NFC relay attack judgment, security authentication system and method based on space-time evolution

Abstract

The application discloses a kind of based on space-time evolution's NFC relay attack determination, security authentication system and method, based on multi-factor space-time perception algorithm, access location, communication time and access time are considered as security verification factors, while tampering with verification information, replay attack and other attacks that can occur in verification process can also provide effective defense.Based on the characteristics of NFC application scene diversification, device type is various, design a kind of convenient and easy-to-use software level defense measure, can realize effective defense without needing to make rechange to existing device hardware, reduce the cost of realizing relay attack defense.In addition to installing APP, no other additional work is needed, greatly improve user friendliness and implementability, provide a practical technical approach for solving the hidden danger of NFC payment.

Description

Technical Field

[0001] This invention belongs to the field of wireless communication information security technology, and relates to a near field communication (NFC) relay attack determination, security authentication system and method, specifically a near field communication relay attack determination system and method based on spatiotemporal evolution, and a security authentication system and method based on spatiotemporal evolution and RSA signature encryption. Background Technology

[0002] Near Field Communication (NFC) is an emerging wireless technology jointly promoted by renowned manufacturers such as Philips, Nokia, and Sony. It evolved from contactless Radio Frequency Identification (RFID) and interconnection technologies, combining inductive card readers, inductive cards, and point-to-point functionality on a single chip. It enables identification and data exchange with compatible devices over short distances, allowing for various applications such as mobile payments, electronic ticketing, access control, mobile identity verification, and anti-counterfeiting using mobile terminals. Through continuous research and development, this technology has evolved from a simple merger of RFID and network technologies into a short-range wireless communication technology, finding applications in many aspects of life and experiencing rapid growth.

[0003] NFC and QR codes, as the two giants of mobile payment, dominate the vast majority of the mobile payment market. Compared with QR codes, the main advantages of NFC payment are its convenience and security. During use, matching is completed simply by near-field contact, and the transaction time is extremely short. At the same time, the close proximity required between the two devices in the NFC payment process ensures stronger security than QR codes. It can be said that security and convenience are the foundation of NFC payment's development. However, with the widespread adoption of NFC payment technology, NFC security issues are becoming increasingly prominent. In recent years, numerous papers have analyzed the feasibility of using relay attacks to attack NFC payments, and a successful relay attack was demonstrated at a hacker conference in 2017. NFC payment security is facing a significant threat from relay attacks.

[0004] Common attack methods against NFC include: UID (User Identification) tampering, reading sensitive information from the card, and relay attacks. Among these, UID tampering and reading sensitive information from the card are relatively difficult to attack under current security protocols and encryption protection, and are unlikely to pose a threat to NFC payments. Relay attacks are the most prevalent form of NFC attack, and these attacks are extremely harmful. Furthermore, existing NFC payment systems struggle to effectively defend against NFC relay attacks. Summary of the Invention

[0005] To address the high risk and difficulty in defending against relay attacks, this invention proposes an NFC relay attack determination and security authentication system and method based on spatiotemporal evolution. Based on a multi-factor spatiotemporal perception algorithm, it comprehensively considers access location, communication time, and access time as security verification factors. At the same time, it can also provide effective defense against attacks that may occur during the verification process, such as tampering with verification information and replay attacks.

[0006] The present invention provides an NFC relay attack detection system based on spatiotemporal evolution, comprising several WiFi base stations and several mobile cellular network base stations; The location information of the real card and the card reader is obtained by combining WiFi positioning with mobile cellular network base station positioning. The distance between the two is used to determine whether a relay attack has occurred. Meanwhile, by using communication time as an indicator to correct the local time of the real card and the card reader, and by comprehensively considering access time and communication time, a time-factor relay attack identification with high feasibility is achieved.

