Cluster Node Sequence Number Adjustment for Replay Attack Prevention

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Network clusters are vulnerable to replay attacks and packet tampering, which can impact cluster functionality and security, as existing methods do not effectively prevent these malicious attacks.

Innovation Solution

The implementation of unique sequence numbers generated based on previous communications and node events, adjusted by delta values corresponding to average communication frequencies, are included in packets to prevent replay attacks. These sequence numbers are verified by receiving nodes using hash-based message authentication codes to ensure packet integrity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If sequence numbers are used to prevent replay attacks, then security against malicious attacks is improved, but device complexity increases due to sequence number generation and verification mechanisms

Engineering Contradiction:
Improvesecurity against replay attacksVSAvoidcomplexity of sequence number generation and verification
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system pre-generates sequence numbers and stores them in a sequence number pool before they are needed for communication. This preliminary preparation allows the system to quickly assign sequence numbers without complex real-time generation, reducing the computational burden during actual packet transmission and verification

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

A dedicated sequence number management component acts as an intermediary between the packet transmission system and the sequence number storage. This component handles the complex tasks of sequence number generation, validation, and pool management, isolating the complexity from the main communication protocol and making the system more modular and manageable

Inventive Principle:
Principle #24Intermediary (Mediator)

2Adaptability or versatility

If delta values based on communication frequency are used to adjust sequence numbers, then adaptability to varying communication rates is improved, but measurement precision requirements increase to accurately determine average communication frequency

Engineering Contradiction:
Improveadaptability to communication frequency changesVSAvoidprecision in measuring average communication frequency
Core Design Contradiction:
Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The system automatically monitors its own communication patterns and calculates the average communication frequency based on historical data from its previous transmissions and receptions. This self-measurement approach eliminates the need for external precision measurement tools, as the system uses its own operational history to determine appropriate delta values for sequence number adjustment

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

Instead of requiring precise measurement of every single communication event, the system uses a simplified averaging approach that considers only the essential communication frequency trends. This partial measurement strategy provides sufficient adaptability for most scenarios without demanding extreme measurement precision, balancing accuracy with implementation simplicity

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP4046356B1Systems and methods for preventing replay attacks
Publication Date: 2023.09.20 CITRIX SYSTEMS INC
  • EP4046356B1 patent drawingFigure 1A
  • EP4046356B1 patent drawingFigure 1B
  • EP4046356B1 patent drawingFigure 1C

AI summary

Disclosed herein includes a system, a method, and a device for preventing replay attacks in a cluster. A first node in the cluster having a plurality of nodes can receive an indication of a node event. The first node can access a first sequence number from a storage corresponding to a previous communication between the plurality of nodes. The first node can adjust the first sequence number by a delta indicative of an average number of communications between the plurality of nodes in the cluster in a determined time period to generate a second sequence number. The first node can transmit a packet including the second sequence number to the plurality of nodes in the cluster. The second sequence number can be used by the plurality of nodes to reset a starting sequence number for communications between the plurality of nodes to prevent replay attacks in the cluster.