Replay prevention method and apparatus, and electronic device and storage medium

Abstract

Provided in the present application are a replay prevention method and apparatus, and an electronic device and a storage medium. In the present application, when a replay prevention sequence number of a received data message is not within the range of a replay prevention window at a receiving end, it indicates that an anomaly may have occurred at a sending end; in this case, the data message is directly discarded, and an encrypted self-recovery data packet carrying a target replay prevention sequence number is sent to the sending end; and after receiving the self-recovery data packet, the sending end decrypts the self-recovery data packet to obtain the target replay prevention sequence number, and resends to the receiving end a data message carrying the target replay prevention sequence number.

Description

Anti-replay method and device, electronic equipment and storage medium TECHNICAL FIELD

[0001] The present application relates to the technical field of network data communication, and particularly relates to an anti-replay method and device, electronic equipment and storage medium. BACKGROUND

[0002] A commonly used anti-replay method is to add an anti-replay sequence number in a message to be transmitted, and a receiving end is configured with a sliding window, which is configured with an anti-replay window range. When receiving the message, the receiving end directly filters out the message whose anti-replay sequence number is outside the anti-replay window range, so as to prevent replay attacks.

[0003] Due to some factors such as network problems, system restart or misoperation, the sending end may lose the state (for example, the order of the anti-replay sequence number) of the anti-replay sequence number of the currently transmitted message, and configure the anti-replay sequence number of the message from zero. In this case, the receiving end may detect the normal message as a replay attack and reject the message, causing misidentification of the replay attack. SUMMARY

[0004] Therefore, the present application provides an anti-replay method and device, electronic equipment and storage medium to avoid misidentification of the replay attack.

[0005] The technical scheme provided by the present application is as follows:

[0006] According to the embodiment of the first aspect of the present application, an anti-replay method is provided, which is applied to a receiving end, and the method comprises: receiving a data message sent by a sending end, and parsing an initial anti-replay sequence number from the data message; if the initial anti-replay sequence number is not within an anti-replay window range of the receiving end, discarding the data message, and sending an encrypted self-recovery data packet to the sending end; wherein the anti-replay window is a window with a preset length; and the self-recovery data packet comprises a target anti-replay sequence number determined based on a center value of the anti-replay window, so that the sending end can resend the data message based on the target anti-replay sequence number after receiving the self-recovery data packet.

[0007] Optionally, the method further comprises: if the initial anti-replay sequence number is within the range of the anti-replay window and the initial anti-replay sequence number is greater than the center value of the anti-replay window, updating the center value of the anti-replay window as the initial anti-replay sequence number, updating the range of the anti-replay window, and processing the data packet; updating the check code corresponding to the initial anti-replay sequence number in the anti-replay list corresponding to the anti-replay window to a second value; wherein the anti-replay list records all anti-replay sequence numbers included in the range of the anti-replay window and the check code corresponding to each anti-replay sequence number, and the check code includes a first value and a second value, the first value indicating that the data packet carrying the anti-replay sequence number has not been processed, and the second value indicating that the data packet carrying the anti-replay sequence number has been processed.

[0008] Optionally, the method further comprises: if the initial anti-replay sequence number is within the range of the anti-replay window and the initial anti-replay sequence number is less than the center value of the anti-replay window, obtaining the check code corresponding to the initial anti-replay sequence number in the anti-replay list corresponding to the anti-replay window; if the check code is a first value, processing the data packet and updating the check code to a second value; if the check code is a second value, discarding the data packet; wherein the anti-replay list records all anti-replay sequence numbers included in the range of the anti-replay window and the check code corresponding to each anti-replay sequence number, and the check code includes a first value and a second value, the first value indicating that the data packet carrying the anti-replay sequence number has not been processed, and the second value indicating that the data packet carrying the anti-replay sequence number has been processed.

[0009] Optionally, the receiving end maintains a plurality of anti-replay windows corresponding to different sending ends, and different anti-replay windows are configured with different service identifiers, and each sending end locally maintains the service identifier of the anti-replay window corresponding to the service of the sending end; the receiving end receives the data packet sent by the sending end, and includes: based on the service identifier carried in the data packet, determining the sending end sending the data packet and the range of the corresponding anti-replay window on the receiving end.

[0010] Optionally, the sending end can resend the data packet based on the target anti-replay sequence number after receiving the self-recovery data packet, and the resending the data packet based on the target anti-replay sequence number specifically includes: decrypting the self-recovery data packet, parsing the target anti-replay sequence number from the self-recovery data packet, and resending the data packet carrying the target anti-replay sequence number.

[0011] According to an embodiment of the second aspect of the present application, a replay prevention method is provided, which is applied to a sending end, and the method comprises: sending a data packet to a receiving end, wherein the data packet carries an initial replay prevention sequence number, so that the receiving end parses the initial replay prevention sequence number from the data packet after receiving the data packet; determining a target replay prevention sequence number based on a self-recovery data packet received from the receiving end; updating the sent data packet carrying the initial replay prevention sequence number to carry the target replay prevention sequence number, and re-sending the data packet carrying the target replay prevention sequence number to the receiving end.

[0012] Optionally, the step of determining the target replay prevention sequence number based on the self-recovery data packet comprises: decrypting the self-recovery data packet, and parsing the target replay prevention sequence number from the self-recovery data packet.