[0007] This invention provides a method for determining NFC relay attacks based on spatiotemporal evolution, comprising the following steps: Step A1: Obtain the location information of the real card and the card reader by combining WiFi positioning with mobile cellular network base station positioning. If the location distance is greater than the positioning accuracy, substitute the location distance and positioning accuracy into the sigmoid function to calculate the result P1 and save it; otherwise, save the zero value. Step A2: Use communication time as an indicator to calibrate the local time of the physical card and the card reader; If the difference between the time the device receives the response and the time the device sends the packet is greater than the communication time allowable threshold, then substitute the difference between the time the device receives the response and the time the device sends the packet and the communication time allowable threshold into the sigmoid function to calculate the result P2 and save it; otherwise, save the value as zero. The device includes a physical card and a card reader. If the time difference between the access times of the two devices is greater than the allowable access time threshold, then substitute the time difference between the two devices and the allowable access time threshold into the sigmoid function to calculate the result P3 and save it; otherwise, save the value as zero. Step A3: Calculate the overall probability using P1, P2, and P3. If the overall probability is greater than the allowed probability threshold, an attack is determined to have occurred; otherwise, no attack is determined to have occurred.

[0008] This invention provides an NFC security authentication system based on spatiotemporal evolution, comprising a server, a card reader, an HCE (Host-based Card Emulation) emulation card, and a client; the client includes a system layer, a perception layer, a communication layer, an interface layer, and an application layer; The server is used to issue digital certificates to card readers and HCE emulation cards; The card reader is used by the communication initiator to actively send a request; The HCE emulation card is used to respond to the card reader; The system layer is used to establish a connection between the card reader and the HCE emulated card. This process is mainly completed by the NFC chip and the Android system. The perception layer is used to perceive authentication information, including a location information acquisition module and a time information acquisition module, which respectively acquire the location and time when the NFC connection layer is accessed; The communication layer includes a key management module and an NFC communication module. The key management module generates public and private keys and requests a digital certificate from the server. The communication module completes information exchange with the other end of the NFC communication and submits the information to the interface layer. The interface layer is used to extract information from the communication layer, complete the verification, and pass the verification result to the application layer. The application layer is used to include various NFC-based apps, primarily those that support NFC payments.

[0009] This invention provides an NFC security authentication method based on spatiotemporal evolution, characterized by comprising the following steps: Step B1: The client system layer detects the connection establishment information and obtains the current time. Then create an Intent and set its property to start; set the Intent's launch mode to ensure the application starts in a new task stack; then add time information t1 to the Intent; finally capture the Intent. Step B2: When the client discovers an NFC device, the perception layer activates the location acquisition module and the time acquisition module to acquire the location and time of the NFC access. Step B3: The NFC communication module communicates with the other end of the NFC communication. In the NFC communication, the key management module of the communication layer provides confidentiality for the communication module based on the RSA algorithm, thereby completing NFC security authentication.

[0010] Proposed solutions to defend against relay attacks, such as restricting NFC use and adding extra verification, would inconvenience users. Meanwhile, the NFC distance protocol, which uses communication latency as the sole criterion, lacks sufficient reliability due to its small latency and its variability with devices.

[0011] Based on the characteristics of NFC communication distance and short communication time and access time interval, this invention collects spatiotemporal information on smartphones and discloses an NFC relay attack judgment and security authentication system and method based on spatiotemporal evolution. Based on a multi-factor spatiotemporal perception algorithm, it comprehensively considers access location, communication time and access time as security verification factors, and can also provide effective defense against attacks such as tampering with verification information and replay attacks that may occur in the verification process.

[0012] This invention can be easily deployed on a user's Android device by installing a client. Without requiring user interaction, it can help various NFC devices provide effective protection for NFC communication without modifying the hardware, prevent relay attacks during NFC payment, safeguard secure NFC payments, greatly reduce the potential risks of NFC payments, and is safe, effective, and highly feasible.

[0013] This invention provides effective defense while protecting the two most competitive advantages of NFC payment in the mobile payment field: convenience and security. NFC payment applications enhanced by this system will be more competitive in the market and can be easily deployed to NFC-enabled devices such as smartphones. Therefore, this system has wide applications and possesses enormous market demand and development potential. Attached Figure Description

[0014] Figure 1 This is a framework diagram of an NFC security authentication system based on spatiotemporal evolution, according to an embodiment of the present invention.

[0015] Figure 2 This is a diagram of the key management module in an embodiment of the present invention.

