Method and apparatus for detecting a relay attack

Abstract

The application discloses a relay attack detection method and device, and the method comprises the following steps: a target communication device detects whether a target data packet is received, the target data packet carries a target timestamp, and the target timestamp is generated by a source communication device of the target data packet based on a timestamp generation mode corresponding to the target data packet; when the target communication device receives the target data packet, the target communication device determines the type of the target data packet according to the target timestamp and a local timestamp of the target communication device, and the type is used to represent whether the target data packet is a relay attack data packet. It can be seen that the application can efficiently identify the relay attack through a timestamp detection mechanism, improve the speed and accuracy of relay attack detection, improve the security of the communication device, prevent the relay attack, and increase the difficulty of the relay attack.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a relay attack detection method and device. BACKGROUND

[0002] With the rapid development of wireless communication technology, more and more devices tend to be connected and interacted through wireless communication. However, in the scenario where communication devices need to communicate directly (such as: smart key unlocking smart lock in close range), they are vulnerable to relay attacks. The so-called relay attack is an illegal operation of listening and rebroadcasting legitimate communication information and analyzing and tampering with the collected communication information.

[0003] In practical application, the detection method of relay attack is usually based on the nonce (random number) scheme, that is, a random number value is added in the communication message, and when the communication device receives the communication message, the random number value is stored and verified by the random number value whether it has been used. However, with the passage of time, this scheme will consume more and more memory space, making the verification time of nonce longer and seriously affecting the detection efficiency.

[0004] Therefore, it is particularly important to provide a scheme for efficiently identifying relay attacks to improve the security of communication between devices. SUMMARY

[0005] The present application provides a relay attack detection method and device, which can efficiently identify relay attacks through a timestamp detection mechanism, improve the speed and accuracy of relay attack detection, improve the security of communication devices, prevent relay attacks, and increase the difficulty of relay attacks.

[0006] To solve the above technical problems, the first aspect of the present application discloses a relay attack detection method, which comprises:

[0007] The target communication device detects whether a target data packet is received, the target data packet carrying a target timestamp, the target timestamp being generated by a source communication device of the target data packet based on a timestamp generation mode corresponding to the target data packet;

[0008] When the target communication device receives the target data packet, the target communication device determines the type of the target data packet according to the target timestamp and the local timestamp of the target communication device, the type being used to indicate whether the target data packet is a relay attack data packet.

[0009] As an optional implementation, in the first aspect of the present application, the target communication device determines the type of the target data packet according to the target timestamp and a local timestamp of the target communication device, comprising:

[0010] The target communication device calculates a time difference value between the target timestamp of the target data packet and a local timestamp of the target communication device;

[0011] The target communication device determines whether the time difference value satisfies a preset time length condition, and when it is determined that the time difference value does not satisfy the preset time length condition, determines that the type of the target data packet is a relay attack type, and the relay attack type is used to indicate that the target data packet is a relay attack data packet.

[0012] As an optional implementation, in the first aspect of the present application, the method further comprises:

[0013] The target communication device establishes a communication connection with a source communication device, receives a time synchronization negotiation data packet sent by the source communication device, and synchronizes a local time of the source communication device as a local time of the target communication device according to the received time synchronization negotiation data packet, wherein the time synchronization negotiation data packet comprises the local time of the source communication device; or,

[0014] The target communication device establishes a communication connection with a source communication device, sends a time synchronization negotiation data packet to the source communication device, wherein the time synchronization negotiation data packet comprises a local time of the target communication device, and the time synchronization negotiation data packet is used to synchronize the local time of the target communication device as a local time of the source communication device by the source communication device according to the local time of the target communication device.

[0015] As an optional implementation, in the first aspect of the present application, the method further comprises:

[0016] The target communication device acquires a first time of a time server, and sets the first time as a local time of the target communication device, wherein the time server is used to provide a calibrated standard time;

[0017] And the time server is further used to determine a second time at which the source communication device can keep time synchronization with the target communication device according to a first synchronization request triggered by the source communication device or a second synchronization request triggered by the target communication device, and provide the second time to the source communication device to trigger the source communication device to set the second time as a local time of the source communication device, wherein the source communication device is a device that needs to communicate with the target communication device.

[0018] The first synchronization request is used to request time synchronization with the target communication device, and the second synchronization request is used to set the local time of the source communication device to achieve time synchronization between the source communication device and the target communication device.

[0019] As an optional implementation, in the first aspect of the present application, the target timestamp is specifically generated by the following manner:

[0020] The source communication device judges whether the target data packet enters a sending stage, and records a current local time point of the source communication device when it is judged that the target data packet enters the sending stage;

[0021] The source communication device delays the current local time point of the source communication device by a predetermined duration of the sending stage to obtain a target sending time point;

[0022] The source communication device determines the target sending time point as the target timestamp.

[0023] As an optional implementation, in the first aspect of the present application, the preset duration condition includes a preset duration threshold, and the time difference value does not satisfy the preset duration condition when the time difference value is greater than the preset duration threshold; before the type of the target data packet is determined according to the target timestamp and a local timestamp of the target communication device, the method further includes:

[0024] The target communication device determines transmission durations of a plurality of historical data packets between the target communication device and the source communication device according to historical data of communication between the target communication device and the source communication device, the transmission duration of the historical data packet being a historical time difference value between a sending time point of the historical data packet and a receiving time point of the historical data packet, wherein all the historical data packets are of a normal data packet type;

[0025] The target communication device determines a statistical value of all the historical time difference values according to the historical time difference values of all the historical data packets, and determines the statistical value as a preset time threshold, wherein the statistical value includes one of an average value, an extreme value, and a median value.