[0013] According to an embodiment of the third aspect of the present application, a replay prevention device is provided, which is applied to a receiving end, and the device comprises: a receiving unit configured to receive a data packet sent by a sending end, and parse an initial replay prevention sequence number from the data packet; a processing unit configured to discard the data packet if the initial replay prevention sequence number is not within a replay prevention window of the receiving end; wherein the replay prevention window is a window with a preset length; and a sending unit configured to send a self-recovery data packet encrypted to the sending end, wherein the self-recovery data packet comprises a target replay prevention sequence number determined based on a center value of the replay prevention window, so that the sending end can re-send the data packet based on the target replay prevention sequence number after receiving the self-recovery data packet.

[0014] Optionally, the processing unit is further configured to: if the initial replay prevention sequence number is within the range of the replay prevention window and the initial replay prevention sequence number is greater than the center value of the replay prevention window, update the center value of the replay prevention window as the initial replay prevention sequence number, update the range of the replay prevention window, and process the data packet; and update a check code corresponding to the initial replay prevention sequence number in a replay prevention list corresponding to the replay prevention window to a second value; wherein the replay prevention list records all replay prevention sequence numbers within the range of the replay prevention window and check codes corresponding to the replay prevention sequence numbers, and the check codes comprise a first value and a second value, wherein the first value indicates that a data packet carrying the replay prevention sequence number has not been processed, and the second value indicates that the data packet carrying the replay prevention sequence number has been processed.

[0015] Optionally, the processing unit is further configured to: if the initial anti-replay sequence number is within the range of the anti-replay window and the initial anti-replay sequence number is less than the center value of the anti-replay window, obtaining a check code corresponding to the initial anti-replay sequence number in an anti-replay list corresponding to the anti-replay window; if the check code is a first value, processing the data packet and updating the check code to a second value; if the check code is the second value, discarding the data packet. The anti-replay list records all anti-replay sequence numbers included in the range of the anti-replay window and the check codes corresponding to the anti-replay sequence numbers, and the check code includes the first value and the second value. The first value indicates that the data packet carrying the anti-replay sequence number has not been processed, and the second value indicates that the data packet carrying the anti-replay sequence number has been processed.

[0016] Optionally, the receiving end maintains a plurality of anti-replay windows corresponding to different sending ends, and different anti-replay windows are configured with different service identifiers. Each sending end locally maintains the service identifier of the anti-replay window corresponding to the service of the sending end. The receiving unit is further configured to: in the case of receiving a data packet, determining the sending end sending the data packet and the range of the corresponding anti-replay window on the receiving end based on the service identifier carried in the data packet.

[0017] Optionally, after receiving the self-recovery data packet, the sending end can resend the data packet based on the target anti-replay sequence number, specifically including: decrypting the self-recovery data packet, parsing the target anti-replay sequence number from the self-recovery data packet, and resending the data packet carrying the target anti-replay sequence number.

[0018] According to an embodiment of the fourth aspect of the application, an anti-replay device is provided, which is applied to a sending end and includes: a sending unit configured to send a data packet to a receiving end, the data packet carrying an initial anti-replay sequence number, so that the receiving end parses the initial anti-replay sequence number from the data packet after receiving the data packet; a decryption unit configured to determine a target anti-replay sequence number based on an encrypted self-recovery data packet sent by the receiving end; and a retransmission unit configured to update the data packet carrying the initial anti-replay sequence number to the data packet carrying the target anti-replay sequence number, and resend the data packet carrying the target anti-replay sequence number to the receiving end.

[0019] Optionally, the decryption unit is further configured to decrypt the self-recovery data packet and parse the target anti-replay sequence number from the self-recovery data packet.

[0020] According to an embodiment of the fifth aspect of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to the first aspect or the second aspect when executing the program.

[0021] According to an embodiment of the sixth aspect of the present application, a computer readable storage medium is provided, wherein a plurality of computer instructions are stored on the computer readable storage medium, and the computer instructions implement the method according to the first aspect or the second aspect when executed.

[0022] As can be seen from the above technical solutions, in the case that the received data packet does not have a replay prevention sequence number within the replay prevention window range of the receiving end, it is indicated that the sending end may have an abnormality, and the current replay prevention sequence number cannot be known. At this time, the data packet is directly discarded, and an encrypted self-recovery data packet is sent to the sending end. The self-recovery data packet carries a target replay prevention sequence number, so that the sending end, after receiving the self-recovery data packet, decrypts the self-recovery data packet to obtain the target replay prevention sequence number, and re-sends the data packet carrying the target replay prevention sequence number to the receiving end. Through the above method, the encrypted self-recovery data packet is sent to the sending end of the data packet. If the sending end can successfully decrypt, it is indicated that the sending end is a normal sending end, rather than a replay attack. Further, the parsed target replay prevention sequence number is taken as the current replay prevention sequence number, and the data packet is re-sent to the receiving end for processing, thereby avoiding misidentification of the replay attack. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0024] FIG. 1 is a flow chart of a replay prevention method according to an embodiment of the present application.

[0025] FIG. 2 is a schematic diagram of a replay prevention window range according to an embodiment of the present application.

[0026] FIG. 3 is a schematic diagram of a replay prevention list according to an embodiment of the present application.

[0027] FIG. 4 is an interaction diagram of a replay prevention method according to an embodiment of the present application.

[0028] FIGS. 5A and 5B are schematic diagrams of multi-link communication between devices according to an embodiment of the present application.

[0029] FIG. 6 is a flow chart of another replay prevention method according to an embodiment of the present application.

[0030] FIG. 7 is a schematic diagram of a structure of an electronic device according to an embodiment of the present application.

[0031] FIG. 8 is a structural diagram of a replay protection device according to an embodiment of the present application.

[0032] FIG. 9 is a structural diagram of another replay protection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the technical solution provided by the embodiments of the present application more comprehensible to those skilled in the art, and to make the above-mentioned purposes, features and advantages of the embodiments of the present application more apparent and easy to understand, the technical solutions in the embodiments of the present application will be further described in detail below with reference to the drawings.

