Anti-replay method and system based on hidden serial number and hash check

Abstract

The application discloses an anti-replay method based on hidden serial number and hash check, which hides the serial number in the local and does not transmit the serial number with the message, and uses the serial number as an input parameter of hash calculation, so that even if the attacker intercepts the message, the attacker cannot obtain the valid serial number, and thus cannot construct a replay message or a fake message which can pass the hash check; meanwhile, the message integrity verification and the anti-replay verification can be synchronously completed by using one hash check, and additional serial number comparison logic or independent check field is not needed, and the whole scheme does not need clock synchronization and complex negotiation, only needs to locally save eighteen bytes of data, significantly reduces resource consumption, and is particularly suitable for clock synchronization-free and performance-limited embedded systems, and can effectively resist replay attacks and message tampering in a plaintext communication scene.

Description

Technical Field

[0001] This invention belongs to the technical field of information security for embedded systems in industrial control, and particularly relates to an anti-replay method and system based on hidden serial numbers and hash verification. Background Technology

[0002] Industrial control embedded systems are widely used in critical infrastructures such as transportation, energy, and manufacturing, and are characterized by their diversity, varying performance, and rich application scenarios. With the popularization of the Industrial Internet, industrial embedded systems are gradually shifting from specialized and closed systems to open and intelligent systems, and the cybersecurity threats they face are becoming increasingly severe.

[0003] Ensuring the integrity, authenticity, and confidentiality of data in network communications has become a crucial task. Replay attacks, a common and highly threatening cyberattack method, can steal legitimate communication data at any time and resend it, attempting to deceive the system or services to illegally obtain information, tamper with data, or even disrupt the normal operation of the system. Existing countermeasures against replay attacks mainly employ three methods: timestamps, random numbers, and sequence numbers.

[0004] 1. Timestamp Scheme Timestamp schemes are a simple and effective anti-replay mechanism, using timestamps in the data to determine the validity of a message. Its drawback is that both communicating parties need to support clock synchronization, and the more precise the clock synchronization, the better. Timestamp schemes are not suitable for embedded systems without clock synchronization or with inaccurate clock synchronization.

[0005] 2. Random number scheme The random number scheme introduces a unique random number as an identifier. The receiver checks whether the random number has been used to determine if it is a replay message. The random number scheme does not require clock synchronization, but as the number of requests increases, the amount of used random numbers that the receiver needs to store also increases, posing a challenge to the system's storage and query performance.

[0006] 3. Serial Number Scheme Sequence numbering schemes add an incrementing integer to the messages between both parties. A non-consecutive sequence number is considered a replay message. Sequence numbering schemes also do not require clock synchronization and store significantly less information than random number schemes. However, once an attacker successfully decrypts the message, they can obtain the sequence number. In some embedded systems that use plaintext transmission due to performance limitations, obtaining the sequence number is relatively easy. Once an attacker obtains the sequence number, they can increment it to deceive the authentication end.

[0007] Therefore, there is a need in the field for a solution that can defend against replay attacks in embedded systems that lack clock synchronization and have limited performance. Summary of the Invention

[0008] The purpose of this invention is to provide an anti-replay method and system based on hidden serial numbers and hash verification, which can effectively resist replay and tampering of messages without consuming too many system resources, thus achieving a balance between security and performance.

[0009] To achieve the above objectives, the technical solution of the present invention is as follows: A replay protection method based on hidden sequence number and hash verification includes: Before establishing a link, both parties randomly generate a starting sequence number and a sequence number step size. After establishing a link, both parties exchange their starting sequence number and sequence number step size, and initialize the sending sequence number and receiving sequence number based on the exchanged parameters. Before sending a message, the sending end combines the current sending sequence number with the message to be sent and calculates the hash value of the combined data; after appending the hash value to the message to be sent, it sends a message containing the original text and the hash value to the receiving end, wherein the sending sequence number is not transmitted with the message; after successful transmission, the sending sequence number is increased by the sequence number step size. After receiving a message, the receiving end combines the current received sequence number with the received original text and calculates the hash value of the combined data; it compares the calculated hash value with the received hash value; if they match, the message is confirmed to be valid, the message is processed, and the received sequence number is increased by the sequence number step; if they do not match, the message is discarded.

[0010] According to one embodiment of the present invention, the starting sequence number is four bytes, the sequence number step size is one byte, and both the sending sequence number and the receiving sequence number are eight bytes. During initialization, the lower four bytes of the sequence number are set to the corresponding starting sequence number.

