2.2. Replay Protection

2.2. Replay Protection

The User-based Security Model provides protection against message replay, message delay, and message redirection. This protection is based on the use of:

1. msgAuthoritativeEngineID: The snmpEngineID of the authoritative SNMP engine involved in the exchange of this message.
2. msgAuthoritativeEngineBoots: The number of times the authoritative SNMP engine has re-initialized itself since initial configuration.
3. msgAuthoritativeEngineTime: The number of seconds since the authoritative SNMP engine last incremented the msgAuthoritativeEngineBoots counter.

These three values together provide a loosely synchronized clock that is used to limit the temporal window of opportunity for message replay attacks.

The replay protection mechanism works as follows:

For Request Messages

When generating a request message, the non-authoritative SNMP engine includes the following values from the authoritative SNMP engine:

• The most recently received msgAuthoritativeEngineID
• The most recently received msgAuthoritativeEngineBoots
• The most recently received msgAuthoritativeEngineTime

For Response Messages

When generating a response message, the authoritative SNMP engine includes its current values for:

• msgAuthoritativeEngineID
• msgAuthoritativeEngineBoots
• msgAuthoritativeEngineTime

Time Window

A receiving SNMP engine considers a message to be outside the time window if:

abs(msgAuthoritativeEngineTime - localEngineTime) > 150 seconds

where localEngineTime is the local SNMP engine's notion of the current time for the msgAuthoritativeEngineID.

Messages that are outside the time window are discarded, and an error indication is returned to the message processing subsystem.