System for efficiently handling cryptographic messages containing nonce values in a wireless connectionless environment

• US 9,071,438 B2
• Filed: 05/24/2013
• Issued: 06/30/2015
• Est. Priority Date: 08/21/2001
• Status: Expired due to Fees

• Current Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Original Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Inventors: Lagimonier, Todd, Voris, Jim
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US13/902,074
• Publication Number:
  US 20130339737A1
• Time in Patent Office: 767 Days
• Field of Search: 726/22, 713/170
• US Class Current: 1/1
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]

Abstract

A secure communication module that accepts a cryptographic message if a nonce value for the received message is greater than the largest nonce value yet seen. If the received nonce value is not the largest nonce value yet seen, the secure communication module compares the received nonce value with a nonce acceptance window. If the nonce value falls outside the nonce acceptance window, the secure communication module rejects the received message and assumes a replay attack. Alternatively, if the nonce value falls within the nonce acceptance window, the secure communication module compares the received nonce value with a replay window mask. If comparison with the replay window mask indicates that the received nonce value has been seen before, the secure communication module rejects the received message and assumes a replay attack. Otherwise, the secure communication module accepts the message and adds the received nonce value to the replay window mask.

Claims

1. A method of processing out-of-order data packets, comprising:

obtaining a largest nonce value from among a plurality of nonce values of previous data packets;

adjusting, at a receiving device, a size of a range of acceptable nonce values within an acceptance window based around said largest nonce value;

accepting, at said receiving device, a newly received out-of-order data packet including a newly received nonce value when said newly received nonce value is within said acceptance window; and

resetting said largest nonce value to said newly received nonce value when said accepted, newly received nonce value exceeds said largest nonce value.

2. The method of processing out-of-order data packets according to claim 1, further comprising:

adjusting said size of said range of acceptable nonce values within said acceptance window based on said reset largest nonce value.

3. The method of processing out-of-order message packets according to claim 1, wherein:

said largest nonce value is associated with a first session.

4. The method of processing out-of-order message packets according to claim 1, wherein:

said largest nonce value is associated with a second session.

5. The method of processing out-of-order message packets according to claim 1, further comprising:

generating a new cryptographic key.

6. A method of processing out-of-order data packets, comprising:

obtaining a largest nonce value from among a plurality of nonce values of previous data packets;

adjusting, at a receiving device, a size of a range of acceptable nonce values within an acceptance window based around said largest nonce value;

accepting, at said receiving device, a newly received out-of-order data packet including a newly received nonce value when said newly received nonce value is within said acceptance window; and

adjusting said size of said range of acceptable nonce values within said acceptance window when said accepted, newly received nonce value exceeds said largest nonce value.

7. The method of processing out-of-order data packets according to claim 6, further comprising:

resetting said largest nonce value to said newly received nonce value when said accepted, newly received nonce value exceeds said largest nonce value.

8. The method of processing out-of-order message packets according to claim 6, wherein:

said largest nonce value is associated with a first session.

9. The method of processing out-of-order message packets according to claim 6, wherein:

said largest nonce value is associated with a second session.

10. The method of processing out-of-order message packets according to claim 6, further comprising:

generating a new cryptographic key.

11. A method of rejecting a replay attack in out-of-order data packets, comprising:

obtaining a largest nonce value from among a plurality of nonce values of previous data packets;

adjusting, at a receiving device, a size of a range of acceptable nonce values within an acceptance window based around said largest nonce value; and

rejecting, at said receiving device, a newly received out-of-order data packet including a newly received nonce value when said newly received nonce value is outside of said acceptance window.

12. The method of rejecting a replay attack in out-of-order data packets according to claim 11, further comprising:

designating said newly received out-of-order data packet as a replay attack.