摘要：

当前Web应用采用的HTTPS协议为客户端与服务器端之间的消息请求提供良好的加密机制,但HTTPS协议无法对应用层消息进行选择性处理,因而在消息请求交互的过程中并未全过程加密,使Web应用无法避免重放攻击。为此,提出一种基于动态校验子与计数器双重验证的抗重放攻击方案。利用服务器端的当前时间作为动态校验子,以该动态校验子作为消息请求的新鲜性,结合计数器机制反馈客户端数据丢包情况,以此防止重放攻击。实验结果表明,该方案与基于单一序列号机制的方案相比,能降低对服务器端数据库存储空间的开销,与基于单一时间戳机制的方案相比,解决了时钟同步问题,并可反馈客户端数据丢包情况。

关键词: 重放攻击, 存储空间, 时间戳, 时钟同步, 服务器

Abstract:

Currently HTTPS protocolused by Web applications provides a good message encryption mechanism for the message requests between the client and the server,but it cannot selectively process the application layer message,thus the whole process message request interaction does not encrypt,which cannot prevent replay attacks in the whole process.So,this paper proposes an anti-replay attack scheme based on counterand dynamic calibration,which uses the current time on the server as the dynamic calibration,and sets the counter mechanisms feedback client data packet loss.Experimental results show the scheme compared with the sheme based on the single serial number mechanism can relieve dependence on the database server.Compared with thesheme based on a single time stamp mechanism,it can avoid clock synchronization and feedback data packet loss.

Key words: replay attack, storage space, timestamp, clock synchronization, server

中图分类号: 

• TP309.7