[0034] Please refer to FIG. 1, which is a flow chart of a replay protection method according to an embodiment of the present application. The method is applied to a receiving end.

[0035] As shown in FIG. 1, the method can include steps 101 to 102.

[0036] In step 101, a data packet sent by a sending end is received, and an initial replay protection sequence number is parsed from the data packet.

[0037] In the embodiment, the receiving end can parse the initial replay protection sequence number from the data packet in the case that the data packet sent by the sending end is received.

[0038] For example, the replay protection sequence number can be identified by a specific identifier carried in the data packet. For example, the replay protection sequence number can be a field with a fixed length, or in a specific position of the packet, or a specific flag bit. The replay protection sequence number is used to detect and prevent an attacker from resending or sending messages in different orders. For example, in some examples, the replay protection sequence number can be a value that is incremented in a continuous manner.

[0039] So far, the description of step 101 is ended.

[0040] In step 102, if the initial replay protection sequence number is not within the replay protection window range of the receiving end, the data packet is discarded, and an encrypted self-recovery data packet is sent to the sending end.

[0041] The replay protection window is a window with a preset length, and the center value of the replay protection window is the largest replay protection sequence number that has been received within the range of the replay protection window. The self-recovery data packet includes a target replay protection sequence number determined based on the center value of the replay protection window, so that the sending end can resend the data packet based on the target replay protection sequence number after receiving the self-recovery data packet. In an embodiment, the sending end can decrypt the self-recovery data packet after receiving the self-recovery data packet, parse the target replay protection sequence number from the self-recovery data packet, and resend the data packet carrying the target replay protection sequence number.

[0042] In the embodiment, a replay protection window is configured at the receiving end. The replay protection window is a window of a preset length. If the replay protection sequence number carried in the data message received at the receiving end is not within the range of the replay protection window, the data message can be directly discarded. The center value of the replay protection window is the replay protection sequence number received at the receiving end and having the largest value within the range of the replay protection window. The preset length of the replay protection window indicates the range of the replay protection window.

[0043] In the embodiment, the center value of the replay protection window can be changed along with the replay protection sequence number carried in the received data message, and the entire replay protection window can also be moved. Specifically, if the replay protection sequence number carried in the received data message is within the range of the current replay protection window and the replay protection sequence number is greater than the center value of the replay protection window, the replay protection sequence number can be taken as the center value of the new replay protection window, and the range of the replay protection window is updated according to the preset length of the window.

[0044] As an example, if the center value of the current replay protection window is 10 and the preset length of the window is 5x2, the range of the replay protection window is 5 to 15. If the receiving end receives a data message carrying a replay protection sequence number 12, at this time, 12 is within the range of the replay protection window 5 to 15, and 12 is the largest replay protection sequence number received within the range of the replay protection window. At this time, 12 is determined as the center value of the new replay protection window, and the range of the replay protection window is also adjusted to 7 to 17. The updating process of the center value of the replay protection window will be described in detail below, and will not be described here.

[0045] In the embodiment, the replay protection window can also have a loop, that is, it loops back to 0 after reaching the maximum value of the unsigned integer. Taking a 32-bit computer as an example, the maximum value of int is 2^32, that is, 4294967296, which is equivalent to 0 in the computer. Therefore, the maximum value of the unsigned integer is 4294967295. For example, if the center value of the current replay protection window is 10 and the preset length of the replay protection window is 200x2 (=400), the range of the replay protection window is 4294967106 to 4294967295, and 0 to 210 (that is, 4294967106 to 4294967295 and 0 to 9 are 200 values centered on the center value 10 of the replay protection window, and 11 to 210 are 200 values centered on the center value 10 of the replay protection window).

[0046] The replay protection window will be briefly introduced below in combination with FIG. 2.

[0047] Please refer to FIG. 2, which is a schematic diagram of the range of the replay protection window provided in the embodiment of the present application.

[0048] As shown in FIG. 2, the anti-replay sequence number in the embodiment can be continuously increased from 0 to 2^32-1, i.e. 4294967295, and then looped back to 0.

[0049] In the embodiment, the center value of the anti-replay window is 399, and the preset length of the window is 200x 2, i.e. the range of the anti-replay window is 199 to 599.

[0050] For example, if the anti-replay sequence number carried in the received data packet is not within the range of 199 to 599, such as 150, the data packet can be directly discarded.

[0051] In the embodiment, the setting of the anti-replay window can directly filter the data packets not within the range of the anti-replay window, and the setting of the anti-replay window can also be used to prevent replay attacks. The anti-replay sequence number carried in the data packet can be used to detect and prevent the attacker from resending or sending messages in different orders.

[0052] When the receiving end receives the data packet sent by the sending end, it checks whether the initial anti-replay sequence number carried in the received data packet is within the range of the anti-replay window. For example, if the preset length of the anti-replay window is 200x 2, and the anti-replay sequence number carried in the expected next data packet is 600, it indicates that the current anti-replay window is 399 to 799 (inclusive), and the center value of the anti-replay window is 599.

[0053] In this case, if the attacker attempts to resend the data packet that has been received by the receiving end (such as the data packet carrying an anti-replay sequence number less than 399), such attempts will be identified and intercepted, preventing replay attacks. However, if the attacker resends a data packet carrying an anti-replay sequence number within the range of the anti-replay window, i.e. 399 to 599, the data packet will not be directly discarded.

[0054] In this regard, the embodiment of the present application proposes a method for detecting the anti-replay sequence number within the range of the anti-replay window.

