Smart card relay attack prevention method and device, storage medium and computer equipment

Abstract

According to the intelligent card relay attack prevention method and device, the storage medium and the computer equipment provided by the invention, when the intelligent card initiates the financial transaction with the terminal, the application initialization command is sent to the intelligent card through the terminal, the response data returned by the intelligent card according to the command is received, and then the command response duration is determined according to the two commands / data; the command response duration comprises the transmission time of at least one of the command and the response data between the terminal and the intelligent card, so that unstable factors are eliminated by reducing the processing time of the timing card, a stable preset threshold value is set, and when the response duration is smaller than the preset threshold value, the financial transaction process continues to be completed. And similarly, the terminal sends an application ciphertext command to the smart card and performs duration threshold detection, and determines corresponding transaction information and application ciphertext when the duration threshold detection is passed, so that the financial transaction is completed. Based on this, the application does not need to additionally send an exchange anti-relay attack data command irrelevant to the transaction, so that the transaction efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of transaction security technology, and in particular to a smart card relay attack prevention method, device, storage medium and computer equipment. Background Art

[0002] Since the birth of bank cards, transaction security issues have attracted much attention from card groups, banks and users. Among them, the current prevention method for relay attacks on chip cards mainly relies on the RRP protocol. The core of this protocol is that after the GPO command is executed, the payment terminal will send an ERRD (Exchange Relay Resistance Data command) command to the card. After receiving this command, the card will perform a series of specific operations and respond.

[0003] In order to detect potential relay attacks, the terminal starts and stops a timer before and after sending the ERRD command to measure the total time it takes for the card to process the ERRD command. If the time for three consecutive measurements exceeds the preset threshold, it is considered that there is a risk of relay attack, and the terminal will terminate the transaction or report it to the issuing bank for further judgment.

[0004] In actual applications, the total time recorded by the timer actually covers the time it takes for the command to be transmitted to the card, the time it takes for the card to process the command internally, and the time it takes for the response to be transmitted back to the terminal. The card processing time is affected by many factors, including the field strength of the terminal and the physical location when the card is swiped. These factors vary significantly in different terminals and transaction scenarios, resulting in large fluctuations in the measured value of the ERRD command execution time. Therefore, existing relay attack prevention methods face great challenges in setting the threshold. If it is too high, it may not be able to effectively identify relay attacks, while if it is too low, it may accidentally damage normal transactions. Summary of the invention

[0005] The purpose of this application is to solve at least one of the above-mentioned technical defects, especially the technical defect that the existing relay attack prevention method in the prior art has great challenges in setting the threshold value. If the threshold value is too high, it may not be able to effectively identify relay attacks, while if the threshold value is too low, it may accidentally damage normal transactions.

[0006] The present application provides a smart card relay attack prevention method, the method comprising:

[0007] When detecting that a mobile device uses a smart card to initiate a financial transaction with a POS terminal, sending an application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command;

[0008] Determine the first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration includes the transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card;

[0009] When the first command response time is less than a first preset threshold, sending an application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command;

[0010] Determine a second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration includes a transmission time between the POS terminal and the smart card of at least one of the application ciphertext command and the second response data;

[0011] When the second command response time is less than a second preset threshold, the POS terminal determines transaction information corresponding to the application ciphertext command and the application ciphertext of the second response, and completes the financial transaction based on the transaction information and the application ciphertext.

[0012] Optionally, sending the application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command, includes:

[0013] Acquire a first timestamp of the current moment in the POS terminal, generate an application initialization command carrying the first timestamp through the POS terminal, and send the application initialization command to the smart card;

[0014] When detecting that the smart card receives the application initialization command, determining a first receiving time of the application initialization command;

[0015] After the application initialization command is executed by the mobile device using the smart card, a second timestamp of the current time in the smart card is obtained, and first response data carrying the first receiving time and the second timestamp is generated and returned to the POS terminal.

[0016] Optionally, determining the first command response time of the smart card according to the application initialization command and the first response data includes:

[0017] When detecting that the POS terminal receives the first response data, determining a second reception time of the first response data, and performing signal analysis on the first response data by the POS terminal to obtain a first reception time and a second timestamp;

[0018] Determine a first command transmission time of the application initialization command according to the first timestamp and the first receiving time, and determine a first response transmission time of the first response data according to the second timestamp and the second receiving time;

[0019] When the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the first command transmission time is used as the first command response duration of the smart card;

[0020] When the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the first response transmission time is used as the first command response duration of the smart card;

[0021] When the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the first command transmission time and the first response transmission time are summed to obtain the first command response duration of the smart card.