[0026] As an optional implementation, in the first aspect of the present application, the method further includes:

[0027] After it is judged that the time difference value does not satisfy the preset duration condition, the target communication device judges whether a signal strength between the target communication device and the source communication device is lower than a predetermined signal strength threshold;

[0028] The target communication device performs the operation of determining the type of the target data packet as the relay attack type when it is determined that the signal strength between the target communication device and the source communication device is not lower than the signal strength threshold.

[0029] The second aspect of the present application discloses a device for detecting a relay attack, which comprises:

[0030] A receiving module is configured to detect whether a target data packet is received, wherein the target data packet carries a target timestamp, and the target timestamp is generated by a source communication device of the target data packet based on a timestamp generation manner corresponding to the target data packet.

[0031] A first determining module is configured to determine the type of the target data packet according to the target timestamp and a local timestamp of the target communication device when the receiving module detects that the target data packet is received, wherein the type is used to represent whether the target data packet is a relay attack data packet.

[0032] As an optional implementation, in the second aspect of the present application, the first determining module comprises:

[0033] A calculating sub-module is configured to calculate a time difference value between the target timestamp of the target data packet and the local timestamp of the target communication device.

[0034] A judging sub-module is configured to judge whether the time difference value satisfies a preset time length condition.

[0035] A determining sub-module is configured to determine the type of the target data packet as a relay attack type when the judging sub-module judges that the time difference value does not satisfy the preset time length condition, wherein the relay attack type is used to represent that the target data packet is a relay attack data packet.

[0036] As an optional implementation, in the second aspect of the present application, the device further comprises:

[0037] A time synchronization module is configured to establish a communication connection with a source communication device, receive a time synchronization negotiation data packet sent by the source communication device, and synchronize the local time of the source communication device as the local time of the target communication device according to the received time synchronization negotiation data packet, wherein the time synchronization negotiation data packet comprises the local time of the source communication device; or

[0038] sending a time synchronization negotiation packet to the source communication device, wherein the time synchronization negotiation packet comprises a local time of the target communication device, and the time synchronization negotiation packet is used by the source communication device to synchronize the local time of the target communication device to a local time of the source communication device according to the local time of the target communication device; or

[0039] acquiring a first time of a time server, and setting the first time as the local time of the target communication device, wherein the time server is used to provide a calibrated standard time, and the time server is further used to determine a second time at which the source communication device can keep time synchronization with the target communication device according to a first synchronization request triggered by the source communication device or a second synchronization request triggered by the target communication device, and provide the second time to the source communication device to trigger the source communication device to set the second time as the local time of the source communication device, the source communication device being a device that needs to communicate with the target communication device; wherein the first synchronization request is used to request time synchronization with the target communication device, and the second synchronization request is used to request setting the local time of the source communication device to realize time synchronization between the source communication device and the target communication device.

[0040] As an optional implementation, in the second aspect of the present application, the target timestamp is specifically generated by the following manner:

[0041] judging, by the source communication device, whether the target data packet enters a sending stage, and recording a current local time point of the source communication device when it is judged that the target data packet enters the sending stage;

[0042] delaying, by the source communication device, the current local time point of the source communication device by a predetermined duration of the sending stage to obtain a target sending time point;

[0043] determining, by the source communication device, the target sending time point as the target timestamp.

[0044] As an optional implementation, in the second aspect of the present application, the preset duration condition comprises a preset duration threshold, and the time difference value does not satisfy the preset duration condition when the time difference value is greater than the preset duration threshold; the apparatus further comprises:

[0045] a second determining module, configured to determine a transmission time length of a plurality of historical data packets between the target communication device and the source communication device according to historical data of communication between the target communication device and the source communication device, the transmission time length of the historical data packets being a historical time difference between a sending time point of the historical data packets and a receiving time point of the historical data packets, wherein all the historical data packets are of a normal data packet type;

[0046] The second determining module is further configured to determine a statistical value of all the historical time difference values according to the historical time difference values of all the historical data packets, and determine the statistical value as a preset time threshold value, wherein the statistical value includes one of an average value, an extreme value and a median value.

[0047] As an optional implementation, in the second aspect of the present application, the judging sub-module is further configured to:

[0048] judge whether the signal strength between the target communication device and the source communication device is lower than a predetermined signal strength threshold value, and trigger the determining sub-module to perform the operation of determining that the type of the target data packet is the relay attack type when it is judged that the signal strength between the target communication device and the source communication device is not lower than the signal strength threshold value.

[0049] A third aspect of the present application discloses another relay attack detection device, which comprises:

[0050] a memory storing executable program codes;

[0051] a processor coupled with the memory;

[0052] The processor invokes the executable program codes stored in the memory to execute part or all steps of any one of the relay attack detection methods disclosed in the first aspect of the present application.

[0053] A fourth aspect of the present application discloses a computer storage medium storing computer instructions, which are invoked to execute part or all steps of any one of the relay attack detection methods disclosed in the first aspect of the present application.

