# US 10,122,755 B2 · Method and apparatus for detecting that an attacker has sent one or more messages to a receiver node > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,755 B2 - Document ID: US10122755B2 - Status: Granted - Kind: B2 - Application number: 15/103,390 - Filed: 2014-01-23 - Published: 2016-10-27 - Granted: 2018-11-06 - Earliest claimed: 2013-12-24 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget Lm Ericsson (Publ) - Inventors: Giovanni Fiaschi; Géza Gaál - Web page: https://patentgrep.com/patent/US10122755B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/126: {the source of the received data} - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention provides a method and apparatus for detecting that an attacker has sent one or more messages to a receiver node. The method comprises storing at least a portion of an nth message received by the receiver node from a sender node in a memory device; sending an integrity check message to the sender node comprising an indication of the value of n; receiving a reply message from the sender node including at least a portion of the nth message sent by the sender node to the receiver node; and comparing the at least a portion of the nth message sent by the sender node to the receiver node with the nth message received by the receiver node from the sender node stored in the memory device. ## Claims ### Claim 1 A method for detecting that an attacker has sent one or more messages to a receiver node, the method comprising: storing, at the receiver node, at least a portion of an nth message received by the receiver node from a sender node in a memory device; sending, from the receiver node, an integrity check message to the sender node comprising an indication of the value of n, where n is an integer value greater than one; receiving, at the receiver node, a reply message from the sender node including at least a portion of the nth message sent by the sender node to the receiver node; and comparing the at least a portion of the nth message sent by the sender node to the receiver node with the nth message received by the receiver node from the sender node stored in the memory device. ### Claim 2 (depends on 1) A method according to claim 1, wherein the nth message received by the receiver node from the sender node is selected randomly or pseudo-randomly. ### Claim 3 (depends on 2) A method according to claim 2, wherein selecting the nth message received by the receiver node from the sender node comprises, for each of a plurality of messages received by the receiver node from the sender node: generating a number, x, randomly or pseudo-randomly; and comparing the number, x, to a probability, p; wherein the probability, p, indicates the probability that a message received by the receiver node from the sender node is integrity checked. ### Claim 4 (depends on 1) A method according to claim 1, wherein the integrity check message further comprises message authentication data for enabling the sender node to verify that the receiver node sent the integrity check message. ### Claim 5 (depends on 1) A method according to claim 1, wherein the reply message further comprises message authentication data, further comprising using the message authentication in the reply message to verify that the sender node sent the reply message. ### Claim 6 A method comprising: storing, at a sender node, at least a portion of each of a plurality of messages sent by the sender node to a receiver node in a memory device; receiving, at the sender node, an integrity check message from the receiver node comprising an indication of a value of n, where n is an integer value greater than one; retrieving, at the sender node, at least a portion of the nth message sent by the sender node to the receiver node from the memory device; and sending, from the sender node, a reply message to the receiver node including the at least a portion of the nth message sent by the sender node to the receiver node. ### Claim 7 (depends on 6) A method according to claim 6, wherein the integrity check message further comprises message authentication data, further comprising using the message authentication data to verify that the receiver node sent the integrity check message. ### Claim 8 (depends on 6) A method according to claim 6, wherein the reply message further comprises message authentication data for enabling the receiver node to verify that the sender node sent the reply message. ### Claim 9 (depends on 8) A method according to claim 8, further comprising generating the message authentication data in the reply message, by applying a hash function to at least a part of the at least a portion of the nth message sent by the sender node to the receiver node. ### Claim 10 (depends on 9) A method according to claim 9, wherein the hash function is applied to only a part of the at least a portion of the nth message sent by the sender node to the receiver node. ### Claim 11 Apparatus for detecting that an attacker has sent one or more messages to a receiver node, the apparatus comprising a processor and a memory device, wherein the processor is configured to store, at the receiver node, at least a portion of an nth message received by the receiver node from a sender node in the memory device; send, from the receiver node, an integrity check message to the sender node comprising an indication of the value of n, where n is an integer value greater than one; receive, at the receiver node, a reply message from the sender node including at least a portion of the nth message sent by the sender node to the receiver node; and compare the at least a portion of the nth message sent by the sender node to the receiver node with the nth message received by the receiver node from the sender node stored in the memory device. ### Claim 12 (depends on 11) Apparatus according to claim 11, wherein the processor is configured to select the nth message received by the receiver node from the sender node randomly or pseudo-randomly. ### Claim 13 (depends on 12) Apparatus according to claim 12, wherein the processor is configured to select the nth message received by the receiver node from the sender node by, for each of a plurality of messages received by the receiver node from the sender node: generating a number, x, randomly or pseudo-randomly; and comparing the number, x, to a probability, p; wherein the probability, p, indicates the probability that a message received by the receiver node from the sender node is integrity checked. ### Claim 14 (depends on 11) Apparatus according to claim 11, wherein the integrity check message further comprises message authentication data for enabling the sender node to verify that the receiver node sent the integrity check message. ### Claim 15 (depends on 11) Apparatus according to claim 11, further comprising a counter configured to count messages received by the receiver node from the sender node; wherein the processor is configured to restart the counter after the nth message has been received by the receiver node. ### Claim 16 Apparatus comprising a processor and a memory device, wherein the processor is configured to: store, at a sender node, at least a portion of each of a plurality of messages sent by the sender node to a receiver node in a memory device; receive, at the sender node, an integrity check message from the receiver node comprising an indication of a value of n, where n is an integer value greater than one; retrieve, at the sender node, at least a portion of the nth message sent by the sender node to the receiver node from the memory device; and send, from the sender node, a reply message to the receiver node including the at least a portion of the nth message sent by the sender node to the receiver node. ### Claim 17 (depends on 16) Apparatus according to claim 16, wherein the reply message further comprises message authentication data for enabling the receiver node to verify that the sender node sent the reply message. ### Claim 18 (depends on 17) Apparatus according to claim 17, wherein the processor is configured to generate the message authentication data in the reply message, by applying a hash function to at least a part of the at least a portion of the nth message sent by the sender node to the receiver node. ### Claim 19 (depends on 16) Apparatus according to claim 16, further comprising a counter configured to count the messages sent by the sender node to the receiver node, wherein the processor is configured to re-start the counter to count the messages sent by the sender node to the receiver node from after the nth message sent by the sender node to the receiver node. ### Claim 20 (depends on 16) Apparatus according to claim 16, wherein the processor is further configured to delete or overwrite the at least a portion of each of the plurality of messages sent by the sender node to the receiver node from the memory device which were sent to the receiver node before the nth message.