[0011] According to one embodiment of the present invention, the hash value is calculated using the national cryptographic algorithm SM3; The sending sequence number or the receiving sequence number is placed at the front end or back end of the original message to participate in the hash calculation, and the two communicating parties agree on the placement position in advance.

[0012] According to one embodiment of the present invention, when the two communicating parties use TLS encrypted communication, they exchange their respective starting sequence number and sequence number step size in the extended fields of the ClientHello and ServerHello messages during the TLS negotiation phase.

[0013] According to one embodiment of the present invention, when the two communicating parties use plaintext communication, they transmit their respective starting sequence number and sequence number step size in the first service message after the connection is established.

[0014] According to one embodiment of the present invention, the method further includes: The application layer sets a timeout mechanism; if no new valid message is received within a preset time, the current communication link is disconnected.

[0015] An anti-replay system based on hidden sequence number and hash verification includes a transmitting device and a receiving device; The transmitting device includes: The parameter generation module is used to randomly generate the starting sequence number and the sequence number step size. The sequence number management module is used to initialize the sending sequence number based on the peer's starting sequence number obtained from the exchange, and to update the sending sequence number by the sequence number step size after each successful transmission; The hash calculation module is used to calculate the hash value by combining the current sending sequence number with the message to be sent; The message assembly module is used to append the calculated hash value to the message to be sent to generate a message to be sent. The communication module is used to send the transmission message to the receiving device; The receiving device includes: A communication module is used to receive the transmitted message; The sequence number management module is used to initialize the receiving sequence number based on the sending end start sequence number obtained by exchange, and to update the receiving sequence number by the sequence number step size after each successful reception of a valid message; The hash calculation module is used to calculate the hash value by combining the current received sequence number with the received plain text; The verification module is used to compare the calculated hash value with the hash value attached to the sent message. If they match, the message is confirmed to be valid; otherwise, the message is discarded. Neither the sending sequence number nor the receiving sequence number is transmitted with the message.

[0016] According to one embodiment of the present invention, the hash calculation module uses the national cryptographic SM3 algorithm to calculate the hash value.

[0017] According to one embodiment of the present invention, the sending device and / or the receiving device further includes a timeout control module, configured to disconnect the current communication link if no new legitimate message is received within a preset time. Because the present invention adopts the above technical solution, it has the following advantages and positive effects compared with the prior art: The anti-replay method based on hidden sequence number and hash verification in one embodiment of the present invention hides the sequence number locally without transmitting it with the message, and uses it as the input parameter for hash calculation. This prevents attackers from obtaining the valid sequence number even if they intercept the message, thus making it impossible for them to construct replay messages or forged messages that can pass hash verification. At the same time, message integrity verification and anti-replay verification can be completed simultaneously with a single hash verification, without the need for additional sequence number comparison logic or independent verification fields. Moreover, the entire solution does not require clock synchronization or complex negotiation, and only needs to store eighteen bytes of data locally, which significantly reduces resource overhead. It is particularly suitable for embedded systems without clock synchronization and with limited performance, and can also effectively resist replay attacks and message tampering in plaintext communication scenarios. Attached Figure Description

[0018] Figure 1 This is a flowchart of an anti-replay method based on hidden serial number and hash verification in one embodiment of the present invention; Figure 2 This is a schematic diagram of TLS negotiation in one embodiment of the present invention; Figure 3 This is a schematic diagram of a data transmission protocol format in one embodiment of the present invention; Figure 4 This is a flowchart illustrating the message receiving process in one embodiment of the present invention. Detailed Implementation

[0019] The following detailed description, in conjunction with the accompanying drawings and specific embodiments, provides a further detailed explanation of the anti-replay method and system based on hidden serial numbers and hash verification proposed in this invention.

[0020] This embodiment provides an anti-replay method based on hidden serial numbers and hash verification, suitable for communication scenarios in industrial control embedded systems where resources are limited and clock synchronization is not required. Figures 1 to 4 As shown, this method mainly includes three core stages: parameter negotiation and initialization, sending end processing, and receiving end processing.

[0021] During the parameter negotiation and initialization phase, before establishing a link, both communicating parties randomly generate a starting sequence number and a sequence number step size locally. The starting sequence number occupies four bytes, and the sequence number step size occupies one byte. Since the starting sequence number and sequence number step size are randomly generated for each communication, and each party generates them independently, this process is unpredictable.