[0054] Compared with the prior art, the present application has the following beneficial effects:

[0055] In the present application, the target communication device detects whether the target data packet is received, the target data packet carries a target timestamp, and the target timestamp is generated by the source communication device of the target data packet based on the generation mode of the timestamp corresponding to the target data packet; when the target communication device receives the target data packet, the target communication device determines the type of the target data packet according to the target timestamp and the local timestamp of the target communication device, and the type is used to indicate whether the target data packet is a relay attack data packet. It can be seen that the present application can efficiently identify relay attacks through a timestamp detection mechanism, improve the speed and accuracy of relay attack detection, improve the security of the communication device, prevent relay attacks, increase the difficulty of relay attacks, dynamically adjust the preset time threshold according to the mathematical statistics of historical data, and continuously optimize the set time threshold to make it reach a more accurate and reasonable range, improve the adaptability and universality of the present application, maintain the time of the target communication device and the source communication device at a high consistency level through multiple time synchronization protocol modes, further improve the accuracy of the timestamp, and further improve the accuracy of the relay attack detection. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0057] Figure 1 is a flow diagram of a relay attack detection method disclosed by an embodiment of the present application;

[0058] Figure 2 is a flow diagram of another relay attack detection method disclosed by an embodiment of the present application;

[0059] Figure 3 is a structural diagram of a relay attack detection device disclosed by an embodiment of the present application;

[0060] Figure 4 is a structural diagram of another relay attack detection device disclosed by an embodiment of the present application;

[0061] Figure 5 is a structural diagram of another relay attack detection device disclosed by an embodiment of the present application. DETAILED DESCRIPTION

[0062] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of the present application.

[0063] The terms "first", "second", and the like in the description and claims of the present application and the above drawings are used to distinguish different objects, rather than to describe a particular order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product, or end including a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed or can optionally include other steps or units inherent to the process, method, product, or end.

[0064] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily all refer to the same embodiment, nor is it necessarily mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0065] The present application discloses a method and device, the detection method and device of relay attack can efficiently identify relay attack through a timestamp detection mechanism, improve the speed and accuracy of relay attack detection, improve the security of communication equipment, prevent relay attack, and increase the difficulty of relay attack. In addition, one or more embodiments of the present application can be applied to any scene requiring relay attack detection, such as smart key unlocking process, non-contact withdrawal process, etc., and the embodiments of the present application are not limited.

[0066] Embodiment one

[0067] Please refer to Figure 1 , Figure 1 is a flowchart of a relay attack detection method disclosed by an embodiment of the present application. Wherein, Figure 1 The described method can be applied to a relay attack detection device, which can be a separate device (such as a Bluetooth module, a Wifi module), or can be integrated in a communication equipment (such as a vehicle-mounted device that can be remotely unlocked), and the embodiments of the present application are not limited.

[0068] As Figure 1As shown, the detection method of the relay attack can include the following operations:

[0069] 101, the target communication device detects whether a target data packet is received, the target data packet carrying a target timestamp.

[0070] In the embodiment of the application, the target communication device communicates through wireless communication, and the wireless communication technology can be Bluetooth technology, Wifi technology, ZigBee technology, NFC technology, etc., which is not limited in the embodiment of the application. The target data packet received by the target communication device at least includes a target timestamp, wherein the target timestamp is generated by the source communication device of the target data packet based on the generation method of the timestamp corresponding to the target data packet. It should be noted that the relay attack involved in the application refers to that the relay device captures the target data packet sent by the source communication device to the target communication device, saves the sent target data packet, and re-sends it to the target device to deceive the target communication device to perform a specific operation. The relay device cannot modify the target timestamp in the target data packet.

[0071] 102, when the target communication device receives the target data packet, the target communication device determines the type of the target data packet according to the target timestamp and the local timestamp of the target communication device.

[0072] In the embodiment of the application, when the target communication device detects that the target data packet is received, the target timestamp in the target data packet is parsed, and the target communication device determines the receiving time of the target data packet when the target data packet is received, that is, the above local timestamp. The target communication device can determine the type of the target data packet according to the mathematical relationship between the target timestamp and the local timestamp, and the type is used to indicate whether the target data packet is a relay attack data packet.

[0073] It can be seen that the method described in the embodiment of the application can efficiently identify relay attacks through a timestamp detection mechanism, improve the speed and accuracy of relay attack detection, improve the security of the communication device, prevent relay attacks, and increase the difficulty of relay attacks.

[0074] In an optional embodiment, the target communication device determines the type of the target data packet according to the target timestamp and the local timestamp of the target communication device, which can include the following operations:

[0075] The target communication device calculates the time difference between the target timestamp of the target data packet and the local timestamp of the target communication device;

[0076] The target communication device judges whether the time difference satisfies a preset time length condition, and when it is judged that the time difference does not satisfy the preset time length condition, determines that the type of the target data packet is a relay attack type, which is used to represent that the target data packet is a relay attack data packet.

[0077] In the embodiment of the application, when the target communication device receives the target data packet, the time length between the target timestamp and the local timestamp is calculated, and whether the target data packet is a relay attack data packet is determined by judging whether the time length satisfies a preset time length condition. The preset time length condition can include being greater than a preset time length threshold or being less than the preset time length threshold, and the embodiment of the application is not limited. When the target communication device judges that the time length does not satisfy the preset condition, it is determined that the type of the target data packet is a relay attack type; when the target communication device judges that the time length satisfies the preset condition, it is determined that the type of the target data packet is a non-relay attack type. For example, the preset condition is a preset time length of 10 ms, and if the target timestamp in the target data packet is 00:0140 ms and the local timestamp of the target data packet is 00:0145 ms, the time difference is 5 ms, which is less than the preset time length of 10 ms, indicating that the target data packet is not a relay attack data packet.

