CN111262701A - Replay attack detection method, system, equipment and storage medium - Google Patents

Abstract

The invention discloses a replay attack detection method, which comprises the following steps: receiving a data packet which is sent by a client and comprises a first digital signature, a client current timestamp and a client identification code; the first digital signature is generated by a client identification code, a client current time stamp and a client password through an encryption algorithm; extracting a client current timestamp and a client identification code in the data packet; generating a second digital signature by using the extracted client current timestamp, the client identification code and the pre-stored password; the pre-stored password is a preset password which is the same as the client password; when the first digital signature and the second digital signature are not the same, it is determined that a replay attack has occurred. The invention also discloses a replay attack detection system, a replay attack detection device and a computer storage medium. By adopting the embodiment of the invention, the problem that the server without the timestamp can not detect replay attack can be effectively solved, and the network security of the server without the timestamp can be enhanced.

Description

A replay attack detection method, system, device and storage medium

technical field

The present invention relates to the technical field of communication networks, and in particular, to a replay attack detection method, system, device and storage medium.

Background technique

Replay attack (ReplayAttacks) means that the attacker sends a packet that the destination host has received to achieve the purpose of deceiving the system. It is mainly used in the identity authentication process and destroys the correctness of the authentication. It is a type of attack that repeatedly maliciously or fraudulently repeats a valid data transmission, a replay attack can be performed by the initiator or by an adversary who intercepts and retransmits the data.

In the existing replay attack detection methods, due to the superiority of the timestamp itself, the current mainstream anti-replay attack methods are basically completed based on the server and client timestamps. There are currently three ways to detect replay attacks: the first is based on the timestamp scheme, which has the risk that the attacker modifies the timestamp to bypass the anti-replay mechanism, making the replay attack effective; the second is based on The nonce scheme consumes more and more server memory space over time, making it more and more time-consuming to verify whether the nonce exists on the server, which seriously affects server performance; the third is based on timestamp and The nonce combination scheme can effectively avoid the shortcomings of the above two schemes, and save the nonce within a specified time, which reduces memory consumption and prevents short-term replay attacks.

However, the above three ways must rely on server and client timestamps to implement. For a server without a timestamp, the replay attack cannot be accurately detected, so the network security of the server cannot be guaranteed.

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present invention is to provide a replay attack detection method, system, device and storage medium, which can effectively solve the problem that the time stampless server cannot detect the replay attack, and strengthen the network security of the time stampless server.

To achieve the above purpose, an embodiment of the present invention provides a replay attack detection method, including:

Receive the data packet sent by the client including the first digital signature, the current timestamp of the client and the client identification code; wherein, the first digital signature is composed of the client identification code, the current timestamp of the client and the client identification code. The terminal password is generated by an encryption algorithm;

extracting the current timestamp of the client and the client identification code in the data packet;

generating a second digital signature from the extracted current timestamp of the client, the client identification code and the pre-stored password; wherein, the pre-stored password is a preset password identical to the client password;

When the first digital signature and the second digital signature are different, it is determined that a replay attack occurs.

Compared with the prior art, in the replay attack detection method disclosed in the embodiment of the present invention, firstly, by receiving a data packet containing the first digital signature, the current timestamp of the client and the client identification code, and extracting the client from the data packet. terminal current timestamp and client identification code; then, generate the second digital signature by extracting the client current timestamp and client identification code and the pre-stored password from the data packet; finally, by judging the first digital signature and the second digital signature Whether the current network is the same to determine whether the current network suffers from a replay attack, when the first digital signature is different from the second digital signature, it indicates that the data in the data packet has been tampered with. At this time, it can be confirmed that the current network has suffered a replay attack, which can be effectively solved. The problem that no timestamp server cannot detect replay attacks, and the network security of no timestamp server is strengthened.

As an improvement of the above scheme, the method also includes:

When the first digital signature and the second digital signature are the same, determine whether the current timestamp of the client is greater than the latest timestamp pre-stored in the timestamp list;

If yes, write the current timestamp of the client as the latest timestamp into the timestamp list; if not, determine that a replay attack occurs or the client request times out.