[0022] Optionally, sending the application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command, includes:

[0023] Obtaining a third timestamp of the current moment in the POS terminal, generating an application ciphertext command carrying the third timestamp through the POS terminal, and sending the application ciphertext command to the smart card;

[0024] When detecting that the smart card receives the application ciphertext command, determining a third receiving time of the application ciphertext command;

[0025] After the application ciphertext command is executed by the mobile device using the smart card, a fourth timestamp of the current time in the smart card is obtained, and second response data carrying the third receiving time and the fourth timestamp is generated and returned to the POS terminal.

[0026] Optionally, determining the second command response time of the smart card according to the application ciphertext command and the second response data includes:

[0027] When detecting that the POS terminal receives the second response data, determining a fourth reception time of the application ciphertext command, and performing signal parsing on the second response data by the POS terminal to obtain a third reception time and a fourth timestamp;

[0028] Determine a second command transmission time of the application ciphertext command according to the third timestamp and the third receiving time, and determine a second response transmission time of the second response data according to the fourth timestamp and the fourth receiving time;

[0029] When the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the second command transmission time is used as the second command response duration of the smart card;

[0030] When the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the second response transmission time is used as the second command response duration of the smart card;

[0031] When the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the second command transmission time and the second response transmission time are summed to obtain the second command response duration of the smart card.

[0032] Optionally, the method further comprises:

[0033] If the first command response time is not less than the first preset threshold, the financial transaction is terminated through the POS terminal.

[0034] Optionally, the method further comprises:

[0035] If the second command response time is not less than the second preset threshold, the financial transaction is terminated through the POS terminal.

[0036] The present application also provides a smart card relay attack prevention device, comprising:

[0037] A transaction initiation module, configured to, when detecting that a mobile device uses a smart card to initiate a financial transaction with a POS terminal, send an application initialization command to the smart card through the POS terminal, and receive first response data returned by the smart card according to the application initialization command;

[0038] A first duration determination module, configured to determine a first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card;

[0039] a transaction response module, configured to send an application ciphertext command to the smart card through the POS terminal when the first command response time is less than a first preset threshold, and receive second response data returned by the smart card according to the application ciphertext command;

[0040] A second duration determination module, configured to determine a second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration is the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card;

[0041] The transaction completion module is used to determine the transaction information corresponding to the application ciphertext command and the application ciphertext of the second response through the POS terminal when the second command response time is less than a second preset threshold, and complete the financial transaction based on the transaction information and the application ciphertext.

[0042] The present application also provides a storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the smart card relay attack prevention method as described in any of the above embodiments.

[0043] The present application also provides a computer device, comprising: one or more processors, and a memory;

[0044] The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the smart card relay attack prevention method as described in any one of the above embodiments are performed.

[0045] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0046] The smart card relay attack prevention method, device, storage medium and computer equipment provided by the present application can send an application initialization command to the smart card through the POS terminal when detecting that the mobile device uses the smart card to initiate a financial transaction with the POS terminal, and receive the first response data returned by the smart card according to the application initialization command, and then determine the first command response time of the smart card according to the application initialization command and the first response data; the first command response time is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, so that by reducing the timing card processing time to eliminate unstable factors, a stable first preset threshold can be set, and when the first command response time is less than the first preset threshold, the process of completing the financial transaction can be continued. Similarly, the POS terminal can send an application ciphertext command to the smart card, and receive the second response data returned by the smart card according to the application ciphertext command, and determine the second command response time of the smart card according to the application ciphertext command and the second response data, so that when the second command response time is less than the second preset threshold, the transaction information corresponding to the application ciphertext command can be determined through the POS terminal, and the application ciphertext in the second response data can be parsed, and the financial transaction can be completed based on the transaction information and the application ciphertext. Based on this, the present application does not need to send additional anti-relay attack data exchange commands with the transaction, thereby further improving transaction efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 A flowchart of a smart card relay attack prevention method provided in an embodiment of the present application;

[0049] Figure 2 One of the flow diagrams of the data interaction process between a POS terminal and a smart card provided in an embodiment of the present application;

[0050] Figure 3 A second flowchart of a POS terminal and smart card data interaction process provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of the architecture of a relay attack prevention system provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of the structure of a smart card relay attack prevention device provided in an embodiment of the present application;

[0053] Figure 6 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0055] In one embodiment, Figure 1 As shown, Figure 1 A flow chart of a smart card relay attack prevention method provided in an embodiment of the present application; the present application provides a smart card relay attack prevention method, which specifically includes the following:

[0056] S110: When it is detected that the mobile device uses the smart card to initiate a financial transaction with the POS terminal, an application initialization command is sent to the smart card through the POS terminal, and first response data returned by the smart card according to the application initialization command is received.

