Smart card relay attack prevention method and device, storage medium and computer equipment

Abstract

The smart card relay attack prevention method and device, the storage medium and the computer device provided by the application, when the smart card and the terminal initiate a financial transaction, the terminal sends an application initialization command to the smart card, receives response data returned by the smart card according to the command, and then determines a command response time according to the two commands / data; the command response time includes transmission time of at least one of the command and the response data between the terminal and the smart card, so as to exclude unstable factors by reducing the card processing time, set a stable preset threshold, and continue to complete the process of the financial transaction when the response time is less than the preset threshold. Similarly, the terminal sends an application ciphertext command to the smart card and performs time threshold detection, and determines corresponding transaction information and application ciphertext when passing, and then completes the financial transaction. Based on this, the application does not need to send additional exchange anti-relay attack data commands unrelated to the transaction, thereby improving the transaction efficiency.

Description

Technical Field

[0001] The present application relates to the field of transaction security technology, and in particular to a method, apparatus, storage medium, and computer equipment for preventing smart card relay attacks. Background Art

[0002] Since the advent of bank cards, transaction security has been a major concern for cardholders, banks, and users. Current mitigation measures against relay attacks on chip cards primarily rely on the RRP protocol. The core of this protocol is that after executing a GPO command, the payment terminal sends an ERRD (Exchange Relay Resistance Data) command to the card. Upon receiving this command, the card performs a series of specific actions and responds.

[0003] To detect potential relay attacks, the terminal starts and stops a timer before and after sending the ERRD command, measuring the total time it takes for the card to process the ERRD command. If the time for three consecutive measurements exceeds a preset threshold, the risk of a relay attack is considered present, and the terminal will either abort the transaction or report it to the issuing bank for further evaluation.

[0004] In practice, the total time recorded by the timer actually covers the time it takes for the command to be transmitted to the card, the time it takes for the card to process the command internally, and the time it takes for the response to be transmitted back to the terminal. Card processing time is affected by a variety of factors, including the terminal's field strength and the physical location of the card when it is swiped. These factors vary significantly across different terminals and transaction scenarios, leading to significant fluctuations in the measured ERRD command execution time. Therefore, existing relay attack prevention methods face significant challenges in setting the threshold. Setting it too high may fail to effectively identify relay attacks, while setting it too low may inadvertently disrupt legitimate transactions. Summary of the Invention

[0005] The purpose of this application is to solve at least one of the above-mentioned technical defects, especially the technical defect that the existing relay attack prevention method in the prior art faces great challenges when setting the threshold. If the threshold is too high, it may not be able to effectively identify relay attacks, while if it is too low, it may accidentally damage normal transactions.

[0006] The present application provides a method for preventing smart card relay attacks, the method comprising:

[0007] When detecting that a mobile device uses a smart card to initiate a financial transaction with a POS terminal, sending an application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command;

[0008] Determine a first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration includes a transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card;

[0009] When the first command response time is less than a first preset threshold, sending an application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command;

[0010] Determining a second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration includes a transmission time of at least one of the application ciphertext command and the second response data between the POS terminal and the smart card;

[0011] When the second command response time is less than a second preset threshold, the POS terminal determines transaction information corresponding to the application ciphertext command and the application ciphertext of the second response, and completes the financial transaction based on the transaction information and the application ciphertext.

[0012] Optionally, sending the application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command, includes:

[0013] Obtaining a first timestamp of the current moment in the POS terminal, generating an application initialization command carrying the first timestamp through the POS terminal, and sending the application initialization command to the smart card;

[0014] When detecting that the smart card receives the application initialization command, determining a first receiving time of the application initialization command;

[0015] After the application initialization command is executed by the mobile device using the smart card, the second timestamp of the current moment in the smart card is obtained, and first response data carrying the first receiving moment and the second timestamp is generated and returned to the POS terminal.

[0016] Optionally, determining the first command response duration of the smart card according to the application initialization command and the first response data includes:

[0017] Upon detecting that the POS terminal receives the first response data, determining a second reception time of the first response data, and performing signal analysis on the first response data by the POS terminal to obtain a first reception time and a second timestamp;

[0018] determining a first command transmission time of the application initialization command according to the first timestamp and the first receiving time, and determining a first response transmission time of the first response data according to the second timestamp and the second receiving time;

[0019] When the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the first command transmission time is used as the first command response duration of the smart card;

[0020] When the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the first response transmission time is used as the first command response duration of the smart card;

[0021] When the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the first command transmission time and the first response transmission time are summed to obtain the first command response duration of the smart card.

