Short-range inspection for communication devices

Abstract

The disclosure relates to performing a proximity check to determine whether a transponder device is in proximity of a reader device. In an exemplary embodiment, a method of performing a proximity check to determine whether a transponder device is in proximity of a reader device includes transmitting a command from the reader device to the transponder device, the command includes a request for a measured response time for a number n of previous command-response exchanges stored by the transponder device; in response to receiving the command at the transponder device, transmitting a response to the reader device, the response including measured response times stored by the transponder device for the previous n command-response exchanges; and determining whether a predetermined criterion of the short-range check is reached by comparing the measured response time stored by the reader device with the measured response time emitted by the transponder device in the response.

Description

Technical Field

[0001] The present disclosure relates to performing a proximity check to determine whether a transponder device is within proximity of a reader device. The present disclosure further relates to a reader device, a transponder device and a contactless communication system including such devices. Background Art

[0002] Contactless interfaces, as standardized in, for example, ISO / IEC 14443, are used in several security applications, including contactless payment cards, vehicle or building access control, and for verifying documents such as biometric passports and identity cards. Such contactless interfaces are susceptible to relay attacks, in which an unauthorized third party relays information between a transponder device (or PICC, Proximity Integrated Circuit Card) and a reader device (or PCD, Proximity Coupling Device) when the transponder device is not in close proximity to the reader device.

[0003] An example of a relay attack is where a contactless payment card is read without the knowledge of the owner of the contactless payment card and the information from the card is relayed by a fraudulent card reader to another device in close physical proximity to a valid reader device. Transactions should only be allowed when the transponder device and the reader device are actually in close physical proximity. Any situation where a fraudulent repeater attempts to intervene between a transponder device and a reader device needs to be detected. This can be done using a proximity check, where a series of command-response exchanges are carried out between the reader device and the transponder device to determine whether the transponder device is actually in physical proximity. An example of a proximity check is described in EP2940882B1, where the expected transponder device response time is used to determine whether the transponder device meets a predetermined criterion.

[0004] The risk of relay attacks can be mitigated by controlling the exact elapsed time between messages exchanged from the PCD to the PICC, which can be defined as the time starting at the end of the last bit transmitted by the PCD and ending with the first bit of the response transmitted by the PICC. For simplicity, this time can be referred to as the frame delay time (FDT). Although the term is typically used for Type A cards under the ISO / IEC 14443 standard, the same principle applies to both Type A and Type B cards.

[0005] Some existing methods of reducing the risk of relay attacks only allow very short time windows, which are intended to reduce the chance of establishing a relay attack. However, this method imposes strong requirements on the PICC reaction time, which may be undesirable from an application perspective. Moreover, over time, when more sophisticated repeaters become available, the acceptable time may be shortened. Summary of the invention

[0006] According to a first aspect, there is provided a method of performing a proximity check to determine whether a transponder device is within proximity of a reader device, the method comprising:

[0007] transmitting a command from the reader device to the transponder device, the command comprising a request for measured response times for a number n of previous command-response exchanges stored by the transponder device;

[0008] in response to receiving a command at the transponder device, transmitting a response to the reader device, the response comprising measured response times for n previous command-response exchanges stored by the transponder device; and

[0009] Whether the predetermined criteria for the proximity check are met is determined by comparing the measured response time stored by the reader device with the measured response time transmitted in response by the transponder device.

[0010] The method provides a way to prevent relay attacks that is flexible for different FDTs, which is performed by both the PICC (transponder device) and the PCD (reader device) measuring and exchanging the actual FDT for a specific command-response exchange, which can then be checked to determine whether the transponder device is authentic.

[0011] Because any relay attack adds extra time to the FDT, this attack can be detected and the fraudulent transaction can then be aborted. The allowed tolerance for this acceptable time window does not need to be fixed, but can be a parameter in the protocol and provided by either the PCD or PICC. The device can take its own tolerance into account when reporting or storing the measured FDT, so there is no need to manage or fix the tolerance.

[0012] The number n may be greater than 1 and may be no greater than 8.

[0013] The step of determining whether the predetermined criteria for proximity inspection are met may be performed by a reader device.

[0014] The reader device may abort further command-response exchanges with the transponder device if predetermined criteria for the proximity check are not met. The predetermined criteria may include a measured response time stored by the reader device being equal to a measured response time transmitted by the transponder device in a response.