[0057] In this step, when the computer device detects that the user uses the smart card to initiate a financial transaction with the POS terminal through the mobile device, the computer device can send an application initialization command to the smart card through the POS terminal, and receive the first response data returned by the smart card according to the application initialization command.

[0058] Among them, the mobile device of this application refers to a portable electronic device that integrates NFO software, such as a smartphone, tablet computer or other portable smart device; these devices can obtain the function of interacting with smart cards by installing and registering NFO software. The NFO software here is an application specially designed to read, parse and process smart card information, which enables the mobile device to become a bridge for communication between smart cards and POS terminals.

[0059] The smart card of the present application is an active card, which refers to a bank card that has a built-in battery or can be powered by an external power source, allowing them to perform more complex computing tasks, provide stronger security performance, and actively communicate with the card reader when needed. Compared with passive cards, that is, smart cards that only rely on power provided by the card reader to work, the active cards of the present application generally have longer communication distances and faster processing speeds.

[0060] Specifically, when a user uses a smart card to conduct financial transactions with a POS terminal through a mobile device, the POS terminal can first send a PPSE (Proximity Payment Systems Environment) command under SELECT (Select command) to the smart card, so that the smart card returns an FCI (File Control Information) under the PPSE command to the POS terminal. Then, the POS terminal can send an AID (Application Identifier) ​​command under SELECT to the smart card, so that the smart card selects the corresponding financial application. At this time, the smart card can return the FCI corresponding to the financial application to the POS terminal, thereby establishing a financial transaction between the smart card and the POS terminal.

[0061] Next, based on the financial transaction, the POS terminal can send an application initialization command (Get Processing Options command, GPO) to the smart card, so that after receiving the application initialization command, the smart card can process according to the application and data stored internally and the parameters specified in the command, and after the processing is completed, generate a first response data and return it to the computer device through the POS terminal. The first response data may include card status information, application interaction features, application file locator, account encryption information, etc., which are not limited here and are mainly used to respond to subsequent transaction operations of the POS terminal.

[0062] Furthermore, if the smart card information is not pre-stored in the mobile device, the user can also directly use the smart card to approach the POS terminal for financial transactions. It should be noted that by pre-reading the smart card information on the mobile device, the computer device can remotely realize the financial transaction between the smart card and the POS terminal, such as overseas transactions.

[0063] S120: Determine a first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card.

[0064] In this step, after receiving the first command response duration returned by the smart card through step S110, the computer device can determine the first command response duration of the smart card based on the application initialization command and the first response data. The first command response duration here is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card.

[0065] It is understandable that the card processing time is affected by factors such as the terminal field strength and the card swiping position. That is to say, the field strength may be different for different terminals, and the position of each card swiping may also be biased, which will cause the command execution time counted in the current relay attack prevention method to fluctuate greatly. Based on this, when counting the command execution time, this application can only count the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, that is, the card processing time is not counted, thereby reducing the unstable factors caused by this time. Therefore, through the first command response time, this application can set a relatively stable threshold with a wide range of applicability, thereby improving the stability and efficiency of transactions.

[0066] It should be noted that the smart card of the present application can integrate a high-precision, low-power clock module internally. This clock module can synchronize time with computer equipment based on NTP (Network Time Protocol) or other time synchronization protocols to ensure that the timestamp generated by the card is accurate and reliable. In addition, in order to ensure the accuracy of the clock, the smart card needs to be calibrated regularly, communicate with the computer equipment, obtain the standard time and automatically calibrate. The same is true for POS terminals. Therefore, once the smart card conducts a financial transaction with the POS terminal, the computer device can use the timestamp generated on the POS terminal and the smart card along with the application initialization command and the first response data to calculate the first command response time.

[0067] S130: When the first command response time is less than a first preset threshold, sending an application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command.

[0068] In this step, after calculating the first command response time of the smart card in step S120, the computer device can compare the first command response time with the first preset threshold, and when the first command response time is less than the first preset threshold, send an application ciphertext command to the smart card through the POS terminal, and receive second response data returned by the smart card according to the application ciphertext command.

[0069] It is understandable that the generation and transmission process of the application cryptogram command (Generate Application Cryptogram command, GAP) of this application is an important part of the financial transaction process. The application cryptogram command is mainly used to request the smart card to generate an application cryptogram so that the card issuer can verify the legitimacy of the transaction and decide whether to approve the financial transaction. Therefore, the second response data returned by the smart card according to the application cryptogram command contains AC (Application Cryptogram) or CDA (Combined DDA / AC Generation).

