Packet Verification Using Time Factors and Sequence Windows

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing message verification methods for defending against replay attacks are ineffective due to high synchronization requirements for timestamps, vulnerability to serial number decryption, and significant storage overhead for random numbers, leading to increased false positives and security risks.

Innovation Solution

A dual verification method using a time authentication factor and sequence number is employed, where a time authentication factor is generated based on local timestamps and a time difference, and a check code is generated using a terminal key and/or sequence number, with verification conducted by a network device to ensure freshness and uniqueness of data packets.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If timestamp-based message verification is used, then freshness can be verified, but high synchronization requirements between authentication parties are imposed

Engineering Contradiction:

Improvefreshness verificationVSAvoidtime synchronization requirement

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The verification mechanism is segmented into two independent components: timestamp-based freshness verification and sequence number-based ordering verification. Each component handles a specific aspect of replay attack prevention independently, allowing the system to tolerate time desynchronization while maintaining security through the sequence number window mechanism.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A sequence number window acts as an intermediary mechanism between the timestamp verification and the actual message acceptance. The window provides a tolerance range that mediates between strict timestamp synchronization requirements and the need for reliable replay prevention, allowing messages within the time window and sequence range to be accepted without requiring precise synchronization.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If serial number-based message verification is used, then time synchronization is not required, but false positive rate increases when non-continuous serial numbers are received

Engineering Contradiction:

Improveno time synchronization requiredVSAvoidfalse positive rate

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The sequence number verification mechanism is made dynamic by introducing a configurable window range rather than requiring strict continuity. The window minimum and maximum values create a flexible verification range that adapts to network conditions, allowing non-continuous sequence numbers within the acceptable range while maintaining security against replay attacks.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The verification parameters are changed from strict sequence number continuity to a window-based range check. By defining a window minimum and maximum sequence number range, the system can accept sequence numbers that are not strictly continuous while still preventing replay attacks, thereby reducing false positives.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If random number-based message verification is used, then replay attacks can be detected, but significant storage overhead is required for storing and querying used random numbers

Engineering Contradiction:

Improvereplay attack detectionVSAvoidstorage overhead

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

Instead of storing used random numbers for extended periods, the system uses sequence numbers that are incremented and discarded after use. The sequence number window mechanism allows the system to track used numbers within a limited range without requiring long-term storage, effectively treating verification data as short-lived and disposable.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Solution Approach 2:

The system discards old sequence numbers outside the current window range rather than retaining them for future reference. By defining a sliding window that moves with each successful authentication, the system recovers from the need for permanent storage by allowing sequence numbers to be discarded after they fall out of the acceptable range.

Inventive Principle:

Principle #34Discarding and recovering

Data Source

PatentUS20250385804A1Verification method, terminal device, network device and medium

Publication Date: 2025.12.18 ZTE CORP

AI summary

Provided are a verification method, a terminal device, a network device and a medium. The verification method includes the following: A time authentication factor is generated based on a first terminal timestamp and a time difference, where the first terminal timestamp is a local timestamp of the terminal device when generating the time authentication factor, and the time difference is the difference between a second terminal timestamp and a first system timestamp. A first check code is generated based on an acquired terminal key and at least one of the time authentication factor or a sequence number. A to-be-verified data packet is generated, and the to-be-verified data packet is sent to the network device for verification, where the to-be-verified data packet includes a source IP address, a destination IP address, the first check code, the time authentication factor, and the sequence number.