[0022] After establishing a connection, both parties exchange their respective starting sequence numbers and sequence number steps. Following this exchange, both parties initialize the sending and receiving sequence numbers for this connection. Each sequence number occupies eight bytes. During initialization, the lower four bytes of the sequence number are set to the corresponding starting sequence number, and the higher four bytes are set to zero or other preset initial values. Specifically, both parties initialize the sending sequence number using the starting sequence number generated by their own end, and initialize the receiving sequence number using the starting sequence number sent by the other end.

[0023] The data that each communicating party needs to store locally includes: the sending sequence number (8 bytes), the receiving sequence number (8 bytes), the local sequence number step size (1 byte), and the peer sequence number step size (1 byte), totaling eighteen bytes. This storage requirement is minimal for resource-constrained embedded systems.

[0024] Before sending a service message, the sending end performs the following steps: Step S101: Combine the current sending sequence number with the original message to be sent. The sending sequence number can be placed at the beginning or end of the original message; the placement can be agreed upon beforehand by both communicating parties.

[0025] Step S102: Calculate the hash value of the combined data. In this embodiment, the hash algorithm used is the Chinese national cryptographic algorithm SM3. Because the SM3 algorithm is one-way, even if an attacker intercepts the hash value, they cannot deduce the original serial number.

[0026] Step S103: Append the calculated hash value to the end of the original message to generate the message to be sent. It should be noted that the sequence number is removed from the final sent message and is not transmitted with it. That is, the content actually transmitted over the network only includes the original message and the hash value; the sequence number is completely hidden.

[0027] Step S104: Send the message to be sent to the receiving end through the communication interface.

[0028] Step S105: After successful transmission, increment the value of the transmission sequence number by the sequence number step size to prepare for the next transmission.

[0029] After receiving the message, the receiving end performs the following steps: Step S201: Receive a message from the sender, which contains the original message and a hash value appended to the end.

[0030] Step S202: Separate the original message and hash value from the received message. Specifically, remove the hash value portion at the end of the message and retain the original message content.

[0031] Step S203: Combine the current received sequence number with the original message obtained in step S202. The placement of the received sequence number (front end or back end) is consistent with the agreement of the sending end.

[0032] Step S204: Calculate the hash value of the combined data using the same hash algorithm (SM3) as the sending end to obtain the locally calculated hash value.

[0033] Step S205: Compare the locally calculated hash value obtained in step S204 with the received hash value separated in step S202.

[0034] If the two are inconsistent, it indicates that the message may have been subjected to a replay attack or tampering attack. The receiving end will discard the message directly without further processing.

[0035] If the two match, it indicates that the message is a valid message. The receiving end continues to process the message and increments the value of the received sequence number by the sequence number step size to prepare for the next reception.

[0036] Through the above process, since the sequence number is not transmitted over the network, even if an attacker intercepts the message, they cannot obtain the currently valid sequence number value. Therefore, they cannot construct a replay message or forged message that can pass hash verification. Furthermore, due to the one-way and sensitive nature of hash verification, any tampering with the message content will cause the hash value comparison to fail. Therefore, this method achieves both anti-replay functionality and message integrity verification.

[0037] In one embodiment, the two communicating parties use a TLS encrypted channel for communication. For example... Figure 2 As shown, the two communicating parties exchange the starting sequence number and sequence number step size during the TLS negotiation phase.

[0038] Specifically, when sending a Client Hello message, the client appends a locally generated start sequence number and sequence number step size to the extension portion at the end of the Client Hello message. This extension field has an extension code of 0xFF77 and a length of five bytes, where the first four bytes are the start sequence number and the last byte is the sequence number step size.

[0039] After receiving the Client Hello message, the server parses the aforementioned extended fields to obtain the client's starting sequence number and sequence number step size. Simultaneously, in its reply Server Hello message, the server appends a randomly generated starting sequence number and sequence number step size to the extension portion at the end of the message, using the extended encoding 0xFF77.

[0040] After the TLS negotiation is completed, starting from the first business message, both communicating parties perform sequence number management and hash verification in accordance with the method described in Example 1.

[0041] like Figure 3 As shown, during the data transmission phase, the sender first adds the sending sequence number to the front of the original message and calculates the hash value using the SM3 national cryptographic algorithm. After calculation, the sending sequence number is removed, and the hash value is placed at the back of the original message. Subsequently, the message is padded as needed and encrypted using the SM4 national cryptographic algorithm to obtain ciphertext. The random number (IV) required for encryption is appended to the front of the ciphertext to form the final message to be sent.