[0070] S140: Determine the second command response time of the smart card according to the application ciphertext command and the second response data; the second command response time is the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card.

[0071] In this step, after receiving the second command response duration returned by the smart card in step S130, the computer device can determine the second command response duration of the smart card based on the application ciphertext command and the second response data; the second command response duration is the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card.

[0072] It should be noted that the process of determining the second command response time length is consistent with the process of determining the first command response time length, and will not be described in detail here.

[0073] Furthermore, when the smart card is conducting financial transactions, the computer device may not follow the RRP (Relay Resistance Protocol) and send an additional ERRD (Exchange Relay Resistance Data command) to prevent relay attacks, but instead directly perform relay attack prevention on the application initialization command and the application ciphertext command, further improving the efficiency of transactions.

[0074] S150: When the second command response time is less than a second preset threshold, the POS terminal determines the transaction information corresponding to the application ciphertext command and the application ciphertext of the second response, and completes the financial transaction based on the transaction information and the application ciphertext.

[0075] In this step, after calculating the second command response time of the smart card through step S140, the computer device can compare the second command response time with the second preset threshold, and when the second command response time is less than the second preset threshold, determine the transaction information corresponding to the application ciphertext command and the application ciphertext in the second response data through the POS terminal, and complete the financial transaction based on the transaction information and the application ciphertext.

[0076] Specifically, when the second command response time is less than the second preset threshold, it means that the transmission time of the application ciphertext command is within a safe range and has no chance of being tampered with. Therefore, the computer device can determine the transaction information corresponding to the application ciphertext command through the POS terminal, and parse the application ciphertext in the second response data, and then upload the transaction information and the application ciphertext to the acquiring institution, so that the acquiring institution can conduct a financial transaction of the transaction information to the issuing institution of the smart card based on the application ciphertext. After the issuing institution continues to decrypt and verify the application ciphertext, it can deduct the corresponding assets in the smart card based on the transaction information to complete the financial transaction.

[0077] In the above embodiment, when it is detected that the mobile device uses a smart card to initiate a financial transaction with the POS terminal, an application initialization command can be sent to the smart card through the POS terminal, and the first response data returned by the smart card according to the application initialization command can be received, and then the first command response time of the smart card can be determined according to the application initialization command and the first response data; the first command response time is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, so that by reducing the timing card processing time to eliminate unstable factors, a stable first preset threshold can be set, and when the first command response time is less than the first preset threshold, the process of completing the financial transaction can be continued. Similarly, an application ciphertext command can be sent to the smart card through the POS terminal, and the second response data returned by the smart card according to the application ciphertext command can be received, and the second command response time of the smart card can be determined according to the application ciphertext command and the second response data, so that when the second command response time is less than the second preset threshold, the transaction information corresponding to the application ciphertext command and the application ciphertext in the second response data can be determined through the POS terminal, and the financial transaction can be completed based on the transaction information and the application ciphertext. Based on this, the present application does not need to send additional anti-relay attack data exchange commands with the transaction, further improving transaction efficiency.

[0078] In one embodiment, Figure 2 As shown, Figure 2 A flowchart of a POS terminal and smart card data interaction process provided in an embodiment of the present application; Figure 2In step S110, the process of sending the application initialization command to the smart card through the POS terminal and receiving the first response data returned by the smart card according to the application initialization command may include:

[0079] S111: Obtain a first timestamp at the current moment in the POS terminal, generate an application initialization command carrying the first timestamp through the POS terminal, and send the application initialization command to the smart card.

[0080] S112: When it is detected that the smart card receives the application initialization command, the first receiving time of the application initialization command is determined.

[0081] S113: After the application initialization command is executed by the mobile device using the smart card, a second timestamp of the current time in the smart card is obtained, and first response data carrying the first receiving time and the second timestamp is generated and returned to the POS terminal.

[0082] In this embodiment, after the smart card establishes a financial transaction with the POS terminal, the computer device can obtain the first timestamp of the current time in the POS terminal, and generate an application initialization command carrying the first timestamp through the POS terminal to send it to the smart card; when it is detected that the smart card has received the application initialization command, the computer device can determine the first reception time of the application initialization command through the smart card, so that after it uses the smart card to execute the application initialization command, it can obtain the second timestamp of the current time in the smart card, and generate the first response data carrying the first reception time and the second timestamp and return it to the POS terminal.

[0083] It can be understood that the first timestamp here refers to the start time when the application initialization command is transmitted from the POS terminal to the smart card, and the first receiving time refers to the end time when the application initialization command is transmitted from the POS terminal to the smart card; the second timestamp refers to the start time when the first response data is transmitted from the smart card to the POS terminal.