[0016] Figure 3 This is a flowchart of the NFC communication process according to an embodiment of the present invention. Detailed Implementation

[0017] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0018] This invention designs an NFC security authentication system and method based on spatiotemporal evolution, providing a highly accurate and robust protection mechanism for the user's NFC payment process. This technology is based on a multi-factor spatiotemporal awareness algorithm, comprehensively considering access location, communication time, and access time as security verification factors. It also effectively defends against attacks that may occur during the verification process, such as tampering with verification information and replay attacks. Given the diverse application scenarios and numerous device types of NFC, a user-friendly software-level defense measure is designed, enabling effective defense without requiring modifications to existing device hardware, thus reducing the cost of relay attack defense. Since no additional work is required besides installing an app, it greatly improves user-friendliness and feasibility, providing a practical technical approach to addressing the vulnerabilities of NFC payments.

[0019] Please see Figure 1 This embodiment of the NFC security authentication system based on spatiotemporal evolution includes a server, a card reader, an HCE emulator (a mobile phone with HCE functionality), and a client. The server issues digital certificates to the card reader and the HCE emulator. The card reader and the HCE emulator are the two real participants in the NFC communication. An app is installed to implement NFC security authentication. The card reader, as the initiator of the communication, actively sends a request, and the HCE emulator responds to it.

[0020] The client in this embodiment includes a system layer, a perception layer, a communication layer, an interface layer, and an application layer.

[0021] This invention presents an NFC security authentication method based on spatiotemporal evolution, utilizing a multi-factor spatiotemporal perception algorithm that comprehensively considers access location, communication time, and access time as security verification factors. The invention employs a positioning method combining WiFi positioning and mobile cellular network base station positioning to obtain the location information of the actual card and the card reader, determining whether a relay attack has occurred based on the distance between them. This method is effective in defending against long-distance relay attacks, but due to limitations in positioning accuracy, it is insufficient as the sole criterion for determining whether a relay attack has occurred. Therefore, communication time is also used as an indicator to correct the device's local time. By comprehensively considering access time and communication time, a highly feasible time-factor relay attack identification method is achieved.

[0022] By acquiring spatial and temporal information, a multi-factor spatiotemporal perception algorithm is designed. The algorithm comprehensively considers three factors: device access time difference, data packet round-trip time difference (i.e., communication time), and geographical distance. A threshold is given for each evaluation indicator. If the current value exceeds the set threshold, the attack probability under that indicator is calculated using a formula. The three probabilities are calculated separately, and the overall attack probability is obtained using a probability addition formula. If the overall attack probability exceeds the set allowable probability, an attack is considered to have occurred. The specific steps include: Input value: Spacing Device A access time Device B access time Device A's packet sending time Packet receiving time of device B The time when device A receives the response .

[0023] Step 1: If the position spacing Greater than positioning accuracy Then, substituting the position spacing and positioning accuracy into the sigmoid function f(x) = 1 / (1 + ... ),in , s This represents the value of a certain evaluation index. This indicates the threshold value set for the indicator, and the calculation result. ,otherwise ; Step 2: If the time it takes for the device to receive the response is different from the time it sends the packet... Greater than the allowed communication time threshold The difference between the time the device receives the response and the time the device sends the packet will be used. With communication time allowable threshold Substituting the result into the sigmoid function ,otherwise ; Step 3: If there is a time difference between the connection times of the two devices Greater than the allowed access time threshold The time difference between the access times of the two devices will then be considered. Access time allowable threshold Substituting the result into the sigmoid function And save it, otherwise ; Step 4: For the three probabilities calculated in Steps 1, 2, and 3, which are mutually exclusive, use probability addition to calculate the probability of a relay attack. ; Step 5: If the probability calculated in step 4... Greater than the probability allowable threshold If the condition is met, an attack is determined to have occurred; otherwise, no attack is determined to have occurred.