[0022] Optionally, sending the application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command, includes:

[0023] Obtaining a third timestamp of the current moment in the POS terminal, generating an application ciphertext command carrying the third timestamp through the POS terminal, and sending the application ciphertext command to the smart card;

[0024] When detecting that the smart card receives the application ciphertext command, determining a third reception time of the application ciphertext command;

[0025] After the mobile device executes the application ciphertext command using the smart card, the fourth timestamp of the current moment in the smart card is obtained, and second response data carrying the third reception moment and the fourth timestamp is generated and returned to the POS terminal.

[0026] Optionally, determining the second command response duration of the smart card according to the application ciphertext command and the second response data includes:

[0027] Upon detecting that the POS terminal receives the second response data, determining a fourth reception time of the application ciphertext command, and performing signal parsing on the second response data by the POS terminal to obtain a third reception time and a fourth timestamp;

[0028] determining a second command transmission time of the application ciphertext command according to the third timestamp and the third reception time, and determining a second response transmission time of the second response data according to the fourth timestamp and the fourth reception time;

[0029] When the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the second command transmission time is used as the second command response duration of the smart card;

[0030] When the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the second response transmission time is used as the second command response duration of the smart card;

[0031] When the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the second command transmission time and the second response transmission time are summed to obtain the second command response duration of the smart card.

[0032] Optionally, the method further includes:

[0033] If the first command response time is not less than the first preset threshold, the financial transaction is terminated through the POS terminal.

[0034] Optionally, the method further includes:

[0035] If the second command response time is not less than the second preset threshold, the financial transaction is terminated through the POS terminal.

[0036] The present application also provides a smart card relay attack prevention device, comprising:

[0037] a transaction initiation module, configured to, upon detecting that a mobile device initiates a financial transaction with a POS terminal using a smart card, send an application initialization command to the smart card via the POS terminal, and receive first response data returned by the smart card according to the application initialization command;

[0038] a first duration determining module, configured to determine a first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration being the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card;

[0039] a transaction response module, configured to send an application ciphertext command to the smart card via the POS terminal when the first command response time is less than a first preset threshold, and receive second response data returned by the smart card according to the application ciphertext command;

[0040] a second duration determining module, configured to determine a second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration being the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card;

[0041] and a transaction completion module configured to determine, through the POS terminal, transaction information corresponding to the application ciphertext command and the application ciphertext of the second response when the second command response duration is less than a second preset threshold, and complete the financial transaction based on the transaction information and the application ciphertext.

[0042] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the smart card relay attack prevention method as described in any one of the above embodiments.

[0043] The present application also provides a computer device, comprising: one or more processors, and a memory;

[0044] The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the smart card relay attack prevention method as described in any one of the above embodiments are performed.

[0045] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0046] The present application provides a method, apparatus, storage medium, and computer device for preventing smart card relay attacks. Upon detecting that a mobile device is initiating a financial transaction with a POS terminal using a smart card, the POS terminal can send an application initialization command to the smart card and receive first response data returned by the smart card in response to the application initialization command. The method then determines the first command response time of the smart card based on the application initialization command and the first response data. The first command response time is the sum of the transmission time between the application initialization command and the first response data. This reduces the card processing time to eliminate unstable factors, allowing a stable first preset threshold to be set. The method also allows the POS terminal to continue completing the financial transaction process when the first command response time is less than the first preset threshold. Similarly, the POS terminal can send an application ciphertext command to the smart card and receive second response data returned by the smart card in response to the application ciphertext command. The method then determines the second command response time of the smart card based on the application ciphertext command and the second response data. When the second command response time is less than the second preset threshold, the POS terminal determines transaction information corresponding to the application ciphertext command, parses the application ciphertext in the second response data, and completes the financial transaction based on the transaction information and the application ciphertext. Based on this, this application does not need to send additional anti-relay attack data exchange commands with the transaction, further improving transaction efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0048] Figure 1 A flowchart of a smart card relay attack prevention method provided in an embodiment of the present application;

[0049] Figure 2 This is a flowchart of a data interaction process between a POS terminal and a smart card provided in an embodiment of the present application;

[0050] Figure 3 This is a second flow chart of the data interaction process between a POS terminal and a smart card provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of the architecture of a relay attack prevention system provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of the structure of a smart card relay attack prevention device provided in an embodiment of the present application;

[0053] Figure 6 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0055] In one embodiment, Figure 1 As shown, Figure 1 This is a flow chart of a method for preventing smart card relay attacks provided in an embodiment of the present application. This application provides a method for preventing smart card relay attacks, which specifically includes the following:

[0056] S110: When it is detected that the mobile device uses the smart card to initiate a financial transaction with the POS terminal, an application initialization command is sent to the smart card through the POS terminal, and first response data returned by the smart card according to the application initialization command is received.

