a model training module, used to calculate target data including handshake time, data packet interval time, entropy value of consecutive data packets, sliding window analysis of consecutive data packets, and unexpected time sequences under different degrees of communication out-of-sync, and organize the target data into feature values; input the feature values ​​into a logistic regression model for training, so as to output the corresponding communication out-of-sync state probability value. During the training process, a logistic regression model can be used to combine the feature values ​​into a linear function according to weights; an activation function is introduced into the logistic regression model, and the value of the linear function is mapped to the communication out-of-sync state probability value using the activation function.

[0079] Furthermore, in a specific implementation, in the communication out-of-sync state protection device provided in the embodiments of the present invention, the graded compensation module 12 can also be used to determine the communication out-of-sync state between the client and the server as the first state and trigger a first-level compensation strategy when the probability value of the communication out-of-sync state is greater than a first set probability value and less than or equal to a second set probability value; the first-level compensation strategy includes generating an acknowledgment packet without data and inserting the acknowledgment packet into the communication stream; the acknowledgment packet occupies the Transmission Control Protocol window position; when the absolute difference is greater than the second set probability value and less than or equal to a third set probability value, determine the communication out-of-sync state between the client and the server as the second state and trigger a second-level compensation strategy; the second-level compensation strategy includes reading valid messages within a set time period from the cache and reorganizing the data packets according to the valid information; the degree of communication out-of-sync in the second state is greater than the degree of communication out-of-sync in the first state; when the absolute difference is greater than the third set probability value, determine the communication out-of-sync state between the client and the server as the third state and trigger a third-level compensation strategy; the third-level compensation strategy includes terminating the current TLS connection and sending an alarm message to the client and the server to enable the client and the server to re-establish the session; the degree of communication out-of-sync in the third state is greater than the degree of communication out-of-sync in the second state.

[0080] Embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above embodiments of the communication out-of-sync state protection method.

[0081] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above embodiments of the communication out-of-sync state protection method when running.

[0082] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0083] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the communication out-of-sync state protection method.

[0084] Embodiments of the present invention also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above embodiments of the communication out-of-sync state protection method.

[0085] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0086] The present invention has provided a detailed description of a communication out-of-synchronization protection method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of the invention. The descriptions of these embodiments are only intended to aid in understanding the method and core ideas of the invention. It should be noted that those skilled in the art can make various improvements and modifications to the invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the invention.

Claims

1. A method for communication out-of-sync state protection, the method comprising: The application is applied to an application layer device, comprising: After a client and a server complete a transmission layer security protocol handshake, receiving data packets transmitted by the client and the server respectively; wherein a sequence number of a data packet sent by the client is sequentially increased by a set value with the initial sequence number of the client as a starting reference; a sequence number of a data packet sent by the server is sequentially increased by a set value with the initial sequence number of the server as a starting reference; the initial sequence number of the client and the initial sequence number of the server are both generated by a hash algorithm with encrypted negotiation information combined with a time stamp; Analyzing the data packets, extracting the client sequence number and the server sequence number, and calculating the absolute difference between the client sequence number and the server sequence number; Comparing the absolute difference with a preset threshold value, determining the degree of the out-of-step state of the client and the server according to the comparison result, and triggering a corresponding hierarchical compensation strategy.

2. The method of claim 1, wherein, Analyzing the data packets, extracting the client sequence number and the server sequence number, and calculating the absolute difference between the client sequence number and the server sequence number, comprising: According to the record format defined by the transmission layer security protocol, the data packets are structurally disassembled, and the record header and the record payload are sequentially analyzed; After the record header is successfully verified, the client sequence number and the server sequence number encapsulated in the record payload are extracted; The difference between the client sequence number and the server sequence number is calculated and the absolute value is taken to obtain the absolute difference between the client sequence number and the server sequence number.

3. The method of claim 1, wherein, Comparing the absolute difference with a preset threshold value, determining the degree of the out-of-step state of the client and the server according to the comparison result, and triggering a corresponding hierarchical compensation strategy, comprising: When the absolute difference is greater than a first preset threshold value and less than or equal to a second preset threshold value, it is determined that the out-of-step state of the client and the server is in a first state, and a first-level compensation strategy is triggered; the first-level compensation strategy includes generating a data-free acknowledgement packet and inserting the acknowledgement packet into the communication stream; the acknowledgement packet occupies a transmission control protocol window position; When the absolute difference is greater than the second preset threshold value and less than or equal to a third preset threshold value, it is determined that the out-of-step state of the client and the server is in a second state, and a second-level compensation strategy is triggered; the second-level compensation strategy includes reading valid messages in a set time period from a cache and restructuring the data packets according to the valid information; the communication out-of-step degree of the second state is greater than that of the first state.

