初始序列号生成算法的安全性研究

Research on the Security of Initial Sequence Number Generation Arithmetic

许多操作系统都采用了强健的TCPISN生成算法,然而TCPReset攻击的成功率并非人们想象的只有1/232·基于PaulWatson的滑动窗口TCPReset攻击方法,并结合了混沌时间序列分析进行序列号猜测的技术,提出一种新的TCPReset攻击方法来验证TCPISN生成算法的安全性·在Windows操作系统下的实验结果表明,该方法增大了TCPReset攻击的成功概率,攻击发送17个RST包在10ms之内即可断开目标TCP连接·目前操作系统的TCPISN生成算法仍有很大安全风险·

Many operating systems have already adopted strong TCP ISN generation methods. However, the probability of successful TCP Reset attack is not onlyl/2^32 as people expected. Based on Paul Waston＇s “slipping in the window： TCP Reset attacks” method, and combined with the sequence number guessing technology which uses chaotic time series analysis, a new TCP Reset attack method is presented in this paper in order to validate the security of TCP ISN generation methods. The experiment results under Windows operating system indicate that this method increases the success probability of TCP Reset attack, and the attackers can terminate the established TCP connection by sending only 17 RST packets in 10 ms. Present Operation Systems＇ TCP ISN generation methods still have serious security risk.