[0042] After receiving the message, the receiving end first decrypts the data using the key and the received IV. After decryption, the hash value and padding data at the end are removed, the received sequence number is added to the front of the original message, the hash value is recalculated using the national standard SM3, and compared with the received hash value to determine whether the message is legitimate.

[0043] In one embodiment, the two communicating parties communicate in plaintext. Since embedded systems often cannot afford the overhead of encryption and decryption operations due to performance limitations, plaintext communication is quite common in this type of scenario.

[0044] After establishing a TCP connection or similar transport layer connection, both communicating parties send a dedicated parameter exchange message before sending the first service message. This message transmits their respective starting sequence number and sequence number step size. The format of this parameter exchange message can be agreed upon in advance by the two parties; for example, the first four bytes are the starting sequence number, and the fifth byte is the sequence number step size.

[0045] After both parties complete the parameter exchange and initialize their respective send and receive sequence numbers, they can transmit service messages according to the process described in Example 1. Compared with TLS mode, plaintext mode omits steps such as TLS negotiation, SM4 encryption / decryption, and IV appending, while the remaining sequence number hiding and hash verification processes remain the same.

[0046] In plaintext mode, because the sequence number is not transmitted over the network, even if an attacker intercepts a packet through network sniffing, they can only obtain the original packet content and hash value, but cannot know the sequence numbers maintained by the sender and receiver respectively. Therefore, attackers cannot construct forged packets that can pass hash verification, nor can they replay intercepted legitimate packets.

[0047] Furthermore, to prevent inconsistencies in serial numbers between the communicating parties due to network packet loss, program malfunctions, or attacks, this embodiment also includes a timeout protection mechanism.

[0048] Specifically, both communicating parties' application layers are configured with timeout timers. If the receiving end does not receive a new legitimate message within the preset timeout period, the application layer determines that the current connection has an abnormal risk and actively disconnects the current communication connection. If the communicating parties need to continue communicating, they must re-establish the connection and re-execute the process of generating and exchanging the starting sequence number and sequence number step size.

[0049] This timeout mechanism effectively avoids the problem of the security window expanding due to the sequence number being out of sync for a long time. At the same time, since the starting sequence number and step size are randomly generated each time the link is re-established, even if an attacker has previously intercepted some packets, they will not be able to continue using them in the new connection.

[0050] As can be seen from the above embodiments, this anti-replay method based on hidden sequence numbers and hash verification simultaneously achieves message integrity verification and anti-replay verification through a single hash verification. The sending end uses the hidden sequence number as the input parameter for hash calculation, so that the hash value is bound not only to the message content but also to the transmission timing; the receiving end verifies the message's integrity and timing legitimacy through hash comparison. This method does not require the system to have high-precision clock synchronization capabilities, nor does it require complex key negotiation and encryption / decryption operations. It only requires an additional 18 bytes of data storage, achieving high security with minimal resource overhead, and is suitable for embedded systems without clock synchronization and with limited performance.

[0051] Furthermore, it is applicable to both encrypted and plaintext communication scenarios. In TLS encrypted communication, parameters are exchanged through standard extended fields; in plaintext communication, parameters are exchanged through the first message. Especially in plaintext communication scenarios, since the sequence number is completely hidden and not transmitted, it effectively solves the pain point of plaintext embedded systems being vulnerable to replay attacks and message forgery attacks.

[0052] Based on the above method, this application also provides an anti-replay system based on hidden serial number and hash verification, including a transmitting device and a receiving device; The transmitting device includes: The parameter generation module is used to randomly generate the starting sequence number and the sequence number step size. The sequence number management module is used to initialize the sending sequence number based on the peer's starting sequence number obtained from the exchange, and to update the sending sequence number by the sequence number step size after each successful transmission; The hash calculation module is used to calculate the hash value by combining the current sending sequence number with the message to be sent; The message assembly module is used to append the calculated hash value to the message to be sent to generate the message to be sent. The communication module is used to send transmission messages to the receiving device; The receiving equipment includes: The communication module is used to receive and send messages; The sequence number management module is used to initialize the receiving sequence number based on the sending end start sequence number obtained by exchange, and to update the receiving sequence number by the sequence number step size after each successful reception of a valid message; The hash calculation module is used to calculate the hash value by combining the current received sequence number with the received plain text; The verification module compares the calculated hash value with the hash value appended to the sent message. If they match, the message is confirmed to be valid; otherwise, the message is discarded. Neither the sending sequence number nor the receiving sequence number is transmitted with the message.