[0078] It can be seen that the method described in the embodiment of the application can efficiently identify relay attacks through a timestamp detection mechanism, and different preset conditions can be set to adjust the judgment threshold of different data packets, thereby improving the adaptability and universality of the application and further improving the accuracy of identifying relay attacks.

[0079] In another optional embodiment, the target timestamp is generated by the following method:

[0080] The target communication device judges whether the target data packet enters a sending stage, and when it is judged that the target data packet enters the sending stage, records the current local time point of the source communication device;

[0081] The target communication device delays the current local time point of the source communication device by a preset time length of the sending stage to obtain a target sending time point;

[0082] The target communication device determines the target sending time point as the target timestamp.

[0083] In the embodiment of the present application, the target timestamp is a real time point when the target data packet is sent out, which is calculated by the source communication device according to its local time, and then the real time point is converted into a timestamp and packaged into the target data packet. Before the source communication device sends out the target data packet, it can determine whether it has entered the sending stage program by judging, and when it is determined to enter the sending stage program, the current local time point is recorded. Then, the duration of the sending stage is determined in advance, and the time point after the duration of the current local time point is determined as the target sending time point. For example, the instruction for the source communication device to send a data packet is Send(), and according to the clock frequency of the source communication device, the duration of executing the entire Send() is 10 ms, when the target data packet enters the sending stage at 00:00:00:010 (hour: minute: second: millisecond), the real sending time point of the target data packet is 00:00:00:020, that is, the target timestamp in the target data packet is 00:00:00:020. It should be noted that the format of the target timestamp can be in the form of time format, in the form of decimal, or in the form of binary, and the embodiment of the present application is not limited.

[0084] It can be seen that the method described in the embodiment of the present application can efficiently identify relay attacks through a timestamp detection mechanism, and at the same time provides an accurate way to calculate the target timestamp, reduces the error caused by the long duration of the packaging and sending stage, improves the precision and accuracy of the target timestamp, and further improves the precision and accuracy of the relay attack detection.

[0085] In another optional embodiment, the method of the present application can further include the following operations:

[0086] The preset duration condition includes a preset duration threshold, and the time difference value not satisfying the preset duration condition is that the time difference value is greater than the preset duration threshold; before determining the type of the target data packet according to the target timestamp and the local timestamp of the target communication device, the preset duration threshold is determined, and the specific operation is as follows:

[0087] The target communication device determines the transmission duration of a plurality of historical data packets between the target communication device and the source communication device according to historical data of communication between the target communication device and the source communication device, the transmission duration of the historical data packet is a historical time difference value between the sending time point of the historical data packet and the receiving time point of the historical data packet, and the type of all historical data packets is a normal data packet type;

[0088] The target communication device determines a statistical value of all historical time difference values according to all historical time difference values of all historical data packets, and determines the statistical value as a preset time threshold, wherein the statistical value includes one of the average value, the extreme value and the median value.

[0089] In the embodiment of the present application, the target communication device can count a plurality of historical data packets of non-relay attacks between the target communication device and the source communication device, calculate a statistical value of the transmission duration corresponding to the plurality of non-relay attack historical data packets according to the sending time and the receiving time of each non-relay attack data packet, and determine the statistical value as the preset duration threshold, wherein the statistical value can be one of the average value, the extreme value (maximum value or minimum value), and the median value, and can also be a statistical value calculated according to the average value and the variance value of the transmission duration corresponding to the non-relay attack historical data packets. With the continuous increase of the sample number of the historical data packets, the setting of the preset duration threshold will also become more accurate and reasonable.

[0090] It can be seen that the method described in the embodiment of the present application can efficiently identify relay attacks through a timestamp detection mechanism, and can dynamically adjust the preset duration threshold according to the mathematical statistics of historical data with the continuous transmission of normal data packets, and continuously optimize the set duration threshold to make it reach a more accurate and reasonable range, which is beneficial to improve the adaptability of the present application and reduce the possibility of being attacked by relay.

[0091] Embodiment two

[0092] Please refer to Figure 2 , Figure 2 is a flowchart of another relay attack detection method disclosed in the embodiment of the present application. Among them, Figure 2 The method described can be applied to a relay attack detection method device, which can be an independent device (such as a Bluetooth module, a Wifi module), or can be integrated in a communication device (such as a vehicle-mounted device that can be remotely unlocked), and the embodiment of the present application does not limit it. As shown in Figure 2 The relay attack detection method can include the following operations:

[0093] 201, the target communication device and the source communication device perform time synchronization operation; wherein the time synchronization operation can include the following operations:

[0094] The target communication device establishes a communication connection with the source communication device, receives a time synchronization negotiation data packet sent by the source communication device, and synchronizes the local time of the source communication device to the local time of the target communication device according to the received time synchronization negotiation data packet, wherein the time synchronization negotiation data packet includes the local time of the source communication device; or,

[0095] The target communication device establishes a communication connection with the source communication device, and sends a time synchronization negotiation data packet to the source communication device, wherein the time synchronization negotiation data packet comprises a local time of the target communication device, and the time synchronization negotiation data packet is used for synchronizing the local time of the target communication device to a local time of the source communication device according to the local time of the target communication device by the source communication device.