[0057] In this step, when the computer device detects that the user initiates a financial transaction with the POS terminal using a smart card through a mobile device, the computer device can send an application initialization command to the smart card through the POS terminal, and receive the first response data returned by the smart card according to the application initialization command.

[0058] Among them, the mobile device of this application refers to a portable electronic device that integrates NFO software, such as a smartphone, tablet computer or other portable smart device; these devices can obtain the function of interacting with smart cards by installing and registering NFO software. The NFO software here is an application specially designed to read, parse and process smart card information, which enables the mobile device to become a bridge for communication between smart cards and POS terminals.

[0059] The smart cards in this application are active cards, meaning they are powered by a built-in battery or an external power source. This allows them to perform more complex computing tasks, provide stronger security, and actively communicate with a card reader when needed. Compared to passive cards, which rely solely on power from a card reader, active cards in this application typically have longer communication ranges and faster processing speeds.

[0060] Specifically, when a user uses a smart card to conduct a financial transaction with a POS terminal via a mobile device, the POS terminal can first send a PPSE (Proximity Payment Systems Environment) command under the SELECT (Select command) to the smart card, causing the smart card to return an FCI (File Control Information) under the PPSE command to the POS terminal. The POS terminal can then send an AID (Application Identifier) ​​command under the SELECT command to the smart card, causing it to select the corresponding financial application. The smart card then returns the FCI corresponding to the financial application to the POS terminal, thus establishing the financial transaction between the smart card and the POS terminal.

[0061] Then, based on the financial transaction, the POS terminal can send an application initialization command (Get Processing Options command, GPO) to the smart card, so that after receiving the application initialization command, the smart card can process the application and data stored in its internal storage and the parameters specified in the command. After the processing is completed, a first response data is generated and returned to the computer device through the POS terminal. The first response data may include card status information, application interaction characteristics, application file locator, account encryption information, etc., which are not limited here and are mainly used to respond to subsequent transaction operations of the POS terminal.

[0062] Furthermore, if the smart card information is not pre-stored on the mobile device, the user can also directly use the smart card to conduct financial transactions by holding it close to the POS terminal. It should be noted that by pre-reading the smart card information on the mobile device, the computer device can remotely conduct financial transactions between the smart card and the POS terminal, such as overseas transactions.

[0063] S120: Determine a first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card.

[0064] In this step, after receiving the first command response duration returned by the smart card through step S110, the computer device can determine the first command response duration of the smart card based on the application initialization command and the first response data. The first command response duration here is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card.

[0065] It is understandable that card processing time is affected by factors such as the terminal's field strength and the location where the card is swiped. That is, different terminals may have different field strengths, and the location of each card swipe may also vary. This can cause significant fluctuations in the command execution time calculated in current relay attack prevention methods. Based on this, when calculating command execution time, this application can only count the sum of the transmission time between the application initialization command and the first response data between the POS terminal and the smart card, that is, it does not count the card processing time, thereby reducing the instability caused by this time. Therefore, by using the first command response time, this application can set a relatively stable threshold with a wide range of applicability, thereby improving the stability and efficiency of transactions.

[0066] It should be noted that the smart card of the present application can integrate a high-precision, low-power clock module internally. This clock module can synchronize time with computer devices based on NTP (Network Time Protocol) or other time synchronization protocols to ensure that the timestamp generated by the card is accurate and reliable. In addition, to ensure the accuracy of the clock, the smart card needs to be calibrated regularly, and by communicating with the computer device, it obtains the standard time and automatically calibrates. The same is true for POS terminals. Therefore, once the smart card conducts a financial transaction with the POS terminal, the computer device can use the timestamps generated on the POS terminal and the smart card along with the application initialization command and the first response data to calculate the first command response time.

[0067] S130: When the first command response time is less than a first preset threshold, send an application ciphertext command to the smart card through the POS terminal, and receive second response data returned by the smart card according to the application ciphertext command.

[0068] In this step, after calculating the first command response time of the smart card in step S120, the computer device can compare the first command response time with a first preset threshold, and when the first command response time is less than the first preset threshold, send an application ciphertext command to the smart card through the POS terminal, and receive second response data returned by the smart card according to the application ciphertext command.

[0069] It's understood that the generation and transmission of the Generate Application Cryptogram command (GAP) in this application is a crucial step in financial transactions. The GAP command primarily requests that the smart card generate an application cryptogram, enabling the card issuer to verify the transaction's legitimacy and decide whether to approve it. Therefore, the second response data returned by the smart card in response to the GAP command includes an AC (Application Cryptogram) or a CDA (Combined DDA / AC Generation).

[0070] S140: Determine a second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration is the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card.

[0071] In this step, after receiving the second command response duration returned by the smart card in step S130, the computer device can determine the second command response duration of the smart card based on the application ciphertext command and the second response data; the second command response duration is the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card.