[0084] In one embodiment, the process of determining the first command response time of the smart card according to the application initialization command and the first response data in step S120 may include:

[0085] S121: when it is detected that the POS terminal receives the first response data, determining the second receiving time of the first response data, and performing signal analysis on the first response data by the POS terminal to obtain the first receiving time and the second timestamp.

[0086] S122: Determine a first command transmission time of the application initialization command according to the first timestamp and the first receiving time, and determine a first response transmission time of the first response data according to the second timestamp and the second receiving time.

[0087] S123: When the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the first command transmission time is used as the first command response duration of the smart card.

[0088] S124: When the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the first response transmission time is used as the first command response duration of the smart card.

[0089] S125: When the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the first command transmission time and the first response transmission time are summed to obtain the first command response duration of the smart card.

[0090] In this embodiment, when the computer detects that the POS terminal receives the first response data, it can determine the second reception time of the first response data, which represents the termination time of the transmission of the first response data from the smart card to the POS terminal. At the same time, the computer device can also perform signal analysis on the first response data through the POS terminal to obtain the first reception time and the second timestamp.

[0091] Therefore, the computer device can determine the first command transmission time of the application initialization command based on the first timestamp and the first receiving time, and determine the first response transmission time of the first response data based on the second timestamp and the second receiving time, and then determine the type of the first command response duration according to the actual scenario of the financial transaction, and then calculate the first command transmission time and the first response transmission time according to each type of method strategy, and then obtain the first command response duration excluding the card processing time.

[0092] For example, when the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the computer device may use the first command transmission time as the first command response duration of the smart card; when the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the computer device may use the first response transmission time as the first command response duration of the smart card; and when the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the computer device may sum the first command transmission time and the first response transmission time, and use the sum as the first command response duration of the smart card.

[0093] In one embodiment, Figure 3 As shown, Figure 3 The second flowchart of the data interaction process between a POS terminal and a smart card provided in an embodiment of the present application is as follows: Figure 3In step S130, the process of sending the application ciphertext command to the smart card through the POS terminal and receiving the second response data returned by the smart card according to the application ciphertext command may include:

[0094] S131: Obtain a third timestamp of the current moment in the POS terminal, generate an application ciphertext command carrying the third timestamp through the POS terminal, and send the application ciphertext command to the smart card.

[0095] S132: When it is detected that the smart card receives the application ciphertext command, a third receiving time of the application ciphertext command is determined.

[0096] S133: After the application ciphertext command is executed by the mobile device using the smart card, a fourth timestamp of the current time in the smart card is obtained, and second response data carrying the third receiving time and the fourth timestamp is generated and returned to the POS terminal.

[0097] In this embodiment, after the first command response time is less than the first preset threshold, the computer device can obtain the third timestamp of the current time in the POS terminal, and generate an application ciphertext command carrying the third timestamp through the POS terminal to send it to the smart card; when it is detected that the smart card has received the application ciphertext command, the computer device can determine the third reception time of the application ciphertext command through the smart card, so that after it uses the smart card to execute the application ciphertext command, it can obtain the fourth timestamp of the current time in the smart card, and generate the second response data carrying the third reception time and the fourth timestamp and return it to the POS terminal.

[0098] It can be understood that the third timestamp here refers to the start time when the application ciphertext command is transmitted from the POS terminal to the smart card, and the third receiving time refers to the end time when the application ciphertext command is transmitted from the POS terminal to the smart card; the fourth timestamp refers to the start time when the second response data is transmitted from the smart card to the POS terminal.

[0099] In one embodiment, the process of determining the second command response time of the smart card according to the application ciphertext command and the second response data in step S140 may include:

[0100] S141: when detecting that the POS terminal receives the second response data, determining a fourth receiving time of the application ciphertext command, and performing signal analysis on the second response data by the POS terminal to obtain a third receiving time and a fourth timestamp;

[0101] S142: Determine a second command transmission time of the application ciphertext command according to the third timestamp and the third receiving time, and determine a second response transmission time of the second response data according to the fourth timestamp and the fourth receiving time.

[0102] S143: When the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the second command transmission time is used as the second command response duration of the smart card.

[0103] S144: When the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the second response transmission time is used as the second command response duration of the smart card.

[0104] S145: When the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the second command transmission time and the second response transmission time are summed to obtain the second command response duration of the smart card.

[0105] In this embodiment, when the computer detects that the POS terminal receives the second response data, it can determine the fourth reception time of the second response data, which represents the end time of the second response data being transmitted from the smart card to the POS terminal. At the same time, the computer device can also perform signal analysis on the second response data through the POS terminal to obtain the third reception time and the fourth timestamp.