As an improvement of the above solution, after the current timestamp of the client is written into the timestamp list as the latest timestamp, the method further includes:

Judging whether the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold;

If yes, delete the client timestamp whose difference from the latest timestamp is greater than the preset time threshold from the timestamp list; if not, keep the difference from the latest timestamp less than or equal to The client timestamp of the preset time threshold.

As an improvement of the above solution, the timestamp list includes several client timestamps corresponding to the client identification codes, and each of the client timestamps is sorted in a preset order.

As an improvement of the above solution, the second digital signature is generated by an encryption algorithm.

In order to achieve the above purpose, an embodiment of the present invention also provides a replay attack detection system, including:

A data packet receiving module, configured to receive a data packet sent by a client including a first digital signature, a current timestamp of the client and a client identification code; wherein the first digital signature is composed of the client identification code, the client identification The current timestamp of the client and the client password are generated by an encryption algorithm;

a data extraction module for extracting the current timestamp of the client and the client identification code in the data packet;

A digital signature generation module, configured to generate a second digital signature from the extracted current timestamp of the client, the client identification code and the pre-stored password; wherein, the pre-stored password is the same as the preset password of the client password;

a first judgment module for judging whether the first digital signature and the second digital signature are the same;

A first detection module, configured to determine that a replay attack occurs when the first digital signature and the second digital signature are different.

Compared with the prior art, in the replay attack detection system disclosed in the embodiment of the present invention, first, the data packet receiving module receives the data packet containing the first digital signature, the current time stamp of the client and the client identification code, and the data extraction module receives the data packet from the Extract the current timestamp of the client and the client identification code from the data packet; then, the digital signature generation module generates the second digital signature from the current timestamp of the client, the client identification code and the pre-stored password extracted from the data packet; finally, the first digital signature is generated. The judgment module judges whether the first digital signature and the second digital signature are the same, so that the first detection module determines whether the current network suffers from a replay attack, and when the first digital signature is different from the second digital signature, it indicates that the data in the data packet If it has been tampered with, it can be confirmed that the current network has encountered a replay attack, which can effectively solve the problem that the timestampless server cannot detect the replay attack, and strengthen the network security of the timestampless server.

As an improvement of the above solution, the replay attack detection system further includes:

a second judgment module, configured to judge whether the current timestamp of the client is greater than the latest timestamp in the pre-existing timestamp list when the first digital signature and the second digital signature are the same;

A timestamp updating module, configured to use the current timestamp of the client as the latest timestamp to write into the timestamp list when the current timestamp of the client is greater than the latest timestamp;

The second detection module is configured to determine that a replay attack occurs or the client request times out when the current timestamp of the client is less than or equal to the latest timestamp.

As an improvement of the above solution, the replay attack detection system further includes:

a third judging module, configured to judge whether the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold;

A timestamp deletion module, configured to delete the latest timestamp from the timestamp list and the latest timestamp when the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold The difference between the stamps is greater than the client timestamp of the preset time threshold.

To achieve the above object, an embodiment of the present invention further provides a replay attack detection device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor When the computer program is executed, the replay attack detection method described in any of the above embodiments is implemented.

To achieve the above object, an embodiment of the present invention further provides a computer-readable storage medium, where the computer-readable storage medium includes a stored computer program, wherein the computer-readable storage medium is controlled when the computer program runs The device where it is located executes the replay attack detection method described in any of the foregoing embodiments.

Description of drawings

1 is a flowchart of a method for detecting a replay attack provided by an embodiment of the present invention;

2 is a flowchart of another method for detecting a replay attack provided by an embodiment of the present invention;

3 is a flowchart of updating a timestamp list provided by an embodiment of the present invention;

4 is a structural block diagram of a replay attack detection system provided by an embodiment of the present invention;

FIG. 5 is a structural block diagram of a replay attack detection device provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Referring to FIG. 1, FIG. 1 is a flowchart of a replay attack detection method provided by an embodiment of the present invention; the replay attack detection method includes:

S1. Receive a data packet including a first digital signature, a current timestamp of the client, and a client identification code sent by a client; wherein, the first digital signature is composed of the client identification code, the current timestamp of the client And the client password is generated by an encryption algorithm;

S2, extracting the current timestamp of the client and the client identification code in the data packet;

S3. Generate a second digital signature from the extracted current timestamp of the client, the client identification code and the pre-stored password; wherein, the pre-stored password is a preset password identical to the client password;

S4. When the first digital signature and the second digital signature are different, determine that a replay attack occurs.