[0072] It should be noted that the process of determining the second command response time length is the same as the process of determining the first command response time length, and will not be described in detail here.

[0073] Furthermore, when a smart card is conducting a financial transaction, the computer device may not follow the RRP (Relay Resistance Protocol) and send an additional ERRD (Exchange Relay Resistance Data command) to prevent relay attacks. Instead, the computer device may directly perform relay attack prevention on the application initialization command and the application ciphertext command, further improving transaction efficiency.

[0074] S150: When the second command response time is less than a second preset threshold, the POS terminal determines the transaction information corresponding to the application ciphertext command and the application ciphertext of the second response, and completes the financial transaction based on the transaction information and the application ciphertext.

[0075] In this step, after calculating the second command response time of the smart card in step S140, the computer device can compare the second command response time with the second preset threshold, and when the second command response time is less than the second preset threshold, determine the transaction information corresponding to the application ciphertext command and the application ciphertext in the second response data through the POS terminal, and complete the financial transaction based on the transaction information and the application ciphertext.

[0076] Specifically, when the second command response time is less than the second preset threshold, it means that the transmission time of the application ciphertext command is within a safe range and there is no chance of being tampered with. Therefore, the computer device can determine the transaction information corresponding to the application ciphertext command through the POS terminal, and parse the application ciphertext in the second response data, and then upload the transaction information and application ciphertext to the acquiring institution, so that the acquiring institution can conduct a financial transaction of the transaction information to the smart card issuer based on the application ciphertext. After the issuer continues to decrypt and verify the application ciphertext, it can deduct the corresponding assets in the smart card based on the transaction information and complete the financial transaction.

[0077] In the above embodiment, when a mobile device is detected to be initiating a financial transaction with a POS terminal using a smart card, the POS terminal can send an application initialization command to the smart card and receive first response data returned by the smart card in response to the application initialization command. The first command response time of the smart card can then be determined based on the application initialization command and the first response data. The first command response time is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card. This reduces the card processing time to eliminate unstable factors, allowing a stable first preset threshold to be set. When the first command response time is less than the first preset threshold, the financial transaction can be continued. Similarly, the POS terminal can send an application ciphertext command to the smart card and receive second response data returned by the smart card in response to the application ciphertext command. The second command response time of the smart card can then be determined based on the application ciphertext command and the second response data. When the second command response time is less than the second preset threshold, the POS terminal can determine the transaction information corresponding to the application ciphertext command and the application ciphertext in the second response data, and complete the financial transaction based on the transaction information and the application ciphertext. Therefore, the present application does not require the sending of additional anti-relay attack data exchange commands, further improving transaction efficiency.

[0078] In one embodiment, Figure 2 As shown, Figure 2 A flowchart of the data interaction process between a POS terminal and a smart card provided in an embodiment of the present application; Figure 2In step S110, the process of sending the application initialization command to the smart card through the POS terminal and receiving the first response data returned by the smart card according to the application initialization command may include:

[0079] S111: Obtain a first timestamp of the current moment in the POS terminal, generate an application initialization command carrying the first timestamp through the POS terminal, and send the application initialization command to the smart card.

[0080] S112: When it is detected that the smart card receives the application initialization command, the first receiving time of the application initialization command is determined.

[0081] S113: After the application initialization command is executed by the mobile device using the smart card, the second timestamp of the current time in the smart card is obtained, and first response data carrying the first receiving time and the second timestamp is generated and returned to the POS terminal.

[0082] In this embodiment, after the smart card establishes a financial transaction with the POS terminal, the computer device can obtain the first timestamp of the current moment in the POS terminal, and generate an application initialization command carrying the first timestamp through the POS terminal to send it to the smart card; when it is detected that the smart card has received the application initialization command, the computer device can determine the first reception time of the application initialization command through the smart card, so that after it uses the smart card to execute the application initialization command, it can obtain the second timestamp of the current moment in the smart card, and generate first response data carrying the first reception time and the second timestamp and return it to the POS terminal.

[0083] It can be understood that the first timestamp here refers to the start time when the application initialization command is transmitted from the POS terminal to the smart card, and the first receiving time refers to the end time when the application initialization command is transmitted from the POS terminal to the smart card; the second timestamp refers to the start time when the first response data is transmitted from the smart card to the POS terminal.

[0084] In one embodiment, the process of determining the first command response time of the smart card according to the application initialization command and the first response data in step S120 may include:

[0085] S121: When detecting that the POS terminal receives the first response data, determining a second receiving time of the first response data, and performing signal analysis on the first response data by the POS terminal to obtain the first receiving time and a second timestamp.