[0106] Therefore, the computer device can determine the second command transmission time of the application ciphertext command based on the third timestamp and the third receiving time, and determine the second response transmission time of the first response data based on the fourth timestamp and the fourth receiving time, and then can determine the type of the second command response duration based on the actual scenario of the financial transaction, and then calculate the second command transmission time and the second response transmission time according to each type of method strategy, and then obtain the second command response duration excluding the card processing time.

[0107] For example, when the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the computer device may use the second command transmission time as the second command response duration of the smart card; when the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the computer device may use the second response transmission time as the second command response duration of the smart card; and when the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the computer device may sum the second command transmission time and the second response transmission time, and use the sum as the second command response duration of the smart card.

[0108] In one embodiment, the method may further include:

[0109] S160: If the first command response time is not less than a first preset threshold, the financial transaction is terminated through the POS terminal.

[0110] In this embodiment, when the first command response time is not less than the first preset threshold, it means that during the financial transaction, there is an abnormality in the data interaction process between the smart card and the POS terminal, and the data transmission process may be maliciously intercepted and tampered with, causing the transmission time to exceed the preset security threshold. Therefore, the computer device will confirm that there is a security risk in the transaction, and will terminate the financial transaction through the POS terminal to maintain the user's asset security.

[0111] In one embodiment, the method may further include:

[0112] S170: If the second command response time is not less than a second preset threshold, the financial transaction is terminated through the POS terminal.

[0113] In this embodiment, when the second command response time is not less than the second preset threshold, the computer device will terminate the financial transaction through the POS terminal, similar to the first command response time, and the specific process will not be repeated here.

[0114] In order to better explain the smart card relay attack prevention method of the present application, the following will be Figure 4 To further illustrate, schematically, Figure 4 As shown, Figure 4 A schematic diagram of the architecture of a relay attack prevention system provided in an embodiment of the present application.

[0115] Figure 4 In the process of financial transactions, the user can place a smart card with active card attributes, such as a bank card, close to a mobile device with NFO installed, such as a mobile phone, so that the mobile phone can read the card information of the bank card, and then synchronize the card information to the mobile phone with NFO installed abroad, so that the mobile phone abroad can conduct financial transactions with the POS terminal. In the process of financial transactions, the mobile phone abroad can use the bank card to send and respond to the GPO / GAC1 command between the mobile phone in China and the POS terminal. The command and response here both contain timestamps, thereby realizing timestamp risk control. When the timestamps of all commands and responses are within the security control range, the POS institution can upload the corresponding transaction information and application ciphertext AC to the acquiring institution, so that the acquiring institution can send it to the issuing bank of the bank card for AC verification, and complete the financial transaction after the verification is successful. Of course, the acquiring institution can also upload the timestamp to the issuing bank of the bank card for security verification to further enhance the security of the transaction.

[0116] The following is a description of a smart card relay attack prevention device provided in an embodiment of the present application. The smart card relay attack prevention device described below and the smart card relay attack prevention method described above can be referenced to each other.

[0117] In one embodiment, Figure 5As shown, Figure 5 A schematic diagram of the structure of a smart card relay attack prevention device provided in an embodiment of the present application; the present application also provides a schematic diagram of the structure of a smart card relay attack prevention device, including a transaction initiation module 210, a first duration determination module 220, a transaction response module 230, a second duration determination module 240 and a transaction completion module 250, specifically including the following:

[0118] The transaction initiation module 210 is used to send an application initialization command to the smart card through the POS terminal when it is detected that the mobile device uses the smart card to initiate a financial transaction with the POS terminal, and receive the first response data returned by the smart card according to the application initialization command.

[0119] The first duration determination module 220 is used to determine the first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration includes the transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card.

[0120] The transaction response module 230 is used to send an application ciphertext command to the smart card through the POS terminal when the first command response time is less than a first preset threshold, and receive second response data returned by the smart card according to the application ciphertext command.

[0121] The second duration determination module 240 is used to determine the second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration includes the transmission time of at least one of the application ciphertext command and the second response data between the POS terminal and the smart card.

[0122] The transaction completion module 250 is used to determine the transaction information corresponding to the application ciphertext command and the application ciphertext of the second response through the POS terminal when the second command response time is less than the second preset threshold, and complete the financial transaction based on the transaction information and the application ciphertext.

