针对采用“内网IP地址+NAT”接入互联网形成的内网中容易发生同源重放攻击的问题,通过引入会话指纹( Session Fingerprinting)的概念,提出了基于会话识别的同源重放攻击应对方案。该方案通过会话指纹,识别会话的变化,适时地要求用户输入原始认证信息,例如,用户名和密码,进行身份认证,达到应对重放攻击的目的。代码实现和理论分析均表明,提出的应对方案能够有效地应对同源重放攻击。
It's very popular that users get access to the Internet in the "inner IP +NAT"way.However, the "inner IP +NAT"way may help malicious users attack web servers by replaying as a legal user.A protection scheme of identical-source replay attacks is proposed through introducing the concept Session Fingerprinting.This scheme can thwart identical-source replay attacks by identifying client changes and requiring original identification information, such as, username and password. Prototype realization and theoretical analysis both prove that the proposed scheme thwarting identical-source replay attacks is effective.