[0086] S122: Determine a first command transmission time of the application initialization command according to the first timestamp and the first receiving time, and determine a first response transmission time of the first response data according to the second timestamp and the second receiving time.

[0087] S123: When the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the first command transmission time is used as the first command response duration of the smart card.

[0088] S124: When the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the first response transmission time is used as the first command response duration of the smart card.

[0089] S125: When the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the first command transmission time and the first response transmission time are summed to obtain the first command response duration of the smart card.

[0090] In this embodiment, upon detecting that the POS terminal has received the first response data, the computer can determine the second reception time of the first response data, representing the end time of transmission of the first response data from the smart card to the POS terminal. Furthermore, the computer can also perform signal analysis on the first response data via the POS terminal to obtain the first reception time and the second timestamp.

[0091] Therefore, the computer device can determine the first command transmission time of the application initialization command based on the first timestamp and the first receiving time, and determine the first response transmission time of the first response data based on the second timestamp and the second receiving time, and then determine the type of the first command response duration according to the actual scenario of the financial transaction, and then calculate the first command transmission time and the first response transmission time according to each type of method strategy, and then obtain the first command response duration excluding the card processing time.

[0092] For example, when the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the computer device may use the first command transmission time as the first command response duration of the smart card; when the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the computer device may use the first response transmission time as the first command response duration of the smart card; and when the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the computer device may sum the first command transmission time and the first response transmission time, and use the sum result as the first command response duration of the smart card.

[0093] In one embodiment, Figure 3 As shown, Figure 3 This is a second flow chart of the data interaction process between a POS terminal and a smart card provided in an embodiment of the present application. Figure 3In step S130, the process of sending the application ciphertext command to the smart card through the POS terminal and receiving the second response data returned by the smart card according to the application ciphertext command may include:

[0094] S131: Obtain a third timestamp of the current moment in the POS terminal, generate an application ciphertext command carrying the third timestamp through the POS terminal, and send the application ciphertext command to the smart card.

[0095] S132: When it is detected that the smart card receives the application ciphertext command, a third receiving time of the application ciphertext command is determined.

[0096] S133: After the application ciphertext command is executed using the smart card through the mobile device, the fourth timestamp of the current moment in the smart card is obtained, and second response data carrying the third receiving time and the fourth timestamp is generated and returned to the POS terminal.

[0097] In this embodiment, after the first command response time is less than the first preset threshold, the computer device can obtain the third timestamp of the current moment in the POS terminal, and generate an application ciphertext command carrying the third timestamp through the POS terminal to send it to the smart card; when it is detected that the smart card has received the application ciphertext command, the computer device can determine the third reception time of the application ciphertext command through the smart card, so that after it uses the smart card to execute the application ciphertext command, it can obtain the fourth timestamp of the current moment in the smart card, and generate second response data carrying the third reception time and the fourth timestamp and return it to the POS terminal.

[0098] It can be understood that the third timestamp here refers to the start time when the application ciphertext command is transmitted from the POS terminal to the smart card, and the third receiving time refers to the end time when the application ciphertext command is transmitted from the POS terminal to the smart card; the fourth timestamp refers to the start time when the second response data is transmitted from the smart card to the POS terminal.

[0099] In one embodiment, the process of determining the second command response duration of the smart card according to the application ciphertext command and the second response data in step S140 may include:

[0100] S141: upon detecting that the POS terminal receives the second response data, determining a fourth reception time of the application ciphertext command, and performing signal analysis on the second response data by the POS terminal to obtain a third reception time and a fourth timestamp;

[0101] S142: Determine a second command transmission time of the application ciphertext command according to the third timestamp and the third receiving time, and determine a second response transmission time of the second response data according to the fourth timestamp and the fourth receiving time.

[0102] S143: When the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the second command transmission time is used as the second command response duration of the smart card.

[0103] S144: When the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the second response transmission time is used as the second command response duration of the smart card.

[0104] S145: When the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the second command transmission time and the second response transmission time are summed to obtain the second command response duration of the smart card.

[0105] In this embodiment, upon detecting that the POS terminal has received the second response data, the computer can determine a fourth reception time of the second response data, representing the end time of transmission of the second response data from the smart card to the POS terminal. Simultaneously, the computer can also perform signal analysis on the second response data via the POS terminal to obtain a third reception time and a fourth timestamp.

[0106] Therefore, the computer device can determine the second command transmission time of the application ciphertext command based on the third timestamp and the third receiving time, and determine the second response transmission time of the first response data based on the fourth timestamp and the fourth receiving time. Then, the type of the second command response duration can be determined based on the actual scenario of the financial transaction, and the second command transmission time and the second response transmission time can be calculated according to each type of method strategy to obtain the second command response duration excluding the card processing time.