[0096] In the embodiment of the present application, the target communication device should perform a time synchronization operation with the source communication device before detecting whether the target data packet is received, so that the times of the target communication device and the source communication device are highly consistent.

[0097] The embodiment of the present application provides two solutions for the direct time synchronization operation between the target communication device and the source communication device: one is that the target communication device is a passive party, receives a time synchronization negotiation data packet sent by the source communication device, wherein the time synchronization negotiation data packet comprises a local time of the source communication device, and the target communication device updates the local time of the source communication device to the local time of the target communication device when the time synchronization negotiation data packet is received; the other is that the target communication device is an active party, sends a time synchronization negotiation data packet to the source communication device, wherein the time synchronization negotiation data packet comprises a local time of the target communication device, and the source communication device updates the local time of the target communication device to the local time of the source communication device after receiving the time synchronization negotiation data packet.

[0098] Further, the embodiment of the present application provides a time synchronization method using a time server for the non-direct communication between the target communication device and the source communication device, and the specific method is as follows:

[0099] The target communication device acquires a first time of the time server, and sets the first time as a local time of the target communication device, wherein the time server is used for providing a calibrated standard time;

[0100] In addition, the time server is further used for determining a second time at which the source communication device can keep time synchronization with the target communication device according to a first synchronization request triggered by the source communication device or a second synchronization request triggered by the target communication device, and providing the second time to the source communication device, so as to trigger the source communication device to set the second time as a local time of the source communication device, and the source communication device is a device which needs to communicate with the target communication device.

[0101] The first synchronization request is used for requesting to keep time synchronization with the target communication device, and the second synchronization request is used for requesting to set the local time of the source communication device to realize time synchronization between the source communication device and the target communication device.

[0102] The time server is a network time synchronization server, and is used for providing high-precision time correction, such as an NTP server. It should be noted that the time server can be a third-party gateway device which can communicate with the target communication device and the source communication device, and is used for providing reference time (or calibrated time) for the target communication device and the source communication device to perform time synchronization. The embodiment of the present application does not limit the above two solutions. The first time synchronization solution is as follows: first, the target communication device communicates with the time server, and obtains the first time of the time server as the local time of the target communication device; second, the source communication device triggers a time synchronization request or the target communication device triggers a time synchronization request for the source communication device, and finally, the source communication device sends a time synchronization protocol to the same time server, requests the time server to send the second time which is synchronized with the first time to the source communication device, and sets the second time as the local time of the source communication device, thereby completing the time synchronization between the target communication device and the source communication device. The second time synchronization solution is similar to the first time synchronization solution. First, the source communication device communicates with the time server, and obtains the first time of the time server as the local time of the source communication device; second, the target communication device triggers a time synchronization request or the source communication device triggers a time synchronization request for the target communication device, and finally, the target communication device sends a time synchronization protocol to the same time server, requests the time server to send the second time which is synchronized with the first time to the target communication device, and sets the second time as the local time of the target communication device, thereby completing the time synchronization between the target communication device and the source communication device.

[0103] For example, the target communication device communicates with the NTP time server, obtains the first time (13:00:00:000) of the East 8 time zone, and sets the first time as the local time of the target communication device; then the target communication device sends a time synchronization request to the source communication device, requests the source communication device to perform time synchronization with the target communication device, and the time synchronization request can include the time server information (the IP address of the NTP time server), the information of the first time (the time zone), and the like, so that the source communication device can analyze the IP address of the NTP server and the time zone of the first time; then the source communication device requests the same NTP server to obtain the second time (13:00:00:300) of the East 8 time zone, and sets the second time as the local time of the source communication device. Because the target communication device and the source communication device have performed high-precision time correction with the NTP server, the time between the target communication device and the source communication device is consistent.

[0104] 202、the target communication device detects whether the target data packet is received, and the target data packet carries a target timestamp.

[0105] 203、when the target communication device receives the target data packet, the target communication device determines the type of the target data packet according to the target timestamp and a local timestamp of the target communication device.

[0106] In the embodiments of the present application, for other descriptions of steps 202-203, please refer to the detailed description of steps 101-102 in Embodiment 1 respectively, and the embodiments of the present application will not be repeated here.

[0107] It can be seen that the method described in the embodiments of the present application can efficiently identify relay attacks through a timestamp detection mechanism, and at the same time, the time of the target communication device and the source communication device can be kept at a high level of consistency through various time synchronization protocol methods, further improving the accuracy of the timestamp, and then improving the accuracy of the relay attack detection, and increasing the difficulty of the relay attack.

[0108] In an optional embodiment, the method can further include the following operations:

[0109] After the target communication device judges that the time difference value does not satisfy the preset time length condition, the target communication device judges whether the signal strength between the target communication device and the source communication device is lower than a predetermined signal strength threshold value;

[0110] When the target communication device judges that the signal strength between the target communication device and the source communication device is not lower than the signal strength threshold value, the target communication device performs the operation of determining that the type of the target data packet is a relay attack type.