It should be noted that the replay attack detection method described in the embodiment of the present invention is implemented by a server, and the server performs network communication with several clients. The client generates a fixed-length first digital signature with its own client identification code, client current timestamp, and client password as input. Exemplarily, the client uses an encryption algorithm to generate the first digital signature. For example, the encryption algorithm is a hash algorithm, an Md5 algorithm, or other encryption algorithms. Specifically, the hash algorithm and the Md5 algorithm are different. For the calculation process, reference may be made to the prior art, and details are not repeated here. When the client initiates a verification request to the server, the first digital signature, the current timestamp of the client and the client identification code are encapsulated into a data packet and sent to the server.

Specifically, after receiving the data packet sent by the client, the server extracts the current timestamp of the client and the client identification code in the data packet, and then the server extracts the extracted The current timestamp of the client, the client identification code and the pre-stored password in the database generate a second digital signature of a fixed length, and the server uses an encryption algorithm (hash algorithm, Md5 algorithm or other encryption algorithm) to generate the the second digital signature. Finally, the server determines whether the current network suffers from a replay attack by judging whether the first digital signature is the same as the second digital signature. When the first digital signature and the second digital signature are the same, it is considered that the client request is a normal request, the current network is not subject to replay attacks, and the process continues; when the first digital signature and the second digital signature are the same When the digital signatures are different, it can be confirmed that the content of the data packet sent by the client has been tampered with, and it can be determined that a replay attack has occurred on the current network. At this time, the server rejects the client's request, and the client verifies the request. The process ends, and measures are taken to deal with the fact that the replay attack has occurred.

Preferably, the method further includes:

S5, when the first digital signature and the second digital signature are the same, determine whether the current timestamp of the client is greater than the latest timestamp in the pre-existing timestamp list;

S6. If yes, write the current timestamp of the client as the latest timestamp into the timestamp list; if not, determine that a replay attack occurs or the client request times out.

Specifically, when the server determines that the first digital signature and the second digital signature are the same, further verification is performed. At this time, the server compares the current timestamp T1 of the client with the pre-stored timestamp list. The latest timestamp Tnew is compared. When T1 is greater than Tnew, it is considered that the client request is a normal request, the current network is not subject to a replay attack, and the process continues; when T1 is less than or equal to Tnew, a replay attack occurs or the client request times out, at this time The server rejects the client's request, and the client-side verification request process ends. In order to prevent leakage of user information, corresponding measures are taken to deal with the occurrence of a replay attack or the client's request timeout. Two-factor authentication can accurately detect whether a replay attack occurs on the current network, thereby improving network security.

Further, for the process of the above steps S1 to S6, reference may be made to FIG. 2 .

Preferably, the time stamp list includes several time stamp storage spaces, and the time stamp storage space is a memory space opened for each client, which is specially used to store the client time stamp when the client verification request is passed, One-to-one correspondence with the client identification code. Preferably, each of the client timestamps is sorted according to a preset order, for example, sorted according to update time, and the latest timestamp is ranked last in the timestamp list.

When the client passes the verification, it will compare Tnew and T1. When T1 is less than or equal to Tnew, it can be considered that the client request that currently initiates verification has timed out (because Tnew is the latest time recorded in the server, and T1 smaller than Tnew is basically When T1 is greater than Tnew, it is considered that the current request is a fresh request, then the timestamp storage space is used to save the current verification, and the client initiates verification. The current timestamp of the client.

It is worth noting that the server cannot obtain the current time because it does not have a time stamp, and cannot compare its own time with the client time. In order to solve this problem, in the embodiment of the present invention, a dynamic aging mechanism of the timestamp list is designed for the server. This mechanism enables the server to obtain the latest time Tnew after the client has passed the verification, and can prevent timestamps through the dynamic aging mechanism. Takes up a lot of server memory.