[0107] For example, when the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the computer device may use the second command transmission time as the second command response duration of the smart card; when the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the computer device may use the second response transmission time as the second command response duration of the smart card; and when the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the computer device may sum the second command transmission time and the second response transmission time and use the sum as the second command response duration of the smart card.

[0108] In one embodiment, the method may further include:

[0109] S160: If the first command response time is not less than a first preset threshold, the financial transaction is terminated through the POS terminal.

[0110] In this embodiment, when the first command response time is not less than the first preset threshold, it indicates that during the financial transaction, there is an abnormality in the data interaction process between the smart card and the POS terminal. The data transmission process may be maliciously intercepted and tampered with, causing the transmission time to exceed the preset security threshold. Therefore, the computer device will confirm that there is a security risk in the transaction and will terminate the financial transaction through the POS terminal to protect the user's asset security.

[0111] In one embodiment, the method may further include:

[0112] S170: If the second command response time is not less than a second preset threshold, the financial transaction is terminated through the POS terminal.

[0113] In this embodiment, when the second command response time is not less than the second preset threshold, the computer device will terminate the financial transaction through the POS terminal, similar to the first command response time, and the specific process will not be repeated here.

[0114] In order to better explain the smart card relay attack prevention method of this application, the following will be Figure 4 To further illustrate, schematically, Figure 4 As shown, Figure 4 A schematic diagram of the architecture of a relay attack prevention system provided in an embodiment of the present application.

[0115] Figure 4 When conducting overseas transactions, users can place an active smart card, such as a bank card, near a mobile device equipped with an NFO, such as a mobile phone. The phone then reads the card information and synchronizes it with the mobile phone, also equipped with an NFO, allowing the overseas mobile phone to conduct financial transactions with the POS terminal. During the transaction, the overseas mobile phone can use the bank card as a domestic mobile phone to send and receive GPO / GAC1 commands between the POS terminal and the mobile phone. Both commands and responses include timestamps, thus enabling timestamp risk management. When all command and response timestamps are within security control limits, the POS institution can upload the corresponding transaction information and application ciphertext (AC) to the acquiring institution, which then sends it to the bank card's issuing bank for AC verification. Upon successful verification, the transaction is completed. Furthermore, the acquiring institution can also upload the timestamp to the bank card's issuing bank for security verification, further enhancing transaction security.

[0116] The following describes the smart card relay attack prevention device provided in an embodiment of the present application. The smart card relay attack prevention device described below and the smart card relay attack prevention method described above can refer to each other.

[0117] In one embodiment, Figure 5As shown, Figure 5 This is a schematic diagram of the structure of a smart card relay attack prevention device provided in an embodiment of the present application. This application also provides a schematic diagram of the structure of a smart card relay attack prevention device, including a transaction initiation module 210, a first duration determination module 220, a transaction response module 230, a second duration determination module 240, and a transaction completion module 250, specifically including the following:

[0118] The transaction initiation module 210 is configured to send an application initialization command to the smart card through the POS terminal when detecting that the mobile device initiates a financial transaction with the smart card using the smart card, and receive first response data returned by the smart card according to the application initialization command.

[0119] The first duration determination module 220 is used to determine the first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration includes the transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card.

[0120] The transaction response module 230 is configured to send an application ciphertext command to the smart card via the POS terminal when the first command response time is less than a first preset threshold, and receive second response data returned by the smart card according to the application ciphertext command.

[0121] The second duration determination module 240 is used to determine the second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration includes the transmission time of at least one of the application ciphertext command and the second response data between the POS terminal and the smart card.

[0122] The transaction completion module 250 is used to determine the transaction information corresponding to the application ciphertext command and the application ciphertext of the second response through the POS terminal when the second command response time is less than a second preset threshold, and complete the financial transaction based on the transaction information and the application ciphertext.

[0123] In the above embodiment, when a mobile device is detected to initiate a financial transaction with a POS terminal using a smart card, the POS terminal can send an application initialization command to the smart card and receive first response data returned by the smart card in response to the application initialization command. The first command response time of the smart card can then be determined based on the application initialization command and the first response data. The first command response time includes the transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card. This reduces the card processing time to eliminate unstable factors, allowing a stable first preset threshold to be set. When the first command response time is less than the first preset threshold, the financial transaction can be continued. Similarly, the POS terminal can send an application ciphertext command to the smart card and receive second response data returned by the smart card in response to the application ciphertext command. The second command response time of the smart card can then be determined based on the application ciphertext command and the second response data. When the second command response time is less than the second preset threshold, the POS terminal can determine the transaction information corresponding to the application ciphertext command and the application ciphertext in the second response data, and complete the financial transaction based on the transaction information and the application ciphertext. Therefore, the present application does not require the sending of additional anti-relay attack data exchange commands, further improving transaction efficiency.