[0111] In the embodiment of the present application, after judging that the time difference between the target timestamp and the local timestamp does not satisfy the preset time length condition, the target communication device can also judge that the type of the target data packet is a relay attack type, at this time, by further judging the signal strength between the two to further determine whether the type of the target data packet is indeed a relay attack type, that is, a second confirmation is made. The present application is based on considering that the relay device also exists malicious attack relay device and normal forwarding relay device, wherein the necessity factor of data packet forwarding is generally that the signal strength of the source communication device directly sending the data packet to the target communication device is weak, at this time, the relay device is needed to help forwarding, at this time, the signal strength of the relay device should be higher than the signal strength of the source communication device. Therefore, the present application can also further determine whether the type of the target data packet is a relay attack type by comparing the detection value of the signal strength with the pre-determined signal strength threshold. Because, once the data packet needs to be forwarded by the relay, it means that the signal strength of the source communication device sending the target data packet to the target communication device is already relatively weak, but if the signal strength of the source communication device is relatively high, the forwarding of the relay device is completely unnecessary. For example, the signal strength of the source communication device sending the data packet to the target communication device is -50dBm, and the pre-determined signal strength threshold in the target communication device is -60dBm, at this time, the target communication device judges that the time difference of receiving the target data packet has exceeded the preset threshold, and judges that the signal strength (-50dBm) of the source communication device sending the data packet to the target communication device exceeds the pre-determined signal strength threshold (-60dBm), then it can be confirmed that the target data packet is a relay attack type data packet.

[0112] It can be seen that the method described in the embodiment of the present application can efficiently identify relay attacks through a timestamp detection mechanism, and at the same time, in combination with the comparison of the signal strength between the communication devices and the signal strength threshold, the relay attack type is confirmed twice, which greatly improves the accuracy and reliability of the detection result, and is beneficial to reduce the possibility of false positives.

[0113] Embodiment three

[0114] Please refer to Figure 3 , Figure 3 is a structure diagram of a relay attack detection device disclosed in the embodiment of the present application. The relay attack detection method device can be an independent device (such as a Bluetooth module, a Wifi module), or can be integrated in a communication device (such as a vehicle-mounted device that can be remotely unlocked), and the embodiment of the present application does not limit it. It should be noted that the relay attack detection device refers to the steps in the relay attack detection method described in embodiment one and embodiment two, and detailed description is not repeated in this embodiment, as shown in Figure 3 the relay attack detection device can include:

[0115] The receiving module 301 is configured to detect whether a target data packet is received, the target data packet carrying a target timestamp, the target timestamp being generated by a source communication device of the target data packet based on a generation manner of a timestamp corresponding to the target data packet;

[0116] The first determining module 302 is configured to, when the receiving module detects that the target data packet is received, determine a type of the target data packet according to the target timestamp and a local timestamp of the target communication device, the type being used to indicate whether the target data packet is a relay attack data packet.

[0117] It can be seen that the apparatus described in the embodiments of the present application can efficiently identify a relay attack through a timestamp detection mechanism, improve the rate and accuracy of relay attack detection, and improve the security of the communication device, which is conducive to preventing relay attacks and increasing the difficulty of relay attacks.

[0118] In the optional embodiment, further, the target timestamp is specifically generated in the following manner:

[0119] The source communication device judges whether the target data packet enters a sending stage, and when it is judged that the target data packet enters the sending stage, a current local time point of the source communication device is recorded;

[0120] The source communication device delays the current local time point of the source communication device by a predetermined duration of the sending stage to obtain a target sending time point;

[0121] The source communication device determines the target sending time point as the target timestamp.

[0122] It can be seen that the apparatus described in the embodiments of the present application can efficiently identify a relay attack through a timestamp detection mechanism, and at the same time, provide a way of accurately calculating a target timestamp, reduce the error caused by the duration of the sending stage, and improve the precision and accuracy of the target timestamp, thereby improving the precision and accuracy of relay attack detection.

[0123] In an optional embodiment, the first determining module 302 can include:

[0124] The calculating sub-module 3021 is configured to calculate a time difference value between the target timestamp of the target data packet and the local timestamp of the target communication device;

[0125] The judging sub-module 3022 is configured to judge whether the time difference value determined by the calculating sub-module 3021 satisfies a preset duration condition;

[0126] The determining sub-module 3023 is configured to determine that the type of the target data packet is a relay attack type when the judging sub-module 3022 determines that the time difference value does not satisfy the preset time length condition, and the relay attack type is used to represent that the target data packet is a relay attack data packet.

[0127] It can be seen that the device described in the embodiment of the present application can efficiently identify relay attacks through a timestamp detection mechanism, and can set different preset conditions to adjust the judgment threshold of different data packets, thereby improving the adaptability and universality of the present application, and further improving the accuracy of identifying relay attacks.

[0128] In this optional embodiment, further, the judging sub-module 3022 can be further configured to:

[0129] When the judging sub-module 3022 determines that the time difference value determined by the calculating sub-module 3021 does not satisfy the preset time length condition, the judging sub-module 3022 is further configured to determine whether the signal strength between the target communication device and the source communication device is lower than a predetermined signal strength threshold value, and trigger the determining sub-module 3023 to perform the operation of determining that the type of the target data packet is a relay attack type when it is determined that the signal strength between the target communication device and the source communication device is not lower than the signal strength threshold value.

[0130] It can be seen that the device described in the embodiment of the present application can efficiently identify relay attacks through a timestamp detection mechanism, and can set different preset conditions to adjust the judgment threshold of different data packets, thereby improving the adaptability and universality of the present application, and further improving the accuracy of identifying relay attacks.

[0131] In another optional embodiment, as shown in Figure 4 The preset time length condition includes a preset time length threshold value, and the time difference value does not satisfy the preset time length condition means that the time difference value is greater than the preset time length threshold value.