[0024] In summary, when two attackers are far apart, the distance difference between them can be used to determine whether a relay attack has occurred. When the attackers are close together, the combined effect of communication time and access time factors is crucial. Communication time is typically short, timeline calibration accuracy is high, and access time can effectively detect relay attacks. When poor network conditions cause prolonged communication time, communication time becomes decisive in determining whether a relay attack has occurred. The combined effect of distance and time achieves effective defense against relay attacks under any circumstances. In the NFC security authentication method based on the spatiotemporal evolution of the multi-factor spatiotemporal awareness algorithm, the system layer mainly includes an NFC connection module responsible for establishing the connection between the card reader and the HCE emulation card. Since the Android system's NFC function does not provide a corresponding interface to notify the application when establishing an NFC connection in HCE mode, this application implements this interface itself. Implementation method: When the Android system starts the HCE function, it calls the onHostEmulationActivated() method in the android.nfc.cardemulation package. During this method call, an Intent object is created to start the application. The steps are as follows: Step 1: Connection establishment information detected, current time obtained. ; Step 2: Create an Intent and set its property to start; Step 3: Set the launch mode of the Intent to ensure that the application starts in a new task stack; Step 4: Add time information to the Intent ; Step 5: Capture the Intent, and the application starts.

[0025] In the perception layer, location and time information are collected. First, when the client detects an NFC device, it needs to inform the application, thereby activating the location and time acquisition modules to collect the location and time at the time of NFC access. The specific method is as follows: Since the application in the card reader is in the foreground, the foreground publishing system can be enabled directly in the main thread, as follows: Input: Information carrying the tag Step 1: Start the foreground publishing system in the main thread to monitor all types of NFC tags; Step 2: Detect the current Tag object; Step 3: Allow the tag to be parsed by the security authentication module; Step 4: Retrieve and return the information in the Tag.

[0026] The emulated card uses an interface implemented by the connection layer to notify the application to discover the device. Specifically, it sets an intent filter for the application's ReceiveActivity activity, with the Action property of the filter set to "nfc.hce.start". When the emulated card device discovers the other party's NFC device, it can start ReceiveActivity to complete information collection.

[0027] The perception layer also needs to implement a location acquisition module to obtain the current location information. The implementation method is as follows: Step 1: Add WiFi permissions and carrier permissions; Step 2: Create an AMapLocationClient class object to start the location service; Step 3: Set up a listener interface to listen for the startLocation() method; Step 4: When the listener method is called, obtain the current location information; Step 5: Return to current location information.

[0028] The perception layer also implements a time acquisition module, which collects the time when the other party's NFC device is detected. In the simulated card APP, after ReceiveActivity is launched, the intent of launching the APP is parsed, and the getLongExtra() method is called to obtain the time key value put in it, which is the access time. In the card reader APP, when the OnNewIntent method is launched, the System.currentTimeMillis() method is directly called to obtain the current system time, which is the access time.

[0029] The communication layer is the core of this NFC security authentication mechanism, and it is divided into a key management module and an NFC communication module.

[0030] Please see Figure 2 The key management module provides confidentiality for the communication module based on the RSA algorithm. Specifically, it includes the functions of generating local public and private key pairs and requesting digital certificates. The diagram illustrates its process. First, the user generates a public and private key locally. Then, the user encrypts (public key, user ID, random number) using the server's public key and sends it to the server. Next, the server calculates the hash code of the public key and the user ID (identity document), and encrypts the hash code using the server's private key. Finally, the hash code is encrypted using the server's private key. The encrypted hash code, along with the public key and ID, forms an identity certificate, which is then encrypted using the local public key along with the random number + 1 and returned to the local machine. The implementation steps are as follows: Input: User ID; Step 1: Set the key pair generator type to RSA; Step 2: Set the RSA key length; Step 3: Generate an RSA key pair; Step 4: Combine the user ID and public key into a byte array info; Step 5: Set the hash code calculation method to SHA-256; Step 6: Calculate the hash code of info; Step 7: Convert the generated hash code into a 64-bit hexadecimal string (hash.String); Step 8: Encrypt hash.String using the server's private key; Step 9: The encrypted information is combined with the info message to form a digital certificate; Step 10: The user saves the digital certificate.

[0031] Please see Figure 3 The image illustrates the complete process of the communication module. The NFC communication module communicates with the other end of the NFC communication module to complete NFC security authentication. The communication process involves exchanging digital certificates and performing digital signatures to ensure communication security.