[0124] In one embodiment, the transaction initiation module 210 may include:

[0125] The first command generation submodule is configured to obtain a first timestamp of the current moment in the POS terminal, generate an application initialization command carrying the first timestamp through the POS terminal, and send the application initialization command to the smart card.

[0126] The first command receiving submodule is configured to detect that the smart card receives the application initialization command and determine a first receiving time of the application initialization command.

[0127] The first response generation submodule is used to obtain the second timestamp of the current moment in the mobile device after the application initialization command is executed using the smart card through the mobile device, and generate the first response data carrying the first reception time and the second timestamp and return it to the POS terminal.

[0128] In one embodiment, the first duration determining module 220 may include:

[0129] The first signal parsing submodule is configured to determine a second receiving time of the first response data when detecting that the POS terminal receives the first response data, and obtain the first receiving time and the second timestamp by performing signal parsing on the first response data by the POS terminal.

[0130] The first time determination submodule is configured to determine a first command transmission time of the application initialization command according to the first timestamp and the first receiving moment, and to determine a first response transmission time of the first response data according to the second timestamp and the second receiving time.

[0131] The first time summing submodule is configured to sum the first command transmission time and the first response transmission time to obtain a first command response duration of the smart card.

[0132] In one embodiment, the transaction response module 230 may include:

[0133] The second command generation submodule is configured to obtain a third timestamp of the current moment in the POS terminal, generate an application ciphertext command carrying the third timestamp through the POS terminal, and send the application ciphertext command to the smart card.

[0134] The second command receiving submodule is configured to, when detecting that the smart card receives the application ciphertext command, determine a third receiving time of the application ciphertext command.

[0135] The second response generation submodule is used to obtain the fourth timestamp of the current moment in the mobile device after the application ciphertext command is executed using the smart card through the mobile device, and generate second response data carrying the third reception time and the fourth timestamp and return it to the POS terminal.

[0136] In one embodiment, the second duration determining module 240 may include:

[0137] a second signal parsing submodule, configured to determine a fourth reception time of the application ciphertext command when detecting that the POS terminal receives the second response data, and to perform signal parsing on the second response data by the POS terminal to obtain a third reception time and a fourth timestamp;

[0138] The second time determination submodule is configured to determine a second command transmission time of the application ciphertext command according to the third timestamp and the third receiving time, and to determine a second response transmission time of the second response data according to the fourth timestamp and the fourth receiving time.

[0139] The second time summing submodule is configured to sum the second command transmission time and the second response transmission time to obtain a second command response duration of the smart card.

[0140] In one embodiment, the apparatus may further include:

[0141] The first transaction termination module is configured to terminate the financial transaction through the POS terminal if the first command response time is not less than a first preset threshold.

[0142] In one embodiment, the apparatus may further include:

[0143] The second transaction termination module is configured to terminate the financial transaction through the POS terminal if the second command response time is not less than a second preset threshold.

[0144] In one embodiment, the present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the smart card relay attack prevention method as described in any of the above embodiments.

[0145] In one embodiment, the present application also provides a computer device having computer-readable instructions stored therein. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the smart card relay attack prevention method as described in any of the above embodiments.

[0146] Schematically, as Figure 6 As shown, Figure 6 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. The computer device 300 can be provided as a server. Figure 6 Computer device 300 includes a processing component 302, which further includes one or more processors, and a memory resource represented by memory 301 for storing instructions executable by processing component 302, such as an application. The application stored in memory 301 may include one or more modules, each corresponding to a set of instructions. In addition, processing component 302 is configured to execute the instructions to perform the smart card relay attack prevention method of any of the above-mentioned embodiments.

[0147] The computer device 300 may further include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate based on an operating system stored in the memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or the like.

[0148] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0149] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0150] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referenced to each other.

[0151] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for preventing smart card relay attacks, characterized in that: The method comprises: When detecting that a mobile device uses a smart card to initiate a financial transaction with a POS terminal, sending an application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command; Determine a first command response duration of the smart card according to the application initialization command and the first response data; the first command response duration includes a transmission time of at least one of the application initialization command and the first response data between the POS terminal and the smart card; When the first command response time is less than a first preset threshold, sending an application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command; Determining a second command response duration of the smart card according to the application ciphertext command and the second response data; the second command response duration includes a transmission time of at least one of the application ciphertext command and the second response data between the POS terminal and the smart card; When the second command response time is less than a second preset threshold, the POS terminal determines transaction information corresponding to the application ciphertext command and the application ciphertext of the second response, and completes the financial transaction based on the transaction information and the application ciphertext.