[0015] The method may comprise, prior to the step of transmitting the command from the reader device to the transponder device:

[0016] The reader device transmits a previous command to the transponder device;

[0017] the transponder device transmitting a previous response to the reader device in response to a previous command; and

[0018] The transponder device stores the measured response time of a previous response in a transponder memory.

[0019] The previous command may include a random number generated by the reader device.The previous command may be repeated n times before the step of transmitting the command from the reader device to the transponder device.

[0020] According to a second aspect, there is provided a reader device configured for contactless communication with a transponder device, the reader device comprising:

[0021] antenna;

[0022] Memory; and

[0023] Processing unit,

[0024] The processing unit is configured to:

[0025] transmitting a command from the reader device to the transponder device, the command comprising a request for measured response times for a number n of previous command-response exchanges stored by the transponder device;

[0026] In response to the command, receiving a response from the transponder device including measured response times stored by the transponder device for n previous command-response exchanges; and

[0027] Whether the predetermined criteria for the proximity check are met is determined by comparing the measured response time stored by the reader device with the measured response time transmitted in response by the transponder device.

[0028] The number n may be greater than 1 and may be no greater than 8.

[0029] If the predetermined criteria for the proximity check are not met, the reader device may be configured to abort further command-response exchanges with the transponder device.

[0030] The predetermined criteria may comprise a measured response time stored by the reader device being equal to a measured response time transmitted by the transponder device in a response.

[0031] According to a third aspect, there is provided a transponder device configured for contactless communication with a reader device, the transponder device comprising:

[0032] antenna;

[0033] Memory; and

[0034] Processing unit,

[0035] The processing unit is suitable for:

[0036] measuring and storing in a memory a response time during a command-response exchange with a reader device;

[0037] receiving a command from a reader device, the command comprising a request for measured response times for a number n of previous command-response exchanges stored in a memory; and

[0038] In response to the command, a response is sent that includes the stored measured response times for the previous n command-response exchanges.

[0039] The number n may be greater than 1 and may be no greater than 8.

[0040] According to a fourth aspect, there is provided a communication system comprising:

[0041] a reader device according to the second aspect; and

[0042] A transponder device according to the third aspect.

[0043] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Embodiments will be described by way of example only with reference to the accompanying drawings, in which:

[0045] Figure 1 is a schematic diagram showing the principle of a relay attack;

[0046] Figure 2 is a schematic diagram illustrating an example contactless communication system;

[0047] Figure 3a is a schematic message flow diagram showing the steps of the initial steps of preparing for and performing a proximity inspection;

[0048] Figure 3b is a schematic message flow diagram showing the steps of verifying a proximity check;

[0049] Figure 4 is a schematic message flow diagram showing the steps of performing a proximity check; and

[0050] Figure 5 is a schematic diagram illustrating an example sequence of command-response exchanges between a reader device and a transponder device.

[0051] It should be noted that the drawings are diagrammatic and not drawn to scale. For clarity and convenience in the drawings, the relative sizes and proportions of the various parts of these drawings have been shown in an enlarged or reduced manner. The same reference numerals are used overall to refer to corresponding or similar features in modified and different embodiments. DETAILED DESCRIPTION

[0052] Figure 1 A schematic diagram of a relay attack is shown. More specifically, Figure 1 A legitimate reader device 101 and a legitimate transponder device 102 are shown not being in close range of each other, i.e. they are not able to communicate directly via their respective contactless interfaces (not shown). The legitimate reader device 101 may, for example, be part of a cash register system at a store offering contactless payments. The legitimate transponder device 102 may, for example, be an NFC-enabled mobile phone in the pocket of a user at some other location, such as in a public transportation vehicle, a cafe or other public place.

[0053] Figure 1 Additionally shown are an attack transponder device 103 and an attack reader device 104. As shown, the attack transponder device 103 is in close range of the legitimate reader device 101 and is therefore able to perform contactless communication with the latter, as indicated by 105. Similarly, the attack reader device 104 is in close range of the legitimate transponder device 102, for example in the pocket of an attacker sitting next to a person carrying the legitimate transponder device 102, and is therefore able to perform contactless communication with the latter, as indicated by 106. The attack transponder device 103 and the attack reader device 104 communicate with each other via a high bandwidth data connection, such as a mobile 3G, 4G or subsequent generation network.

[0054] Thereby, if appropriate measures are not taken, an attacker (ie, those carrying attack devices 103 and 104) may, for example, be able to use a user account on a legitimate transponder device 102 to perform payment transactions within a store where a legitimate reader device 101 is installed.