[0055] As an embodiment, if the initial anti-replay sequence number is within the range of the anti-replay window and the initial anti-replay sequence number is less than the center value of the anti-replay window, the check code corresponding to the initial anti-replay sequence number in the anti-replay list corresponding to the anti-replay window is obtained; if the check code is the first value, the data packet is processed and the check code is updated to the second value; if the check code is the second value, the data packet is discarded. The anti-replay list records all anti-replay sequence numbers within the range of the anti-replay window and the check codes corresponding to the anti-replay sequence numbers, and the check code includes the first value and the second value, the first value indicating that the data packet carrying the anti-replay sequence number has not been processed, and the second value indicating that the data packet carrying the anti-replay sequence number has been processed.

[0056] In the embodiment, the receiving end also maintains an anti-replay list corresponding to the anti-replay window, and the anti-replay list records all anti-replay sequence numbers within the range of the anti-replay window and the check codes corresponding to the anti-replay sequence numbers. The check code being the first value indicates that the data packet carrying the anti-replay sequence number has not been processed, i.e., the data packet carrying the anti-replay sequence number has not been received, and the check code being the second value indicates that the data packet carrying the anti-replay sequence number has been processed, i.e., the data packet carrying the anti-replay sequence number has been received and processed by the receiving end.

[0057] It is easy to understand that, after determining that the check code corresponding to any anti-replay sequence number is the second value, if the data packet carrying the anti-replay sequence number is received again, it indicates that the data packet is a replay attack by an attacker, and the data packet can be discarded directly.

[0058] In the embodiment, if the initial anti-replay sequence number carried by the received data packet is within the range of the anti-replay window of the receiving end and the initial anti-replay sequence number is less than the center value of the anti-replay window, it indicates that the center value of the anti-replay window will not be updated according to the initial anti-replay sequence number. In this case, the check code corresponding to the initial anti-replay sequence number in the anti-replay list corresponding to the anti-replay window can be obtained.

[0059] After obtaining the check code corresponding to the initial anti-replay sequence number, if it is determined that the check code is the first value, it indicates that the data packet carrying the initial anti-replay sequence number has not been processed, and the data packet can be processed and the check code corresponding to the initial anti-replay sequence number is updated to the second value. If it is determined that the check code is the second value, it indicates that the data packet carrying the initial anti-replay sequence number has been received and processed, and the data packet is considered to be a replay attack by an attacker and is discarded directly.

[0060] As an embodiment, if the initial anti-replay sequence number is within the range of the anti-replay window and the initial anti-replay sequence number is greater than the center value of the anti-replay window, the initial anti-replay sequence number is taken as the center value of the anti-replay window, the range of the anti-replay window is updated, and the data packet is processed; and the check code corresponding to the initial anti-replay sequence number in the anti-replay list corresponding to the anti-replay window is updated to the second value.

[0061] In the embodiment, if the initial anti-replay sequence number carried by the received data packet is within the range of the anti-replay window at the receiving end and the initial anti-replay sequence number is greater than the center value of the anti-replay window, it is indicated that the center value of the anti-replay window will be updated according to the initial anti-replay sequence number. In this case, the initial anti-replay sequence number can be taken as the center value of the new anti-replay window, the range of the anti-replay window is updated, and the data packet is processed.

[0062] It is easy to understand that if the initial anti-replay sequence number carried by the received data packet is within the range of the anti-replay window at the receiving end and the initial anti-replay sequence number is greater than the center value of the anti-replay window, the check code corresponding to the initial anti-replay sequence number in the anti-replay list must be the first value. Because: if the initial anti-replay sequence number has been received before and the initial anti-replay sequence number is within the range of the anti-replay window, the center value of the anti-replay window will be updated to the initial anti-replay sequence number and the range of the anti-replay window will be updated when the initial anti-replay sequence number is received for the first time, but the center value of the current anti-replay window is less than the initial anti-replay sequence number, which indicates that the data packet carrying the initial anti-replay sequence number has not been received before, or the data packet carrying the initial anti-replay sequence number is not within the range of the anti-replay window at that time. It can be seen that no matter which case, the check code corresponding to the initial anti-replay sequence number must be the first value.

[0063] In the embodiment, the range of the anti-replay window is updated, and the anti-replay list corresponding to the anti-replay window maintained by the receiving end is also updated, and the updated anti-replay list records all the anti-replay sequence numbers within the range of the new anti-replay window and the check codes corresponding to the anti-replay sequence numbers.

[0064] Meanwhile, the check code corresponding to the initial anti-replay sequence number, i.e. the center value of the current anti-replay window, in the anti-replay list is also updated to the second value.

[0065] The anti-replay list will be briefly introduced below in combination with FIG. 3.

[0066] Please refer to FIG. 3, which is an anti-replay list diagram provided by the embodiment of the present application.

[0067] As shown in FIG. 3, corresponding to the anti-replay window range in FIG. 2, the anti-replay list in FIG. 3 corresponds to the range of the anti-replay window with the anti-replay sequence numbers from 199 to 599, and the center value of the anti-replay window is 399. The anti-replay list includes two rows, the first row records all the anti-replay sequence numbers included in the corresponding anti-replay window range, and the second row records the check code corresponding to each anti-replay sequence number. In this embodiment, the first value is 0, and the second value is 1.

[0068] For example, if the anti-replay sequence number carried by the data message received at this time is 180, the anti-replay sequence number is not in the range of the anti-replay window, and the data message is directly discarded.