[0132] The device can further include:

[0133] The second determining module 303 is configured to determine the transmission time length of a plurality of historical data packets between the target communication device and the source communication device according to historical data of communication between the target communication device and the source communication device, and the transmission time length of the historical data packet is a historical time difference value between a sending time point of the historical data packet and a receiving time point of the historical data packet, wherein the type of all historical data packets is a normal data packet type.

[0134] The second determining module 303 is further configured to determine a statistical value of all historical time difference values according to the historical time difference values of all historical data packets, and determine the statistical value as a preset time threshold value, wherein the statistical value includes one of an average value, an extreme value, and a median value.

[0135] It can be seen that the device described in the embodiment of the application can efficiently identify relay attacks through a timestamp detection mechanism, and can dynamically adjust the preset time threshold according to the mathematical statistics of historical data while continuously transmitting normal data packets, so as to continuously optimize the set time threshold to make it reach a more accurate and reasonable range, thereby being beneficial to improving the adaptability of the application and reducing the possibility of being attacked by relay attacks.

[0136] In yet another optional embodiment, as shown in Figure 4 The device can further include:

[0137] The time synchronization module 304 is configured to, before the receiving module 301 detects whether the target data packet is received, establish a communication connection with the source communication device, receive a time synchronization negotiation data packet sent by the source communication device, and synchronize the local time of the source communication device to the local time of the target communication device according to the received time synchronization negotiation data packet, wherein the time synchronization negotiation data packet includes the local time of the source communication device; or

[0138] The time synchronization module 304 is configured to, before the receiving module 301 detects whether the target data packet is received, establish a communication connection with the source communication device, receive a time synchronization negotiation data packet sent by the source communication device, and synchronize the local time of the source communication device to the local time of the target communication device according to the received time synchronization negotiation data packet, wherein the time synchronization negotiation data packet includes the local time of the source communication device; or

[0139] The time synchronization module 304 is configured to, before the receiving module 301 detects whether the target data packet is received, establish a communication connection with the source communication device, receive a time synchronization negotiation data packet sent by the source communication device, and synchronize the local time of the source communication device to the local time of the target communication device according to the received time synchronization negotiation data packet, wherein the time synchronization negotiation data packet includes the local time of the source communication device; or

[0140] It can be seen that the device described in the embodiment of the application can efficiently identify relay attacks through a timestamp detection mechanism, and can maintain the time of the target communication device and the source communication device at a highly consistent level through various time synchronization protocol methods, further improve the accuracy of the timestamp, and further improve the accuracy of relay attack detection, thereby increasing the difficulty of relay attacks.

[0141] Embodiment four

[0142] Please refer to Figure 5 , Figure 5 is a schematic structural diagram of another relay attack detection device disclosed by the embodiment of the present application. The relay attack detection method device can be a separate device (such as a Bluetooth module, a Wifi module), or can be integrated in a communication device (such as a vehicle-mounted device that can be remotely unlocked), and the embodiment of the present application is not limited. As shown in Figure 5 , the relay attack detection device can include:

[0143] a memory 401 storing executable program codes;

[0144] a processor 402 coupled with the memory 401;

[0145] The processor 402 calls the executable program codes stored in the memory 402 to execute part or all of the steps of the relay attack detection method disclosed in the embodiment one or the embodiment two of the present application.

[0146] Embodiment five

[0147] The embodiment of the present application discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, the steps of the relay attack detection method disclosed in the embodiment one or the embodiment two of the present application are executed.

[0148] The device embodiments described above are only schematic, wherein the modules described as separate components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, that is, they can be located in one place, or can be distributed on multiple network modules. According to actual needs, part or all of the modules can be selected to achieve the purpose of the embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0149] Those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary universal hardware platform, and of course can also be implemented by hardware, through the specific description of the above embodiments. Based on such understanding, the above technical solutions can be embodied in the form of a software product in essence or in the form of a part of the prior art. The computer software product can be stored in a computer readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage, a magnetic tape storage, or any other computer readable medium that can be used to carry or store data.

[0150] It should be noted that the computer program code required for the operation of the various parts of the specification can be written in any one or more programming languages, including object-oriented programming languages such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc., conventional programmatic programming languages such as C language, Visual Basic, Fortran2003, Perl, COBOL 2002, PHP, ABAP, dynamic programming languages such as Python, Ruby and Groovy, or other programming languages. The program code can be completely run on a computer (PC, embedded intelligent device, etc.), or run as a separate software package on a user computer, or partially run on a user computer and partially run on a remote computer, or completely run on a remote computer or server. In the latter case, the remote computer can be connected to the user computer through any network form, such as a local area network (LAN) or a wide area network (WAN), or connected to an external computer (for example, through the Internet), or in a cloud computing environment, or used as a service such as software as a service (SaaS).

