본문 바로가기
  • Home

Encryption of TCP Sequence Numbers for Session Hijacking Attacks

  • Journal of Knowledge Information Technology and Systems
  • Abbr : JKITS
  • 2014, 9(6), pp.707-714
  • Publisher : Korea Knowledge Information Technology Society
  • Research Area : Interdisciplinary Studies > Interdisciplinary Research
  • Published : December 31, 2014

최재영 1 백현철 2 KimSangBok 1 심종채 3 PARK JAE HEUNG 1

1경상대학교
2경남도립 남해대학
3경남도립남해대학

Accredited

ABSTRACT

Session hijacking attacks represent a type of attack that captures existing session information by terminating normal sessions, which are connected through a TCP 3-Way handshaking process, using RST signals. In the case of the TCP 3-Way handshaking process, different sequence signals between servers and clients are generated to carry out a cross certification for each other. In a normally connected session, attackers interrupt sessions for a normal connection between servers and clients through generating RST signals and attempt to access a system by disguising an attacker as a registered user by generating a new sequence number. In precedent studies on preventing session hijacking attacks, a method that encrypts all sequence numbers generated in accessing a system has proposed. However, this method may cause lots of overheads in a cross certification process because it encrypts all sequence numbers required for the cross certification between servers and clients. Thus, in this study the encryption process is performed using a part of the information of the cross certification numbers in order to prevent illegal session hijacking as abnormal RST signals are generated. In addition, this method prevents the recognition of sequence numbers from attackers even though a sequence number is leaked. Moreover, it is possible to perform a defense for session hijacking attacks and to partly solve the overheads, which have been issued in the conventional studies.

Citation status

* References for papers published after 2023 are currently being built.