[0069] For example, if the anti-replay sequence number carried by the data message received at this time is 201, the anti-replay sequence number is in the range of the anti-replay window, and is less than the center value 399 of the anti-replay window, at this time, the check code corresponding to the anti-replay sequence number can be obtained from the anti-replay list, the check code is 0, indicating that the data message carrying the anti-replay sequence number 201 has not been received and processed, at this time, the data message can be processed, and the check code corresponding to the anti-replay sequence number 201 is updated to 1.

[0070] For example, if the anti-replay sequence number carried by the data message received at this time is 202, the anti-replay sequence number is in the range of the anti-replay window, and is less than the center value 399 of the anti-replay window, at this time, the check code corresponding to the anti-replay sequence number can be obtained from the anti-replay list, the check code is 1, indicating that the data message carrying the anti-replay sequence number 201 has been received and processed, at this time, the data message can be directly discarded.

[0071] For example, if the anti-replay sequence number carried by the data message received at this time is 400, the anti-replay sequence number is in the range of the anti-replay window, and is greater than the center value 399 of the anti-replay window, at this time, the value of the center value of the anti-replay window can be updated to 400, the range of the anti-replay window and the anti-replay list are updated, the data message is processed, and the check code corresponding to 400 in the anti-replay list is updated to 1.

[0072] In an embodiment, the encrypted self-recovery data packet is sent to the sending end, the self-recovery data packet includes a target anti-replay sequence number, so that the sending end decrypts the self-recovery data packet after receiving the self-recovery data packet, parses the target anti-replay sequence number from the self-recovery data packet, and re-sends the data message carrying the target anti-replay sequence number.

[0073] The target anti-replay sequence number is determined based on the center value of the anti-replay window.

[0074] In this embodiment, due to some factors such as network problems, system restart or misoperation, the sending end can lose the order of the anti-replay sequence numbers, and has started to send the anti-replay sequence numbers from zero. If this problem is not handled, according to the anti-replay method described above, the receiving end will incorrectly mark the new data packet as a data packet that has been received, and determine it as a replay attack and discard the data packet.

[0075] To solve this problem, the present application introduces an anti-replay self-recovery mechanism so that the receiving end can require the sending end to re-synchronize its anti-replay sequence numbers.

[0076] As an embodiment, if the initial anti-replay sequence number carried by the received data packet is not within the anti-replay window range of the receiving end, the receiving end considers that the sending end can have lost the order of the anti-replay sequence numbers, at which time the data packet can be discarded, and an encrypted self-recovery data packet is sent to the sending end of the data packet, the self-recovery data packet including a target anti-replay sequence number, the target anti-replay sequence number being determined according to the center value of the anti-replay window.

[0077] In this embodiment, the target anti-replay sequence number is actually the anti-replay sequence number expected to be received by the receiving end. After receiving the self-recovery data packet, the sending end decrypts the self-recovery data packet, parses the target anti-replay sequence number from the self-recovery data packet, and re-sends the data packet carrying the target anti-replay sequence number, to avoid misidentifying the normal data packet as a replay attack.

[0078] It should be noted that, whether the data packet received by the receiving end is a replay attack sent by an attacker or a normal data packet sent by the sending end, as long as the initial anti-replay sequence number carried by the data packet is not within the anti-replay window range of the receiving end, the data packet will be discarded and an encrypted self-recovery data packet will be sent to the sending end of the data packet.

[0079] If the sending end of the data packet is an attacker, the attacker cannot decrypt the self-recovery data packet, and thus cannot obtain the target anti-replay sequence number. If the sending end of the data packet is a normal sending end, the sending end has a decryption method stored locally, and can decrypt the self-recovery data packet to determine the target anti-replay sequence number.

[0080] The anti-replay method when the sending end is unexpectedly restarted is described below with reference to FIG. 4.

[0081] Referring to FIG. 4, FIG. 4 is an anti-replay method interaction diagram provided by an embodiment of the present application.

[0082] As shown in FIG. 4, if the sending end unexpectedly restarts after sending the data message carrying the anti-replay sequence number 398 to the receiving end, the anti-replay sequence number (denoted as seq in FIG. 4) of the sending end is re-sequentially set from 0, and the anti-replay window range of the receiving end still stays from 98 to 598 (the center value of the anti-replay window is 398). It is easy to understand that the first 98 messages sent by the sending end from the anti-replay sequence number 0 to the anti-replay sequence number 98 are all out of the anti-replay window range, and the first 98 messages will all be abnormally sent and discarded by the receiving end.

[0083] In the embodiment, when the receiving end receives the data message carrying the anti-replay sequence number 0 sent by the restarted sending end, the receiving end discards the data message and sends the target anti-replay sequence number 399 recorded by the receiving end in the normal communication to the sending end, and the sending end can use the target anti-replay sequence number to resend the data message for communication.

[0084] In the embodiment, if the receiving end loses the record of the anti-replay sequence number, for example, in the case of a restart of the receiving end, the center value of the anti-replay window of the receiving end is reset to 0, and the anti-replay window range is updated to 4294967096 to 4294967295 and 0 to 200. If the data message carrying the normal anti-replay sequence number such as 399 sent by the sending end is received, the data message is discarded, and the target anti-replay sequence number 1 recorded by the receiving end is sent to the sending end, and the sending end can use the target anti-replay sequence number 1 to resend the data message for communication.

[0085] Thus far, the description of step 102 is ended.

[0086] In the embodiment, the receiving end maintains a plurality of anti-replay windows corresponding to different sending ends, and the different anti-replay windows are configured with different service identifiers. Each sending end locally maintains the service identifier of the anti-replay window corresponding to the service of the sending end. The data message sent by the receiving sending end can include: in the case of receiving the data message, determining the sending end sending the data message and the range of the corresponding anti-replay window on the receiving end based on the service identifier carried in the data message.