[0151] It should be noted that the disclosed relay attack detection method and device are only the preferred embodiments of the present application, and are used to illustrate the technical solutions of the present application, but not to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent ones. The modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting relay attacks, characterized in that, The method includes: The target communication device detects whether it has received a target data packet, the target data packet carrying a target timestamp, the target timestamp being generated by the source communication device of the target data packet based on the timestamp generation method corresponding to the target data packet; When the target communication device receives the target data packet, the target communication device determines the type of the target data packet based on the target timestamp and the target communication device's local timestamp. The type is used to indicate whether the target data packet is a relay attack data packet. The target communication device determines the type of the target data packet based on the target timestamp and the target communication device's local timestamp, including: The target communication device calculates the time difference between the target timestamp of the target data packet and the local timestamp of the target communication device. The target communication device determines whether the time difference value meets the preset duration condition. When it is determined that the time difference value does not meet the preset duration condition, the target data packet is determined to be of the type of relay attack. The relay attack type is used to indicate that the target data packet is a relay attack data packet. The method further includes: After determining that the time difference does not meet the preset duration condition, the target communication device determines whether the signal strength between itself and the source communication device is lower than a predetermined signal strength threshold. When the target communication device determines that the signal strength between the target communication device and the source communication device is not lower than the signal strength threshold, it performs the operation of determining that the type of the target data packet is a relay attack type. The target timestamp is generated in the following way: The source communication device determines whether the target data packet has entered the transmission stage. When it is determined that the target data packet has entered the transmission stage, the current local time of the source communication device is recorded. The source communication device delays its current local time by the predetermined duration of the transmission phase to obtain the target transmission time. The source communication device determines the target transmission time point as the target timestamp; Furthermore, before the target communication device detects whether it has received the target data packet, the method further includes: The target communication device and the source communication device perform a time synchronization operation; the time synchronization operation includes a time synchronization operation performed directly between the target communication device and the source communication device or a time synchronization operation performed through indirect communication between the target communication device and the source communication device. The time synchronization operation directly performed between the target communication device and the source communication device includes: The target communication device establishes a communication connection with the source communication device, receives a time synchronization negotiation data packet sent by the source communication device, and synchronizes the local time of the source communication device to the local time of the target communication device according to the received time synchronization negotiation data packet, wherein the time synchronization negotiation data packet includes the local time of the source communication device; or, The target communication device establishes a communication connection with the source communication device and sends a time synchronization negotiation data packet to the source communication device. The time synchronization negotiation data packet includes the local time of the target communication device and is used by the source communication device to synchronize the local time of the target communication device with the local time of the source communication device according to the local time of the target communication device. And, the time synchronization operation performed between the target communication device and the source communication device through indirect communication includes: The target communication device obtains a first time from the time server and sets the first time as the local time of the target communication device, wherein the time server is used to provide a calibrated standard time; Furthermore, the time server is also configured to determine a second time at which the source communication device can maintain time synchronization with the target communication device based on a first synchronization request triggered by the source communication device or a second synchronization request triggered by the target communication device, and provide the second time to the source communication device to trigger the source communication device to set the second time as the local time of the source communication device, wherein the source communication device is a device that needs to communicate with the target communication device; The first synchronization request is used to request time synchronization with the target communication device, and the second synchronization request is used to request setting the local time of the source communication device to achieve time synchronization between the source communication device and the target communication device.

2. The relay attack detection method according to claim 1, characterized in that, The preset duration condition includes a preset duration threshold, and the time difference does not meet the preset duration condition when the time difference is greater than the preset duration threshold; Before determining the type of the target data packet based on the target timestamp and the local timestamp of the target communication device, the method further includes: The target communication device determines the transmission duration of multiple historical data packets between the target communication device and the source communication device based on the historical communication data between the target communication device and the source communication device. The transmission duration of the historical data packets is the historical time difference between the sending time and the receiving time of the historical data packets. All of the historical data packets are of the normal data packet type. The target communication device determines the statistical value of all the historical time differences based on the historical time differences of all the historical data packets, and sets the statistical value as a preset time threshold. The statistical value includes one of the following: average value, extreme value, and median value.

3. A relay attack detection device, characterized in that, The apparatus is applied to a target communication device, the apparatus is used to perform the relay attack detection method as described in any one of claims 1-2, and the apparatus comprises: The receiving module is used to detect whether a target data packet has been received. The target data packet carries a target timestamp, which is generated by the source communication device of the target data packet based on the timestamp generation method corresponding to the target data packet. The first determining module is used to determine the type of the target data packet based on the target timestamp and the local timestamp of the target communication device when the receiving module detects that the target data packet has been received. The type is used to indicate whether the target data packet is a relay attack data packet. The first determining module includes: The calculation submodule is used to calculate the time difference between the target timestamp of the target data packet and the local timestamp of the target communication device. The judgment submodule is used to determine whether the time difference value meets the preset duration condition; The determination submodule is used to determine that the type of the target data packet is a relay attack type when the judgment submodule determines that the time difference does not meet the preset duration condition. The relay attack type is used to indicate that the target data packet is a relay attack data packet. The target timestamp is generated in the following way: The source communication device determines whether the target data packet has entered the transmission stage. When it is determined that the target data packet has entered the transmission stage, the current local time of the source communication device is recorded. The source communication device delays its current local time by the predetermined duration of the transmission phase to obtain the target transmission time. The source communication device determines the target transmission time point as the target timestamp; The device also includes: The time synchronization module is used to perform a time synchronization operation with the source communication device before the receiving module detects whether the target data packet has been received; the time synchronization operation includes a time synchronization operation performed directly between the target communication device and the source communication device or a time synchronization operation performed through indirect communication between the target communication device and the source communication device.

4. A relay attack detection device, characterized in that, The device includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the relay attack detection method as described in any one of claims 1-2.

5. A computer storage medium, characterized in that, The computer storage medium stores computer instructions, which, when invoked, are used to execute the relay attack detection method as described in any one of claims 1-2.

Images