4. The method of claim 3, wherein, Comparing the absolute difference with a preset threshold value, determining the degree of the out-of-step state of the client and the server according to the comparison result, and triggering a corresponding hierarchical compensation strategy, further comprising: When the absolute difference is greater than the third preset threshold value, it is determined that the out-of-step state of the client and the server is in a third state, and a third-level compensation strategy is triggered; the third-level compensation strategy includes terminating the current transmission layer security protocol connection, sending an alarm message to the client and the server, so that the client and the server reestablish a session; the communication out-of-step degree of the third state is greater than that of the second state.

5. The method of claim 3, wherein, Restructuring the data packets according to the valid information, comprising: Reserve the header of the Internet Protocol layer and the Transmission Control Protocol layer in the data packet; Remove part of the application layer data in the data packet; Fill the effective message in the original position of the part of the application layer data, so that the effective message replaces the part of the application layer data, to generate a reorganized data packet.

6. The method of claim 1, wherein, Further comprising: Building a logistic regression model by using key indicators in network communication; The key indicators include handshake efficiency, transmission rhythm, data randomness, window stability and timing regularity; Determine the degree of communication out-of-sync state between the client and the server by using the trained logistic regression model, and trigger the corresponding hierarchical compensation strategy.

7. The method of claim 6, wherein, Before determining the degree of communication out-of-sync state between the client and the server by using the trained logistic regression model, comprising: Calculate target data including handshake time consumption, data packet interval time, entropy value of continuous data packet, sliding window analysis of continuous data packet and unexpected timing under different communication out-of-sync degrees, and organize the target data into feature values; Input the feature values into the logistic regression model for training, to output corresponding communication out-of-sync state probability values.

8. The method of claim 7, wherein, Inputting the feature values into the logistic regression model for training, comprising: Combining the feature values into a linear function according to weights by using the logistic regression model; Introducing an activation function into the logistic regression model, and mapping the value of the linear function into a communication out-of-sync state probability value by using the activation function.

9. The method of claim 8, wherein, Determine the degree of communication out-of-sync state between the client and the server by using the trained logistic regression model, and trigger the corresponding hierarchical compensation strategy, comprising: When the communication out-of-sync state probability value is greater than a first set probability value and less than or equal to a second set probability value, determine that the communication out-of-sync state between the client and the server is a first state, and trigger a first-level compensation strategy; the first-level compensation strategy includes generating a data-free acknowledgement packet and inserting the acknowledgement packet into the communication stream; the acknowledgement packet occupies a Transmission Control Protocol window position; When the absolute difference value is greater than the second set probability value and less than or equal to a third set probability value, determine that the communication out-of-sync state between the client and the server is a second state, and trigger a second-level compensation strategy; the second-level compensation strategy includes reading effective messages in a set time period from a cache, and restructuring the data packet according to the effective information; the communication out-of-sync degree of the second state is greater than that of the first state.

10. The method of claim 9, wherein, Determine the degree of communication out-of-sync state between the client and the server by using the trained logistic regression model, and trigger the corresponding hierarchical compensation strategy, further comprising: When the absolute difference value is greater than the third set probability value, determine that the communication out-of-sync state between the client and the server is a third state, and trigger a third-level compensation strategy; the third-level compensation strategy includes terminating the connection of the current Transport Layer Security protocol, and sending an alarm packet to the client and the server, so that the client and the server reestablish a session; the communication out-of-sync degree of the third state is greater than that of the second state.

11. The method of protecting against out-of-sync conditions of claim 1, wherein, The generation process of the client initial sequence number and the server initial sequence number comprises: In the transmission layer security protocol handshake stage, a client random number and a server random number are obtained as encryption negotiation information, and the client random number and the server random number are spliced into a string; A current timestamp is appended to the spliced string to form to-be-hashed data; A main key negotiated by the transmission layer security protocol handshake is used as an encryption key to perform a hash operation on the to-be-hashed data to obtain a hash value; A first set length of bytes is intercepted from the hash value according to a preset position; The intercepted bytes are used as a base seed of the initial sequence number; The base seed of the initial sequence number is subjected to a bitwise exclusive or operation with a second set length of bytes at the tail end of a client internet protocol address to generate a client initial sequence number; The base seed of the initial sequence number is subjected to a bitwise exclusive or operation with a third set length of bytes of a server port number to generate a server initial sequence number.

12. The method of protecting against out-of-sync conditions of claim 1, wherein, Before the data packet is parsed, the method further includes: An extension field is added in a client handshake request message and a server handshake response message, and the client initial sequence number and the server initial sequence number are exchanged by using the extension field.

13. An electronic device, comprising: The method includes: a memory configured to store a computer program; a processor configured to implement the steps of the communication out-of-sync state protection method according to any one of claims 1 to 12 when the computer program is executed.

14. A computer-readable storage medium, characterized in that, The computer program is stored in the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the communication out-of-sync state protection method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the communication out-of-sync state protection method according to any one of claims 1 to 12.

Images