[0087] In the embodiment, when there are multiple-link communications or different services for a single device, different anti-replay sequence numbers are used, and a separate sequence number is maintained for each communication link or separate service. The sequence number is incremented each time a data packet is sent. The receiving end maintains multiple different anti-replay windows based on different services, and the different anti-replay windows correspond to different anti-replay sequence number queues. When a data packet sent by the sending end is received, the anti-replay window corresponding to the sending end and the corresponding anti-replay sequence number queue can be determined based on the service identifier carried in the data packet, and the method of steps 101 to 102 is performed in the corresponding anti-replay sequence number queue.

[0088] As shown in FIG. 5A, device A is a low-power device, which has a CPU, a WIFI module, an MCU, and other modules. In the case where the CPU of the low-power device A enters a sleep state, the WIFI module can independently interact with the CPU of device B shown in FIG. 5B. In this case, if the WIFI module and the CPU in the low-power device A shown in FIG. 5A use the same set of anti-replay sequence numbers, it will be difficult to maintain and easy to cause confusion.

[0089] In the present scheme, the WIFI module and the CPU of device A each have a separate set of anti-replay sequence numbers when communicating with device B, but the anti-replay mechanism at the device B end is unified, and device B only stores two sets of anti-replay data for device A. This model greatly improves the communication security of low-power devices.

[0090] Thus far, the description of the flow of the anti-replay method in FIG. 1 is complete.

[0091] In the case where the anti-replay sequence number of the received data packet is not within the anti-replay window at the receiving end, it indicates that the sending end may have an abnormality and cannot know the current anti-replay sequence number to be sent. At this time, the receiving end directly discards the data packet and sends an encrypted self-recovery data packet to the sending end. The self-recovery data packet carries a target anti-replay sequence number, so that the sending end, after receiving the self-recovery data packet, decrypts the self-recovery data packet to obtain the target anti-replay sequence number, and re-sends a data packet carrying the target anti-replay sequence number to the receiving end. Through the above method, the sending end of the data packet is sent an encrypted self-recovery data packet. If the sending end can successfully decrypt, it indicates that the sending end is a normal sending end, not a replay attack, thereby effectively avoiding the misidentification of a replay attack.

[0092] Further, the application further provides a composite anti-replay method. In the case that multiple links exist in a single device, anti-replay protection can be performed for different links or different services respectively, and a set of anti-replay sequence numbers is maintained for each link or service, thereby ensuring the communication security of the multi-link or multi-service device.

[0093] Please refer to FIG. 6, which is a flow chart of another anti-replay method provided by the embodiments of the application, and the method is applied to a sending end.

[0094] As shown in FIG. 6, the method comprises steps 601 to 602.

[0095] In step 601, a data packet is sent to a receiving end, and the data packet carries an initial anti-replay sequence number, so that the receiving end can parse the initial anti-replay sequence number from the data packet after receiving the data packet.

[0096] In step 602, in the case that an encrypted self-recovery data packet sent by the receiving end is received, a target anti-replay sequence number is determined based on the self-recovery data packet, the data packet carrying the initial anti-replay sequence number that has been sent is updated to carry the target anti-replay sequence number, and the data packet carrying the target anti-replay sequence number after the update is re-sent to the receiving end.

[0097] According to an embodiment, the sending end determines the target anti-replay sequence number based on the self-recovery data packet, which comprises decrypting the self-recovery data packet and parsing the target anti-replay sequence number from the self-recovery data packet.

[0098] The method provided by FIG. 6 has been described above, and thus will not be described here.

[0099] Please refer to FIG. 7, which is a schematic structural diagram of an electronic device 700 provided by the embodiments of the application. In the hardware layer, the electronic device 700 comprises a processor 701, an internal bus 705, a network interface 702, a memory 703, a non-volatile memory 704, and of course, other hardware required by services. The processor 701 reads the corresponding computer program from the non-volatile memory 704 to the memory 703 and then runs, and forms a terminal interactive device in the logic layer. Of course, in addition to the software implementation, the application does not exclude other implementation manners, such as logic devices or the combination of software and hardware, and so on, that is, the execution subject of the following processing flow is not limited to the logical units, but can also be hardware or logic devices.

[0100] Please refer to FIG. 8, which is a structural diagram of an anti-replay device 800 provided by the embodiments of the application, and the device is applied to a receiving end. As shown in FIG. 8, the anti-replay device can comprise a receiving unit 801, a processing unit 802, and a sending unit 803.

[0101] The receiving unit 801 is configured to receive a data packet sent by a sending end, and parse an initial anti-replay sequence number from the data packet.

[0102] The processing unit 802 is configured to discard the data packet if the initial anti-replay sequence number is not within a range of an anti-replay window of the receiving end. The anti-replay window is a window with a preset length, and a center value of the anti-replay window is a maximum anti-replay sequence number that has been received within the range of the anti-replay window.

[0103] The sending unit 803 is configured to send an encrypted self-recovery data packet to the sending end. The self-recovery data packet includes a target anti-replay sequence number determined based on the center value of the anti-replay window, so that the sending end can resend the data packet based on the target anti-replay sequence number after receiving the self-recovery data packet. According to an embodiment, the sending end decrypts the self-recovery data packet after receiving the self-recovery data packet, parses the target anti-replay sequence number from the self-recovery data packet, and resends the data packet carrying the target anti-replay sequence number.

