Message Integrity Verification via Random Sampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security protocols, such as IPsec and MACsec, require substantial processing power for integrity checks, necessitating costly hardware accelerators, which increases development effort and power consumption, especially when handling high-speed message transmission.
Innovation Solution
A method that stores a portion of received messages and sends an integrity check message to the sender node, allowing for comparison of the message portions, reducing processing power requirements and enabling detection of tampering or attacks without generating ICVs for each message, with the probability of detection increasing with the number of tampered messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ICV is generated for each message using traditional security protocols, then message integrity and authentication are ensured, but processing power requirements increase substantially
Solution Approach 1:
The patent applies partial action by performing integrity verification on only a portion of messages rather than all messages. The receiver node selects a subset of received messages for verification by sending integrity check messages requesting specific message portions, thereby reducing the overall processing load while maintaining security for the sampled messages.
Solution Approach 2:
The patent uses preliminary action by having the receiver node pre-select which messages will be verified and send integrity check messages in advance. This allows the sender node to prepare verification data beforehand, and enables asynchronous verification that does not block the main message processing flow, thus reducing processing power requirements during high-speed transmission.
2Productivity
If hardware accelerators are implemented for ICV generation, then high-speed message transmission is enabled, but device cost and development effort increase
Solution Approach 1:
The patent uses copying by having the sender node store copies of transmitted messages in a buffer or log. When the receiver requests verification of a specific message, the sender retrieves the stored copy and generates verification data without needing to re-process the original message, enabling fast verification using software rather than dedicated hardware accelerators.
Solution Approach 2:
The patent makes the sender and receiver nodes universal by enabling them to perform both message transmission and integrity verification functions using the same general-purpose processing units. The verification mechanism works for any message type and can be dynamically adjusted, eliminating the need for specialized hardware accelerators while maintaining high-speed capability through efficient software implementation.
3Reliability
If random message selection for verification is implemented, then attacker prediction is prevented, but message storage requirements increase
Solution Approach 1:
The patent applies segmentation by dividing messages into manageable portions for storage and verification. Instead of storing complete high-speed message streams, the system stores segmented portions or extracts of messages that are sufficient for verification purposes. This reduces storage requirements while maintaining the ability to detect attacks through random sampling of message segments.
Data Source
AI summary
The present invention provides a method and apparatus for detecting that an attacker has sent one or more messages to a receiver node. The method comprises storing at least a portion of an nth message received by the receiver node from a sender node in a memory device; sending an integrity check message to the sender node comprising an indication of the value of n; receiving a reply message from the sender node including at least a portion of the nth message sent by the sender node to the receiver node; and comparing the at least a portion of the nth message sent by the sender node to the receiver node with the nth message received by the receiver node from the sender node stored in the memory device.