At this time, after the current timestamp of the client is written into the timestamp list as the latest timestamp, the method further includes:

S7, determine whether the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold;

S8. If yes, delete the client timestamp whose difference from the latest timestamp is greater than the preset time threshold from the timestamp list; if not, keep the difference from the latest timestamp less than or a client timestamp equal to the preset time threshold.

Further, for the process of the above steps S7-S8, reference may be made to FIG. 3 .

The timestamp list is stored with the client identification code as the index and the current timestamp of the client that the client has passed the verification request as the value. The later the new order is, the timestamp corresponding to the latest moment is Tnew, and as the client verification request passes, Tnew will be continuously refreshed by the latest verified client timestamp.

After the client has passed the initial verification, the server will open up a timestamp storage space for each client device according to the client identification code in the data packet to store the timestamp of the client's verification, and perform the verification. Initialization, the initial value of initialization is 0, and the time stamp storage space is retrieved and retrieved through the client identification code, that is, each client corresponds to a time stamp storage space, which is used to store the current value of the client that has passed the verification. timestamp. The server will store the current timestamp of each client that has passed the verification in order from front to back, and the last timestamp is Tnew, where as more and more client verification requests pass, Tnew Will be continuously refreshed with the latest authenticated client timestamp.

Calculate the time difference between Tnew and all client timestamps stored in the server memory. If the difference is greater than the preset time threshold t0, delete the corresponding older timestamp and release the memory space occupied by the timestamp. t0 can be set artificially according to specific usage needs, and can be one day, one week, or even one month. Through the preset threshold of t0, the timestamps saved by the server can be dynamically aged. All timestamps with a time difference of more than t0 from the latest time will be deleted and the occupied memory will be released. This dynamic aging mechanism can be released in time. The memory space of aging timestamps not only saves memory space, but also simplifies the time complexity of the timestamp list sorting process.

In the replay attack detection method provided by the embodiment of the present invention, the time stamps of the clients that have passed the verification are stored and updated and synchronized, so that the server maintains a list of the time stamps of the clients that have passed the verification. First, by verifying the digital signature, and then by comparing the timestamp of the verification request with the timestamp of the latest moment stored by the server, a double insurance mechanism is added to the entire system. This double verification mechanism is used to determine whether it is a replay attack, which improves the accuracy and stability of the system to prevent replay attacks. In addition, through this dynamic aging mechanism, the memory space occupied by the aging timestamp can be released in time, which not only greatly reduces the memory space consumption of the server system, but also simplifies the timestamp list. The time complexity is also greatly reduced.

Referring to FIG. 4, FIG. 4 is a structural block diagram of a replay attack detection system 100 provided by an embodiment of the present invention; the replay attack detection system 100 includes:

A data packet receiving module 101 is configured to receive a data packet sent by a client including a first digital signature, a current timestamp of the client and a client identification code; wherein the first digital signature is composed of the client identification code, the The current timestamp of the client and the client password are generated by an encryption algorithm;

A data extraction module 102, configured to extract the current timestamp of the client and the client identification code in the data packet;

A digital signature generation module 103, configured to generate a second digital signature from the extracted current timestamp of the client, the client identification code and the pre-stored password; wherein, the pre-stored password is a preset and the client password the same password;

The first judgment module 104 is used for judging whether the first digital signature and the second digital signature are the same;

a first detection module 105, configured to determine that a replay attack occurs when the first digital signature and the second digital signature are different;

A second judgment module 106, configured to judge whether the current timestamp of the client is greater than the latest timestamp in the pre-existing timestamp list when the first digital signature and the second digital signature are the same;

A timestamp updating module 107, configured to write the timestamp list with the current timestamp of the client as the latest timestamp when the current timestamp of the client is greater than the latest timestamp;

The second detection module 108 is configured to determine that a replay attack occurs or the client request times out when the current timestamp of the client is less than or equal to the latest timestamp;

A third judging module 109, configured to judge whether the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold;

A timestamp deletion module 110, configured to delete the latest timestamp from the timestamp list when the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold The difference of the timestamps is greater than the client timestamp of the preset time threshold.