[0104] According to an embodiment, the processing unit 802 is further configured to: if the initial anti-replay sequence number is within the range of the anti-replay window and greater than the center value of the anti-replay window, update the center value of the anti-replay window as the initial anti-replay sequence number, update the range of the anti-replay window, and process the data packet; and update a check code corresponding to the initial anti-replay sequence number in an anti-replay list corresponding to the anti-replay window as a second value. The anti-replay list records all anti-replay sequence numbers within the range of the anti-replay window and check codes corresponding to the anti-replay sequence numbers. The check codes include a first value and a second value. The first value indicates that the data packet carrying the anti-replay sequence number has not been processed, and the second value indicates that the data packet carrying the anti-replay sequence number has been processed.

[0105] According to an embodiment, the processing unit 802 is further configured to: if the initial anti-replay sequence number is within the range of the anti-replay window and less than the center value of the anti-replay window, obtain a check code corresponding to the initial anti-replay sequence number in an anti-replay list corresponding to the anti-replay window; if the check code is the first value, process the data packet and update the check code as the second value; and if the check code is the second value, discard the data packet. The anti-replay list records all anti-replay sequence numbers within the range of the anti-replay window and check codes corresponding to the anti-replay sequence numbers. The check codes include a first value and a second value. The first value indicates that the data packet carrying the anti-replay sequence number has not been processed, and the second value indicates that the data packet carrying the anti-replay sequence number has been processed.

[0106] According to an embodiment, the receiving end maintains a plurality of anti-replay windows corresponding to different sending ends, and the different anti-replay windows are configured with different service identifiers, and each sending end locally maintains a service identifier of an anti-replay window corresponding to the service of the sending end. The receiving unit 801 is further configured to, in a case where a data packet is received, determine a sending end sending the data packet and a range of a corresponding anti-replay window on the receiving end based on a service identifier carried in the data packet.

[0107] So far, the description of the anti-replay device in FIG. 8 is completed.

[0108] Please refer to FIG. 9, which is a structural diagram of another anti-replay device 900 provided by the embodiments of the present application, and the device is applied to a sending end. As shown in FIG. 9, the anti-replay device can include a sending unit 901, a decryption unit 902, and a retransmission unit 903.

[0109] The sending unit 901 is configured to send a data packet to a receiving end, and the data packet carries an initial anti-replay sequence number, so that the receiving end parses the initial anti-replay sequence number from the data packet after receiving the data packet.

[0110] The decryption unit 902 is configured to, in a case where an encrypted self-recovery data packet sent by the receiving end is received, determine a target anti-replay sequence number based on the self-recovery data packet.

[0111] The retransmission unit 903 is configured to update the sent data packet carrying the initial anti-replay sequence number to a data packet carrying the target anti-replay sequence number, and retransmit the updated data packet carrying the target anti-replay sequence number to the receiving end.

[0112] In an embodiment, the decryption unit is further configured to decrypt the self-recovery data packet and parse the target anti-replay sequence number from the self-recovery data packet.

[0113] So far, the description of the anti-replay device in FIG. 9 is completed.

[0114] Correspondingly, in the present embodiment, the embodiments of the present application further provide a computer readable storage medium, and the computer readable storage medium stores a plurality of computer instructions, and the computer instructions can implement the method disclosed in the above examples of the present application when executed.

[0115] Exemplarily, the computer readable storage medium described above can be any electronic, magnetic, optical, or other physical storage apparatus, and can contain or store information such as executable instructions, data, and the like. For example, the computer readable storage medium can be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard drive), a solid state drive, any type of storage disk (such as an optical disk, a DVD, and the like), or similar storage medium, or a combination thereof.

[0116] The preferred embodiments of the present application have been described above with the aid of a number of drawings. These embodiments are illustrative only, and there can be other embodiments which do not depart from the spirit and essence of the application. It should be understood that various modifications and changes can be aimed at generalizing the concepts of the application and can be executed by those skilled in the art. Any modification, equivalent replacement, improvement, and the like within the spirit and principle of the present application shall be included in the scope of the present application.

Claims

1. A method for preventing replay, applied at a receiving end, the method comprising: Receive data packets sent by the sending end, and parse the initial anti-replay sequence number from the data packets; If the initial anti-replay sequence number is not within the range of the anti-replay window at the receiving end, then Discard the data packet, and Send encrypted self-recovering data packets to the sending end. Wherein, the anti-replay window is a window of a preset length, and The self-recovery data packet includes a target anti-replay sequence number determined based on the center value of the anti-replay window, so that the sending end can resend the data packet based on the target anti-replay sequence number after receiving the self-recovery data packet.

2. The method according to claim 1, characterized in that, The method further includes: If the initial anti-replay sequence number is within the range of the anti-replay window, and the initial anti-replay sequence number is greater than the center value of the anti-replay window, then The initial anti-replay sequence number is used as the center value of the anti-replay window, the range of the anti-replay window is updated, and the data packet is processed. Update the check code corresponding to the initial anti-replay serial number in the anti-replay list corresponding to the anti-replay window to the second value; The anti-replay list records all anti-replay serial numbers included within the scope of the anti-replay window, as well as the checksum corresponding to each anti-replay serial number. The checksum includes a first value and a second value. The first value indicates that the data packet carrying the anti-replay serial number has not been processed, and the second value indicates that the data packet carrying the anti-replay serial number has been processed.

3. The method according to claim 1, characterized in that, The method further includes: If the initial anti-replay sequence number is within the range of the anti-replay window, and the initial anti-replay sequence number is less than the center value of the anti-replay window, then Obtain the check code corresponding to the initial anti-replay sequence number in the anti-replay list corresponding to the anti-replay window; If the checksum is the first value, then the data packet is processed and the checksum is updated to the second value; If the checksum is the second value, then the data packet is discarded; The anti-replay list records all anti-replay serial numbers included within the scope of the anti-replay window, as well as the checksum corresponding to each anti-replay serial number. The checksum includes a first value and a second value. The first value indicates that the data packet carrying the anti-replay serial number has not been processed, and the second value indicates that the data packet carrying the anti-replay serial number has been processed.