[0123] In the above embodiment, when it is detected that the mobile device uses a smart card to initiate a financial transaction with the POS terminal, an application initialization command can be sent to the smart card through the POS terminal, and the first response data returned by the smart card according to the application initialization command can be received, and then the first command response time of the smart card can be determined according to the application initialization command and the first response data; the first command response time includes the transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card, so that by reducing the timing card processing time to eliminate unstable factors, a stable first preset threshold can be set, and when the first command response time is less than the first preset threshold, the process of completing the financial transaction can be continued. Similarly, an application ciphertext command can be sent to the smart card through the POS terminal, and the second response data returned by the smart card according to the application ciphertext command can be received, and the second command response time of the smart card can be determined according to the application ciphertext command and the second response data, so that when the second command response time is less than the second preset threshold, the transaction information corresponding to the application ciphertext command and the application ciphertext in the second response data can be determined through the POS terminal, and the financial transaction can be completed based on the transaction information and the application ciphertext. Based on this, the present application does not need to send additional anti-relay attack data exchange commands with the transaction, further improving transaction efficiency.

[0124] In one embodiment, the transaction initiation module 210 may include:

[0125] The first command generation submodule is used to obtain a first timestamp at the current moment in the POS terminal, generate an application initialization command carrying the first timestamp through the POS terminal, and send the application initialization command to the smart card.

[0126] The first command receiving submodule is used to determine a first receiving time of the application initialization command when detecting that the smart card receives the application initialization command.

[0127] The first response generation submodule is used to obtain the second timestamp of the current time in the mobile device after executing the application initialization command using the smart card through the mobile device, and generate the first response data carrying the first receiving time and the second timestamp and return it to the POS terminal.

[0128] In one embodiment, the first duration determination module 220 may include:

[0129] The first signal analysis submodule is used to determine the second receiving time of the first response data when detecting that the POS terminal receives the first response data, and to obtain the first receiving time and the second timestamp by performing signal analysis on the first response data through the POS terminal.

[0130] The first time determination submodule is used to determine a first command transmission time of an application initialization command according to a first timestamp and a first receiving time, and to determine a first response transmission time of first response data according to a second timestamp and a second receiving time.

[0131] The first time summing submodule is used to sum the first command transmission time and the first response transmission time to obtain the first command response duration of the smart card.

[0132] In one embodiment, the transaction response module 230 may include:

[0133] The second command generation submodule is used to obtain the third timestamp of the current moment in the POS terminal, generate an application ciphertext command carrying the third timestamp through the POS terminal, and send the application ciphertext command to the smart card.

[0134] The second command receiving submodule is used to determine a third receiving time of the application ciphertext command when detecting that the smart card receives the application ciphertext command.

[0135] The second response generation submodule is used to obtain the fourth timestamp of the current time in the mobile device after the application ciphertext command is executed by the mobile device using the smart card, and generate the second response data carrying the third receiving time and the fourth timestamp and return it to the POS terminal.

[0136] In one embodiment, the second duration determination module 240 may include:

[0137] A second signal parsing submodule is used to determine a fourth receiving time of the application ciphertext command when detecting that the POS terminal receives the second response data, and to perform signal parsing on the second response data by the POS terminal to obtain a third receiving time and a fourth timestamp;

[0138] The second time determination submodule is used to determine the second command transmission time of the application ciphertext command according to the third timestamp and the third receiving time, and to determine the second response transmission time of the second response data according to the fourth timestamp and the fourth receiving time.

[0139] The second time summing submodule is used to sum the second command transmission time and the second response transmission time to obtain the second command response duration of the smart card.

[0140] In one embodiment, the apparatus may further include:

[0141] The first transaction termination module is used to terminate the financial transaction through the POS terminal if the first command response time is not less than a first preset threshold.

[0142] In one embodiment, the apparatus may further include:

[0143] The second transaction termination module is used to terminate the financial transaction through the POS terminal if the second command response time is not less than a second preset threshold.

[0144] In one embodiment, the present application also provides a storage medium, which stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the smart card relay attack prevention method as described in any of the above embodiments.

[0145] In one embodiment, the present application also provides a computer device having computer-readable instructions stored therein. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the smart card relay attack prevention method as described in any one of the above embodiments.

[0146] Indicatively, Figure 6 As shown, Figure 6 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. The computer device 300 may be provided as a server. Figure 6 , the computer device 300 includes a processing component 302, which further includes one or more processors, and a memory resource represented by a memory 301, for storing instructions executable by the processing component 302, such as an application. The application stored in the memory 301 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 302 is configured to execute instructions to perform the smart card relay attack prevention method of any of the above embodiments.

[0147] The computer device 300 may further include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate based on an operating system stored in the memory 301, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, Free BSD TM, or the like.

[0148] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0149] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0150] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.