[0055] Figure 2 An example contactless communication system 200 is shown. System 200 includes a reader device 210 and a transponder device 220. Reader device 210 includes a transmitter antenna 211 and a receiver antenna 212, both of which are communicatively coupled to a reader processing unit 216, such as a microprocessor or a central processing unit. Transmitter antenna 211 is capable of wirelessly transmitting a communication message (or command) 231 to transponder device 220. Receiver antenna 212 is capable of wirelessly receiving a communication message (or response) 232 from transponder device 220. In an alternative embodiment, transmitter antenna 211 and receiver antenna 212 may be replaced by a single common shared transceiver antenna.

[0056] The antennas 211, 212 are electrically coupled to the processor 216 so that data can be sent from the processor 216 to the transmit antenna 211 for transmission as a communication message 231. The communication message 232 received by the receiver antenna 212 can also be analyzed and processed by the processor 216. The command 231 transmitted from the reader device 210 to the transponder device 220 and the subsequent response 232 transmitted from the transponder device 220 to the reader device 210 in response to the command 231 can be referred to as a command-response exchange. Such a command-response exchange forms the basis of the communication between the reader device 220 and the transponder device 220, as described herein.

[0057] A reader memory (or storage unit) 214 , such as a semiconductor memory, is coupled to the processor 216 to allow the reader device 210 to store data accessible by the processor 216 .

[0058] Furthermore, an input / output unit 218 is shown, which allows a user to operate the reader device 210. The input / output unit 218 is an optional feature that may not necessarily be included in some embodiments (e.g., in a reader device for establishing an access control or public transportation system), and may include input elements such as buttons, a keypad, a joystick, etc. Via such input elements, a user may input commands to the reader device 210. Furthermore, the input / output unit 218 may include a display unit, such as a liquid crystal display, which allows the results of a reading procedure of the reader device 210 to be displayed.

[0059] like Figure 2 , the transponder device 220 includes a transmit and receiver antenna 222, a processor 226 (e.g., a microprocessor), and a transponder memory 224. The transponder memory 224 and the processor 226 may be integrally integrated in an integrated circuit (IC) that may be connected to the antenna 222 and attached to a support such as a piece of fabric or a card.

[0060] Figure 3a and 3b Show for example Figure 2 The reader device 210 and the like and the like Figure 2 331. First, as indicated by arrow 331, the reader device 210 transmits a first command (referred to as a prepare proximity check or PPC command) to the transponder device 220. The transponder device 220 responds to the PPC command 331 by transmitting a (first) response 332 back to the reader device 210. The response 332 includes an expected response time pubRespTime stored in the memory 224 of the transponder device. In addition, as indicated by arrow 331, the reader device 210 transmits a first command (referred to as a prepare proximity check or PPC command) to the transponder device 220. The transponder device 220 responds to the PPC command 331 by transmitting a (first) response 332 back to the reader device 210. The response 332 includes an expected response time pubRespTime stored in the memory 224 of the transponder device. Figure 3a As shown in FIG, the first response 332 may include an OK and a CRC (cyclic redundancy check).

[0061] Prior to or while transmitting the first response 332, the transponder device 220 generates a 7-byte random number RndR for use in responding to the random challenge from the reader device 210. The reader device 210 then generates an 8-byte random challenge RndC and transmits it to the transponder device 220 as a second command (referred to as a proximity check or PC command) at least in the form of a partial pRndC along with a CRC, as indicated by arrow 333. In other examples, random challenges of different lengths, such as 4, 6, 7, 10, or 12 bytes, or any other number of bytes, may be used.

[0062] After receiving the second command 333, the transponder device 220 processes the received (partial) random challenge and prepares a corresponding second response, as is known in the art. The second response is transmitted to the reader device 210 (as indicated by arrow 334) so ​​that it will be received by the reader device 210 approximately pubRespTime (with minimum variance) after the reader device 210 has completed transmitting the second command 333. Now, if the transponder device 220 is not actually in the proximity of the reader device 210, this transmission will be delayed, i.e. exceeding the expected response time pubRespTime. The transmission of the second command 333 and the corresponding second response 334 may be repeated until the complete random challenge RndC and the complete response RndR thereto have been transmitted.