4. The method according to claim 1, characterized in that, The receiving end maintains multiple anti-replay windows corresponding to different sending ends. Different anti-replay windows are configured with different service identifiers. Each sending end locally maintains the service identifier of the anti-replay window corresponding to the service of that sending end. The data packets sent by the receiving and sending end include: Upon receiving a data packet, the sending end that sent the data packet and the range of the corresponding anti-replay window on the receiving end are determined based on the service identifier carried in the data packet.

5. The method according to claim 1, characterized in that, After receiving the self-recovery data packet, the sending end can resend the data packet based on the target anti-replay sequence number, specifically including: Decrypt the self-recovery data packet. The target anti-replay sequence number is parsed from the self-recovery data packet, and Resend the data packet carrying the target anti-replay sequence number.

6. A method for preventing replay, characterized in that, This method is applied to the sending end, and includes: Send a data packet to the receiving end, the data packet carrying an initial anti-replay sequence number, so that the receiving end can parse the initial anti-replay sequence number from the data packet after receiving it; Upon receiving the encrypted self-recovering data packet sent by the receiving end, Based on the self-recovery data packet, the target anti-replay sequence number is determined; Update the previously sent data packet carrying the initial anti-replay sequence number to one carrying the target anti-replay sequence number, and The updated data packet carrying the target anti-replay sequence number is resent to the receiving end.

7. The method according to claim 6, characterized in that, Based on the self-recovery data packet, determining the target anti-replay sequence number includes: Decrypt the self-recovery data packet, and The target anti-replay serial number is parsed from the self-recovery data packet.

8. A device for preventing replay, characterized in that, This device is used at the receiving end and includes: The receiving unit is used to receive data packets sent by the sending end and parse the initial anti-replay sequence number from the data packets; The processing unit is configured to discard the data packet if the initial anti-replay sequence number is not within the anti-replay window range of the receiving end; wherein the anti-replay window is a window of a preset length. The sending unit is configured to send an encrypted self-recovery data packet to the sending end, wherein the self-recovery data packet includes a target anti-replay sequence number determined based on the center value of the anti-replay window, so that the sending end can resend the data packet based on the target anti-replay sequence number after receiving the self-recovery data packet.

9. The apparatus according to claim 8, characterized in that, The processing unit is also used for: If the initial anti-replay sequence number is within the range of the anti-replay window, and the initial anti-replay sequence number is greater than the center value of the anti-replay window, then The initial anti-replay sequence number is used as the center value of the anti-replay window, the range of the anti-replay window is updated, and the data packet is processed. Update the check code corresponding to the initial anti-replay serial number in the anti-replay list corresponding to the anti-replay window to the second value; The anti-replay list records all anti-replay serial numbers included within the scope of the anti-replay window, as well as the checksum corresponding to each anti-replay serial number. The checksum includes a first value and a second value. The first value indicates that the data packet carrying the anti-replay serial number has not been processed, and the second value indicates that the data packet carrying the anti-replay serial number has been processed.

10. The apparatus according to claim 8, characterized in that, The processing unit is also used for: If the initial anti-replay sequence number is within the range of the anti-replay window, and the initial anti-replay sequence number is less than the center value of the anti-replay window, then Obtain the check code corresponding to the initial anti-replay sequence number in the anti-replay list corresponding to the anti-replay window; If the checksum is the first value, then the data packet is processed and the checksum is updated to the second value; If the checksum is the second value, then the data packet is discarded; The anti-replay list records all anti-replay serial numbers included within the scope of the anti-replay window, as well as the checksum corresponding to each anti-replay serial number. The checksum includes a first value and a second value. The first value indicates that the data packet carrying the anti-replay serial number has not been processed, and the second value indicates that the data packet carrying the anti-replay serial number has been processed.

11. The apparatus according to claim 8, characterized in that, The receiving end maintains multiple anti-replay windows corresponding to different sending ends. Different anti-replay windows are configured with different service identifiers. Each sending end locally maintains the service identifier of the anti-replay window corresponding to its service. The receiving unit is further configured to: Upon receiving a data packet, the sending end that sent the data packet and the range of the corresponding anti-replay window on the receiving end are determined based on the service identifier carried in the data packet.

12. The apparatus according to claim 8, characterized in that, After receiving the self-recovery data packet, the sending end can resend the data packet based on the target anti-replay sequence number, specifically including: Decrypt the self-recovery data packet. The target anti-replay sequence number is parsed from the self-recovery data packet, and Resend the data packet carrying the target anti-replay sequence number.

13. A device for preventing replay, characterized in that, This device is used at the transmitting end and includes: The sending unit is used to send a data packet to the receiving end, the data packet carrying an initial anti-replay sequence number, so that the receiving end can parse the initial anti-replay sequence number from the data packet after receiving it. The decryption unit is used to determine the target anti-replay sequence number based on the encrypted self-recovery data packet sent by the receiving end. The retransmission unit is used to update the previously sent data packet carrying the initial anti-replay sequence number to carry the target anti-replay sequence number, and retransmit the updated data packet carrying the target anti-replay sequence number to the receiving end.

14. The anti-replay device according to claim 13, characterized in that, The decryption unit is also used for: Decrypt the self-recovery data packet, and The target anti-replay serial number is parsed from the self-recovery data packet.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 7.

16. A computer-readable storage medium storing a plurality of computer instructions, characterized in that, When the computer instructions are executed, they implement the method of any one of claims 1 to 7.

Images