[0151] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A smart card relay attack prevention method, characterized in that: The method comprises: When detecting that a mobile device uses a smart card to initiate a financial transaction with a POS terminal, sending an application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command; Determine the first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration includes the transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card; When the first command response time is less than a first preset threshold, sending an application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command; Determine a second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration includes a transmission time between the POS terminal and the smart card of at least one of the application ciphertext command and the second response data; When the second command response time is less than a second preset threshold, the POS terminal determines transaction information corresponding to the application ciphertext command and the application ciphertext of the second response, and completes the financial transaction based on the transaction information and the application ciphertext.

2. The smart card relay attack prevention method according to claim 1, characterized in that: The sending of the application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command, comprises: Acquire a first timestamp of the current moment in the POS terminal, generate an application initialization command carrying the first timestamp through the POS terminal, and send the application initialization command to the smart card; When detecting that the smart card receives the application initialization command, determining a first receiving time of the application initialization command; After the application initialization command is executed by the mobile device using the smart card, a second timestamp of the current time in the smart card is obtained, and first response data carrying the first receiving time and the second timestamp is generated and returned to the POS terminal.

3. The smart card relay attack prevention method according to claim 2, characterized in that: The determining the first command response time of the smart card according to the application initialization command and the first response data includes: When detecting that the POS terminal receives the first response data, determining a second reception time of the first response data, and performing signal analysis on the first response data by the POS terminal to obtain a first reception time and a second timestamp; Determine a first command transmission time of the application initialization command according to the first timestamp and the first receiving time, and determine a first response transmission time of the first response data according to the second timestamp and the second receiving time; When the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the first command transmission time is used as the first command response duration of the smart card; When the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the first response transmission time is used as the first command response duration of the smart card; When the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the first command transmission time and the first response transmission time are summed to obtain the first command response duration of the smart card.

4. The smart card relay attack prevention method according to claim 1, characterized in that: The step of sending the application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command, comprises: Obtaining a third timestamp of the current moment in the POS terminal, generating an application ciphertext command carrying the third timestamp through the POS terminal, and sending the application ciphertext command to the smart card; When detecting that the smart card receives the application ciphertext command, determining a third receiving time of the application ciphertext command; After the application ciphertext command is executed by the mobile device using the smart card, a fourth timestamp of the current time in the smart card is obtained, and second response data carrying the third receiving time and the fourth timestamp is generated and returned to the POS terminal.

5. The smart card relay attack prevention method according to claim 4, characterized in that: The determining the second command response duration of the smart card according to the application ciphertext command and the second response data includes: When detecting that the POS terminal receives the second response data, determining a fourth reception time of the application ciphertext command, and performing signal parsing on the second response data by the POS terminal to obtain a third reception time and a fourth timestamp; Determine a second command transmission time of the application ciphertext command according to the third timestamp and the third receiving time, and determine a second response transmission time of the second response data according to the fourth timestamp and the fourth receiving time; When the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the second command transmission time is used as the second command response duration of the smart card; When the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the second response transmission time is used as the second command response duration of the smart card; When the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the second command transmission time and the second response transmission time are summed to obtain the second command response duration of the smart card.

6. The smart card relay attack prevention method according to claim 1, characterized in that: The method further comprises: If the first command response time is not less than the first preset threshold, the financial transaction is terminated through the POS terminal.

7. The smart card relay attack prevention method according to claim 1, characterized in that: The method further comprises: If the second command response time is not less than the second preset threshold, the financial transaction is terminated through the POS terminal.

8. A smart card relay attack prevention device, characterized in that: include: A transaction initiation module, configured to, when detecting that a mobile device uses a smart card to initiate a financial transaction with a POS terminal, send an application initialization command to the smart card through the POS terminal, and receive first response data returned by the smart card according to the application initialization command; A first duration determination module, configured to determine a first command response duration of the smart card according to the application initialization command and the first response data; The first command response duration is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card; a transaction response module, configured to send an application ciphertext command to the smart card through the POS terminal when the first command response time is less than a first preset threshold, and receive second response data returned by the smart card according to the application ciphertext command; A second duration determination module, configured to determine a second command response duration of the smart card according to the application ciphertext command and the second response data; The second command response duration is the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card; The transaction completion module is used to determine the transaction information corresponding to the application ciphertext command and the application ciphertext of the second response through the POS terminal when the second command response time is less than a second preset threshold, and complete the financial transaction based on the transaction information and the application ciphertext.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the smart card relay attack prevention method as described in any one of claims 1 to 7.

10. A computer device, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the smart card relay attack prevention method according to any one of claims 1 to 7 are executed.

Images