[0032] First, the card reader sends a SELECT command to the emulated card to select the client; the emulated card returns its identity certificate to the card reader; the card reader receives the identity certificate, decrypts it using the emulated card's public key, and verifies its integrity. If incomplete, an attack occurs, and communication is interrupted. Next, the card reader sends its identity certificate to the emulated card; the emulated card receives this certificate, decrypts it using the server's public key, and verifies its integrity. If incomplete, an attack occurs, and communication is interrupted. Finally, the emulated card returns the security authentication information obtained from the perception layer to the card reader, including location information. The card reader receives the security authentication information returned by the emulated card and decrypts it using the emulated card's public key. If the information is incomplete, an attack occurs, and communication is interrupted. The card reader then submits the authentication information to the interface layer security authentication module. The card reader's security authentication module returns the authentication result to the communication layer. The card reader encrypts the authentication result using its own key and sends it to the emulated card. The emulated card receives the authentication result from the card reader and decrypts it using its own public key. If the information is incomplete, an attack occurs, and communication is interrupted. Finally, the card reader submits the authentication result to the security authentication module, and communication ends.

[0033] Its specific implementation is as follows: Digital Signature: Due to the short authentication information, this technology does not use a digest when implementing digital signatures. Instead, it directly encrypts the authentication information using a private key to complete the digital signature.

[0034] Data transmission and reception for the card reader: In the `onNewIntent` method, the card reader parses the tag, calls `IsoDep isoDep = IsoDep.get(tag)` to obtain an `IsoDep` object, calls the `connect` method to establish a connection, and then uses `tranceive` methods to send commands and retrieve the results. The first command sent is a `SELECT` command, followed by data commands.

[0035] Data processing of the emulated card: The emulated card's HCEService service registers the same AID as the AID sent by the card reader. When the emulated card receives the SELECT command, it will automatically call the HCEService service of this application for processing. Subsequent data will be sent to the processCommandApdu method in the HCEService service, which will complete the data processing.

[0036] Command Format: To distinguish authentication messages at different stages, an additional header is added to the data portion. Therefore, APDU commands can be divided into three parts: command header, data header, and data. The SELECT command header is "00A40400", and the data command header is set to "00CA0000". The data carried by the SELECT command is the AID, which does not require a data header. The data command uses "0" and "1" as the data header, representing the reader's identity certificate and the security authentication result, respectively.

[0037] This invention requires no additional work besides installing an app, greatly improving user-friendliness and feasibility, and providing a practical technical solution to the potential risks of NFC payments. This invention implements a secure and easy-to-use NFC security authentication technology, significantly enhancing NFC security while protecting its core competitive advantages of convenience and speed, ensuring a superior user experience. This defense technology can be easily deployed on existing NFC devices, solving the security challenges that limit the widespread application of NFC payments, contributing to the creation of a secure e-commerce environment in my country, and providing key technical support for domestically developed secure payment technologies.

[0038] It should be understood that the above description of the preferred embodiments is quite detailed, but it should not be considered as a limitation on the scope of protection of this invention. Those skilled in the art, under the guidance of this invention, can make substitutions or modifications without departing from the scope of protection of the claims of this invention, and all such substitutions or modifications fall within the scope of protection of this invention. The scope of protection of this invention should be determined by the appended claims.

Claims

1. An NFC security authentication system based on spatiotemporal evolution, characterized in that: It includes a server, a card reader, an HCE emulation card, and a client; the client includes a system layer, a perception layer, a communication layer, an interface layer, and an application layer. The server is used to issue digital certificates to card readers and HCE emulation cards; The card reader is used by the communication initiator to actively send a request; The HCE emulation card is used to respond to the card reader; The system layer is used to establish a connection between the card reader and the HCE emulation card; The perception layer is used to perceive authentication information, including a location information acquisition module and a time information acquisition module, which respectively acquire the location and time when the NFC connection layer is accessed; The communication layer includes a key management module and an NFC communication module. The key management module generates public and private keys and requests a digital certificate from the server. The communication module completes information exchange with the other end of the NFC communication and submits the information to the interface layer. The interface layer is used to extract information from the communication layer, complete the verification, and pass the verification result to the application layer. The application layer is used to include various NFC-based apps; Furthermore, the NFC security authentication process based on spatiotemporal evolution includes the following steps: Step 1: The client system layer detects the connection establishment information and obtains the current time. Then create an Intent and set its property to start; set the Intent's launch mode to ensure the application starts in a new task stack; then add time information t1 to the Intent; finally capture the Intent. Step 2: When the client discovers an NFC device, the perception layer activates the location acquisition module and the time acquisition module to collect the location and time of the NFC connection; Step 3: The NFC communication module communicates with the other end of the NFC communication. In the NFC communication, the key management module of the communication layer provides confidentiality for the communication module based on the RSA algorithm, thereby completing NFC security authentication.