2. The smart card relay attack prevention method according to claim 1, characterized in that: The sending of the application initialization command to the smart card through the POS terminal, and receiving first response data returned by the smart card according to the application initialization command, includes: Obtaining a first timestamp of the current moment in the POS terminal, generating an application initialization command carrying the first timestamp through the POS terminal, and sending the application initialization command to the smart card; When detecting that the smart card receives the application initialization command, determining a first receiving time of the application initialization command; After the application initialization command is executed by the mobile device using the smart card, the second timestamp of the current moment in the smart card is obtained, and first response data carrying the first receiving moment and the second timestamp is generated and returned to the POS terminal.

3. The smart card relay attack prevention method according to claim 2, characterized in that: The determining the first command response duration of the smart card according to the application initialization command and the first response data includes: Upon detecting that the POS terminal receives the first response data, determining a second reception time of the first response data, and performing signal analysis on the first response data by the POS terminal to obtain a first reception time and a second timestamp; determining a first command transmission time of the application initialization command according to the first timestamp and the first receiving moment, and determining a first response transmission time of the first response data according to the second timestamp and the second receiving moment; When the first command response duration is the transmission time of the application initialization command between the POS terminal and the smart card, the first command transmission time is used as the first command response duration of the smart card; When the first command response duration is the transmission time of the first response data between the POS terminal and the smart card, the first response transmission time is used as the first command response duration of the smart card; When the first command response duration is the transmission time of the application initialization command and the first response data between the POS terminal and the smart card, the first command transmission time and the first response transmission time are summed to obtain the first command response duration of the smart card.

4. The smart card relay attack prevention method according to claim 1, characterized in that: The sending of the application ciphertext command to the smart card through the POS terminal, and receiving second response data returned by the smart card according to the application ciphertext command, includes: Obtaining a third timestamp of the current moment in the POS terminal, generating an application ciphertext command carrying the third timestamp through the POS terminal, and sending the application ciphertext command to the smart card; When detecting that the smart card receives the application ciphertext command, determining a third reception time of the application ciphertext command; After the mobile device executes the application ciphertext command using the smart card, the fourth timestamp of the current moment in the smart card is obtained, and second response data carrying the third reception moment and the fourth timestamp is generated and returned to the POS terminal.

5. The smart card relay attack prevention method according to claim 4, characterized in that: The determining, according to the application ciphertext command and the second response data, the second command response duration of the smart card includes: Upon detecting that the POS terminal receives the second response data, determining a fourth reception time of the application ciphertext command, and performing signal parsing on the second response data by the POS terminal to obtain a third reception time and a fourth timestamp; determining a second command transmission time of the application ciphertext command according to the third timestamp and the third reception time, and determining a second response transmission time of the second response data according to the fourth timestamp and the fourth reception time; When the second command response duration is the transmission time of the application ciphertext command between the POS terminal and the smart card, the second command transmission time is used as the second command response duration of the smart card; When the second command response duration is the transmission time of the second response data between the POS terminal and the smart card, the second response transmission time is used as the second command response duration of the smart card; When the second command response duration is the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card, the second command transmission time and the second response transmission time are summed to obtain the second command response duration of the smart card.

6. The smart card relay attack prevention method according to claim 1, characterized in that: The method further comprises: If the first command response time is not less than the first preset threshold, the financial transaction is terminated through the POS terminal.

7. The smart card relay attack prevention method according to claim 1, characterized in that: The method further comprises: If the second command response time is not less than the second preset threshold, the financial transaction is terminated through the POS terminal.

8. A smart card relay attack prevention device, characterized in that: include: a transaction initiation module, configured to, upon detecting that a mobile device initiates a financial transaction with a POS terminal using a smart card, send an application initialization command to the smart card via the POS terminal, and receive first response data returned by the smart card according to the application initialization command; A first duration determining module, configured to determine a first command response duration of the smart card according to the application initialization command and the first response data; The first command response duration is the sum of the transmission time of the application initialization command and the first response data between the POS terminal and the smart card; a transaction response module, configured to send an application ciphertext command to the smart card via the POS terminal when the first command response time is less than a first preset threshold, and receive second response data returned by the smart card according to the application ciphertext command; A second duration determining module, configured to determine a second command response duration of the smart card according to the application ciphertext command and the second response data; The second command response duration is the sum of the transmission time of the application ciphertext command and the second response data between the POS terminal and the smart card; and a transaction completion module configured to determine, through the POS terminal, transaction information corresponding to the application ciphertext command and the application ciphertext of the second response when the second command response duration is less than a second preset threshold, and complete the financial transaction based on the transaction information and the application ciphertext.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to execute the steps of the smart card relay attack prevention method according to any one of claims 1 to 7.

10. A computer device, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, which, when executed by the one or more processors, execute the steps of the smart card relay attack prevention method according to any one of claims 1 to 7.

Images