[0063] like Figure 3b, after completing the exchange of the random challenge and response, the processing unit 216 of the reader device 210 determines whether the actual response time matches the expected response time pubRespTime with at least a predetermined accuracy (e.g., it does not exceed pubRespTime by more than 10%). If not, the communication with the transponder device 220 is terminated and a corresponding error message is output. If on the other hand the actual response time matches the expected response time pubRespTime with the required accuracy, the reader device 210 generates a reader MAC for the random challenge and response and the expected response time pubRespTime received with the first response 332. The generated reader MAC and CRC are transmitted from the reader device 210 to the transponder device 220 as a third command (Verify Proximity Check (VPC) command), as indicated by arrow 335. The transponder device 220 generates an expected reader MAC for the received third command 335 and compares it with the received reader MAC to authenticate the third command 335. Next, the transponder device 220 generates a transponder MAC for the random challenge and response and the expected response time pubRespTime as stored in its memory 224. The transponder device 220 transmits the latter together with the CRC as a third response to the reader device 210, as indicated by arrow 336. Finally, the reader device 210 generates an expected transponder MAC for the received third response 336 and compares it with the received transponder MAC to authenticate the third response 336. If the processor 216 of the reader device 210 determines that the received third response 336 is authentic, the proximity check is considered successful, and a relay attack can be ruled out.

[0064] In addition to or in lieu of the above sequence of command-response exchanges (i.e., messages 333, 334) in the process of implementing a proximity check, a communication may be performed between the reader device 210 and the transponder device 220 as follows: Figure 4 4. Command 401 is transmitted from the reader device 220 to the transponder device 220, which includes a request for the measured response time of the number n of previous command-response exchanges stored by the transponder device 220. This requires the transponder device 220 to be configured to respond to the measured response time of the number n of previous command-response exchanges stored by the transponder device 220. Figure 3a 333 and the response 334 may include the transponder device 220 storing the measured actual response time in, for example, the transponder memory 224.

[0065] In response to command 401, transponder device 220 returns a message including previously stored measured response time 403. 1-nResponse 402. Measured response time 403 1-n The stored response times for one or more previous command-response exchanges may be included. The number n of response times requested by the reader device 210 and provided by the transponder device may be, for example, between 1 and 8, and may be determined, for example, based on how many previous command-response exchanges the reader device 210 has initiated for a particular transponder device 220. Both the reader device 210 and the transponder device 220 are configured to store the measured response time for each command-response exchange. Thus, the reader device 210 may determine whether the transponder device 220 is authentic by comparing the stored measured response time with the response time received from the transponder device 220, thereby improving the assurance that the response is from an authentic transponder device and not from a relay attack device.

[0066] The response time 403 can be measured in units of code according to the carrier frequency fc used in the response 402 1-n In a specific example, the carrier frequency fc may be approximately 13.5 MHz, making the unit equal to approximately 74 ns. The measured response times stored in the transponder and reader devices 220, 210 are thereby stored in units of 74 ns.

[0067] In the command-response exchange for the procedure for verifying the proximity check, as described above Figure 3b As shown in FIG. 3 , the expected response time pubRespTime in the command 335 and the response 336 is actually the actual response time (actRespTime1-n, Figure 4 ). Otherwise, the verification proximity check process may be similar. The expected response time pubRespTime may also be included in a response 336 from the transponder device 220. In an overall aspect, the method may include transmitting a command 335 from the reader device 210 to the transponder device 220, the command 335 including a reader message authentication code (MAC) based at least on a measured response time stored by the reader device 210. In response to receiving the command 335, the transponder device 220 calculates an expected reader MAC based on the command, verifies that the expected reader MAC is equal to the reader MAC in the command, and transmits a response 336 including a transponder MAC based at least on a measured response time stored by the transponder device to the reader device 210. In response to receiving the response, the reader device calculates an expected transponder MAC based on the response, and verifies that the expected transponder MAC is equal to the transponder MAC in the response. This verification step ensures that the repeater device cannot change the message from the transponder with a false measured response time. Alternatively, other verification methods that ensure that the measured response time is from a real transponder may be used.

[0068] The reader device 210 and the transponder device 220 may have a shared secret key so that data packets transmitted between the devices may be encrypted and authenticated. Random numbers are used in command-response exchanges to prevent duplicate transactions.

[0069] Figure 5 An example sequence of command-response exchanges 501-510 between a reader device (PCD) 210 and a transponder device (PICC) 220 is shown, the sequence comprising a command-response exchange comprising a request for a stored measured response time for several previous command-response exchanges. The first command 501 is a prepare proximity check (PPC) command, to which the transponder device 220 responds by generating a random number RndR and sending a first response 502 comprising the published response time pps1 and the communication bit rate. The first response also comprises an indication of timing measurement support, which the reader device 210 needs to know for subsequent commands.