2. The NFC security authentication system based on spatiotemporal evolution according to claim 1, characterized in that: In step 2, the card reader monitors all types of NFC tags based on the information carried by the tag; After detecting the current Tag object, the current Tag is parsed through the security authentication module; the information in the Tag is then retrieved and returned. The emulation card uses an interface implemented in the connection layer to notify the application to discover the device.

3. The NFC security authentication system based on spatiotemporal evolution according to claim 1, characterized in that: In step 2, when the location acquisition module discovers the other party's device, it first adds WiFi permission and carrier permission; Then, create an AMapLocationClient class object to start the location service, set up a listener interface, and listen for the startLocation() method; when the listener method is called, obtain the current location information and return the current location information; The time acquisition module collects the time of the other party's NFC device. In the simulated card, the getLongExtra() method is called to obtain the key value of the time key, which is the access time. In the card reader, when the OnNewIntent method starts, the System.currentTimeMillis() method is called directly to obtain the current system time, which is the access time.

4. The NFC security authentication system based on spatiotemporal evolution according to claim 1, characterized in that: In step 3, during NFC communication, the key management module of the communication layer provides confidentiality for communication based on the RSA algorithm, including the generation of local public and private key pairs and the request for digital certificates. The specific implementation process is as follows: First, the user generates a public key and a private key locally; then, the user encrypts (public key, user ID, random number) using the server's public key and sends it to the server; next, the server calculates the hash code of the public key and the user ID, and encrypts the hash code using the server's private key; finally, the hash code is encrypted using the server's private key, and the encrypted hash code, together with the public key and the ID, forms an identity certificate, which is then encrypted using the local public key along with the random number + 1 and returned to the local machine.

5. The NFC security authentication system based on spatiotemporal evolution according to any one of claims 1-4, characterized in that, Step 3 includes the following sub-steps: Step 3.1: The card reader sends a SELECT command to the emulated card to select the client; Step 3.2: The emulated card returns its identity certificate to the card reader; Step 3.3: The card reader receives the identity certificate, decrypts it using the simulated card's public key, and verifies the integrity of the identity certificate. If the certificate is incomplete, an attack occurs, and communication is interrupted. Step 3.4: The card reader sends its identity certificate to the emulated card; Step 3.5: The simulated card receives the identity certificate, decrypts the identity certificate using the server's public key, and verifies the integrity of the identity certificate. If it is incomplete, an attack occurs, and communication is interrupted. Step 3.6: The emulated card returns the security authentication information obtained from the perception layer to the card reader, and performs digital signature using the emulated card's private key; the security authentication information includes location information and time information; Step 3.7: The card reader receives the security authentication information returned by the emulated card, decrypts it using the emulated card's public key, and if the information is incomplete, an attack occurs and communication is interrupted; Step 3.8: The card reader delivers the identity authentication information to the interface layer security authentication module; Step 3.9: The card reader security authentication module returns the authentication result to the communication layer; Step 3.10: The card reader encrypts the authentication result using its own key and sends it to the emulated card; Step 3.11: The simulated card receives the authentication result sent by the card reader, decrypts it using the card reader's public key, and if the information is incomplete, an attack occurs and communication is interrupted; Step 3.12: Submit the authentication result to the security authentication module, and the communication ends.

6. The NFC security authentication system based on spatiotemporal evolution according to any one of claims 1-4, characterized in that: The interface layer extracts time and space information from both the communication layer and the perception layer to determine whether a relay attack has occurred and sends an alert to the system or application layer.

Images