Preferably, the timestamp list includes several client timestamps corresponding to the client identifiers, and each of the client timestamps is sorted in a preset order. The second digital signature is generated by an encryption algorithm.

It should be noted that the replay attack detection system 100 according to the embodiment of the present invention may be a server, and the server performs network communication with several clients. The client generates a fixed-length first digital signature with its own client identification code, client current timestamp, and client password as input. Exemplarily, the client uses an encryption algorithm to generate the first digital signature. When the client initiates a verification request to the server, the first digital signature, the current timestamp of the client and the client identification code are encapsulated into a data packet and sent to the server.

For the working process of the replay attack detection system 100 according to the embodiment of the present invention, reference may be made to the working process of the replay attack detection method described in the foregoing embodiment, and details are not described herein again.

The replay attack detection system 100 provided by the embodiment of the present invention stores the time stamps of clients that have passed the verification and implements update synchronization, so that the server maintains a list of time stamps that pass the verification of the clients. First, by verifying the digital signature, and then by comparing the timestamp of the verification request with the timestamp of the latest moment stored by the server, a double insurance mechanism is added to the entire system. This double verification mechanism is used to determine whether it is a replay attack, which improves the accuracy and stability of the system to prevent replay attacks. In addition, through this dynamic aging mechanism, the memory space occupied by the aging timestamp can be released in time, which not only greatly reduces the memory space consumption of the server system, but also simplifies the timestamp list. The time complexity is also greatly reduced.

Referring to FIG. 5 , FIG. 5 is a structural block diagram of a replay attack detection device 200 provided by an embodiment of the present invention; the replay attack detection device 200 in this embodiment includes: a processor 201 , a memory 202 , and a storage device stored in the memory 202 A computer program that can be executed on the processor 201. When the processor 201 executes the computer program, the steps in the above embodiments of the replay attack detection method are implemented, for example, steps S1 to S4 shown in FIG. 1 . Alternatively, when the processor 201 executes the computer program, the functions of the modules/units in the foregoing device embodiments, such as the data packet receiving module 101 , are implemented.

Exemplarily, the computer program can be divided into one or more modules/units, and the one or more modules/units are stored in the memory 202 and executed by the processor 201 to complete the present invention. invention. The one or more modules/units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the replay attack detection device 200 . For example, the computer program can be divided into a data packet receiving module 101, a data extraction module 102, a digital signature generation module 103, a first judgment module 104, a first detection module 105, a second judgment module 106, and a timestamp update module 107 , the second detection module 108 , the third judgment module 109 and the timestamp deletion module 110 . For specific functions of each module, please refer to the specific working process of the replay attack detection system 100 described in the above embodiment, which will not be repeated here.

The replay attack detection device 200 may be a computing device such as a desktop computer, a notebook computer, a handheld computer, and a cloud server. The replay attack detection device 200 may include, but is not limited to, a processor 201 and a memory 202 . Those skilled in the art can understand that the schematic diagram is only an example of the replay attack detection device 200, and does not constitute a limitation on the replay attack detection device 200, and may include more or less components than those shown in the figure, or a combination of certain Some components, or different components, for example, the replay attack detection device 200 may further include an input and output device, a network access device, a bus, and the like.

The processor 201 may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), Off-the-shelf programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The general-purpose processor may be a microprocessor or the processor 201 may also be any conventional processor, etc. The processor 201 is the control center of the replay attack detection device 200, and uses various interfaces and lines to connect the entire Various parts of the attack detection device 200 are placed.