[0053] The anti-replay system based on hidden serial numbers and hash verification is used to implement the above-mentioned anti-replay method based on hidden serial numbers and hash verification. Its implementation method is similar and will not be described in detail here.

[0054] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments. Even if various changes are made to the present invention, if these changes fall within the scope of the claims of the present invention and their equivalents, they shall still fall within the protection scope of the present invention.

Claims

1. A replay protection method based on hidden serial number and hash verification, characterized in that, include: Before establishing a link, both parties randomly generate a starting sequence number and a sequence number step size. After establishing a link, both parties exchange their starting sequence number and sequence number step size, and initialize the sending sequence number and receiving sequence number based on the exchanged parameters. Before sending a message, the sender combines the current sending sequence number with the message to be sent and calculates the hash value of the combined data. After appending the hash value to the message to be sent, a message containing the original text and the hash value is sent to the receiving end, wherein the sending sequence number is not transmitted with the message; after successful transmission, the sending sequence number is incremented by the sequence number step size; After receiving a message, the receiving end combines the current received sequence number with the received original text and calculates the hash value of the combined data; it compares the calculated hash value with the received hash value; if they match, the message is confirmed to be valid, the message is processed, and the received sequence number is increased by the sequence number step; if they do not match, the message is discarded.

2. The anti-replay method based on hidden serial number and hash verification according to claim 1, characterized in that, The starting sequence number is four bytes, and the sequence number step size is one byte; both the sending sequence number and the receiving sequence number are eight bytes. During initialization, the lower four bytes of the sequence number are set to the corresponding starting sequence number.

3. The anti-replay method based on hidden serial number and hash verification according to claim 1, characterized in that, The hash value is calculated using the national cryptographic algorithm SM3. The sending sequence number or the receiving sequence number is placed at the front end or back end of the original message to participate in the hash calculation, and the two communicating parties agree on the placement position in advance.

4. The anti-replay method based on hidden serial number and hash verification according to claim 1, characterized in that, When the two communicating parties use TLS encryption, they exchange their starting sequence number and sequence number step size in the extended fields of the Client Hello and Server Hello messages during the TLS negotiation phase.

5. The anti-replay method based on hidden serial number and hash verification according to claim 1, characterized in that, When both parties communicate in plaintext, they transmit their respective starting sequence number and sequence number step size in the first service message after the connection is established.

6. The anti-replay method based on hidden serial number and hash verification according to claim 1, characterized in that, The method further includes: The application layer sets a timeout mechanism; if no new valid message is received within a preset time, the current communication link is disconnected.

7. A replay protection system based on hidden serial numbers and hash verification, characterized in that, This includes both transmitting and receiving devices. The transmitting device includes: The parameter generation module is used to randomly generate the starting sequence number and the sequence number step size. The sequence number management module is used to initialize the sending sequence number based on the peer's starting sequence number obtained from the exchange, and to update the sending sequence number by the sequence number step size after each successful transmission; The hash calculation module is used to calculate the hash value by combining the current sending sequence number with the message to be sent; The message assembly module is used to append the calculated hash value to the message to be sent to generate a message to be sent. The communication module is used to send the transmission message to the receiving device; The receiving device includes: A communication module is used to receive the transmitted message; The sequence number management module is used to initialize the receiving sequence number based on the sending end start sequence number obtained by exchange, and to update the receiving sequence number by the sequence number step size after each successful reception of a valid message; The hash calculation module is used to calculate the hash value by combining the current received sequence number with the received plain text; The verification module is used to compare the calculated hash value with the hash value attached to the sent message. If they match, the message is confirmed to be valid; otherwise, the message is discarded. Neither the sending sequence number nor the receiving sequence number is transmitted with the message.

8. The anti-replay system based on hidden serial number and hash verification according to claim 7, characterized in that, The hash calculation module uses the national cryptographic SM3 algorithm to calculate the hash value.

9. The anti-replay system based on hidden serial number and hash verification according to claim 7, characterized in that, The sending device and / or the receiving device further include a timeout control module, used to disconnect the current communication link if no new valid message is received within a preset time.

Images