The memory 202 can be used to store the computer programs and/or modules, and the processor 201 executes or executes the computer programs and/or modules stored in the memory 202 and calls the data stored in the memory 202, Various functions of the replay attack detection device 200 are implemented. The memory 202 may mainly include a stored program area and a stored data area, wherein the stored program area may store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the storage data area may Stores data (such as audio data, phonebook, etc.) created according to the use of the mobile phone, and the like. In addition, the memory 202 may include high-speed random access memory, and may also include non-volatile memory such as hard disk, internal memory, plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

Wherein, if the modules/units integrated in the replay attack detection device 200 are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium. Based on this understanding, the present invention can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed by the processor 201, the steps of the foregoing method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form, and the like. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a removable hard disk, a magnetic disk, an optical disc, a computer memory, a read-only memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable media may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer-readable media Electric carrier signals and telecommunication signals are not included.

The above are the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications can be made, and these improvements and modifications may also be regarded as It is the protection scope of the present invention.

Claims (10)

1. a replay attack detection method, is characterized in that, comprises: Receive the data packet sent by the client including the first digital signature, the current timestamp of the client and the client identification code; wherein, the first digital signature is composed of the client identification code, the current timestamp of the client and the client identification code. The terminal password is generated by an encryption algorithm; extracting the current timestamp of the client and the client identification code in the data packet; generating a second digital signature from the extracted current timestamp of the client, the client identification code and the pre-stored password; wherein, the pre-stored password is a preset password identical to the client password; When the first digital signature and the second digital signature are different, it is determined that a replay attack occurs. 2. The replay attack detection method according to claim 1, wherein the method further comprises: When the first digital signature and the second digital signature are the same, determine whether the current timestamp of the client is greater than the latest timestamp pre-stored in the timestamp list; If yes, write the current timestamp of the client as the latest timestamp into the timestamp list; if not, determine that a replay attack occurs or the client request times out. 3 . The replay attack detection method according to claim 2 , wherein after writing the current timestamp of the client as the latest timestamp into the timestamp list, the method further comprises: 3 . Judging whether the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold; If yes, delete the client timestamp whose difference from the latest timestamp is greater than the preset time threshold from the timestamp list; if not, keep the difference from the latest timestamp less than or equal to The client timestamp of the preset time threshold. 4. The replay attack detection method according to claim 2, wherein the timestamp list includes several client timestamps corresponding to the client identifiers, and each client timestamp is Sort by default order. 5. The replay attack detection method according to claim 1, wherein the second digital signature is generated by an encryption algorithm. 6. A replay attack detection system, characterized in that, comprising: A data packet receiving module, configured to receive a data packet sent by a client including a first digital signature, a current timestamp of the client and a client identification code; wherein the first digital signature is composed of the client identification code, the client identification The current timestamp of the client and the client password are generated by an encryption algorithm; a data extraction module for extracting the current timestamp of the client and the client identification code in the data packet; A digital signature generation module, configured to generate a second digital signature from the extracted current timestamp of the client, the client identification code and the pre-stored password; wherein, the pre-stored password is the same as the preset password of the client password; a first judgment module for judging whether the first digital signature and the second digital signature are the same; A first detection module, configured to determine that a replay attack occurs when the first digital signature and the second digital signature are different. 7. The replay attack detection system according to claim 6, wherein the replay attack detection system further comprises: a second judgment module, configured to judge whether the current timestamp of the client is greater than the latest timestamp in the pre-existing timestamp list when the first digital signature and the second digital signature are the same; A timestamp updating module, configured to use the current timestamp of the client as the latest timestamp to write into the timestamp list when the current timestamp of the client is greater than the latest timestamp; The second detection module is configured to determine that a replay attack occurs or the client request times out when the current timestamp of the client is less than or equal to the latest timestamp. 8. The replay attack detection system according to claim 7, wherein the replay attack detection system further comprises: a third judging module, configured to judge whether the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold; A timestamp deletion module, configured to delete the latest timestamp from the timestamp list and the latest timestamp when the difference between the latest timestamp and any client timestamp in the timestamp list is greater than a preset time threshold The difference between the stamps is greater than the client timestamp of the preset time threshold. 9. A replay attack detection device, characterized by comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, when the processor executes the computer program The replay attack detection method according to any one of claims 1 to 5 is implemented. 10. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises a stored computer program, wherein, when the computer program is run, the device where the computer-readable storage medium is located is controlled to perform as claimed in the claims The replay attack detection method described in any one of 1 to 5.

Images