[0070] The second command 503 includes a proximity check (PC) which sends n challenge bytes RndC to the PICC 220. The PICC 220 sends a second response 504 with n bytes RndR as a response. A similar third command 505 and a corresponding third response 506 may be added to the sequence of command-response exchanges. In each of these command-response exchanges, the PCD 210 measures and stores the time for each PC execution. The PICC 220 also measures and stores the response time locally. Additional PC checks in the command-response exchanges 505, 506 may be added to reduce the residual relay attack window. A total of a typical maximum number of 8 such exchanges may be used in a practical embodiment.

[0071] After the PC check, a Get Proximity Check Time (GPCT) command-response exchange is performed, wherein the PCD 210 sends a fourth command 507 requesting the actual response time from the PICC 220. In response, the PICC 220 sends a fourth response 508 including the actual measured response time for the number of response times requested in the fourth command 507.

[0072] Finally, in a fifth command 509, the PCD initiates a MAC check with a Verify Proximity Check (VPC) command. The PICC responds with a fifth response 510, which the PCD then verifies. Assuming the actual response times match, the PCD 210 then confirms the proximity check. If the actual response times do not match, the PCD 210 may abort any further command-response exchanges with the PICC 220, and / or may need to perform another proximity check.

[0073] PCD 210 can detect whether PICC supports GPCT process in a secure manner. PCD 210 starts with a transaction towards PICC 220, for example, via normal ISO / IEC 7816-4 ISO select command. PCD and PICC then establish a secure session via dedicated mutual authentication. PICC capabilities can be read out on the secure channel before starting the actual proximity check protocol. PICC capabilities indicate whether the device supports the proximity check protocol. A proximity check can then be performed using a secure channel session MAC key or a separate proximity check key.

[0074] Proximity checks can be standardized via additions to the ISO / IEC 14443-4 standard, allowing applications to perform the verification step with any application key. Alternatively, proximity checks can be standardized on the APDU level with ISO / IEC 7816-4 commands.

[0075] By reading this disclosure, other changes and modifications will be apparent to the skilled person. Such changes and modifications may involve equivalent and other features that are already known to us in the field of contactless communication systems and can be used as a substitute or supplement to the features already described herein.

[0076] Although the attached claims are directed to specific feature combinations, it should be understood that the scope of the disclosure of the present invention also includes any novel feature or any novel feature combination or any generalized form thereof disclosed explicitly or implicitly herein, regardless of whether it relates to the same invention as currently claimed in any claim or whether it alleviates the same technical problem as any or all of the technical problems alleviated by the present invention.

[0077] Features described in the context of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features described in the context of a single embodiment for the sake of brevity may also be provided separately or in any suitable subcombination. Applicants hereby caution that new claims may be formulated based on such features and / or combinations of such features during the prosecution of this application or any further application derived therefrom.

[0078] For the sake of completeness, it is also stipulated that the term "comprising" does not exclude other elements or steps, the term "a" does not exclude a plurality, a single processor or other unit may realize the functions of several components recited in the claims, and the reference signs in the claims should not be construed as limiting the scope of the claims.

Claims

1. A method of performing a proximity check to determine whether a transponder device (220) is within the proximity of a reader device (210), characterized in that The method comprises: transmitting a command (231, 401, 507) from the reader device (210) to the transponder device (220), the command (231, 401, 507) comprising a request for measured response times for a number n of previous command-response exchanges (503-506) stored by the transponder device (220); In response to receiving the command (231, 401, 507) at the transponder device (220), transmitting a response (402, 508) to the reader device (210), the response (402, 508) comprising the measured response times (403) stored by the transponder device (220) for the previous n command-response exchanges (503-506). 1-n );as well as Whether a predetermined criterion for the proximity check is met is determined by comparing a measured response time stored by the reader device (210) with the measured response time transmitted by the transponder device (220) in the response (402).

2. The method according to claim 1, characterized in that n is greater than 1.

3. The method according to claim 1 or claim 2, characterized in that: n is not greater than 8.

4. A method according to any of the preceding claims, characterised in that The step of determining whether predetermined criteria for the proximity check are met is performed by the reader device.

5. The method according to claim 4, characterized in that If the predetermined criterion for the proximity check is met, the reader device (210) aborts further command-response exchanges with the transponder device (220).

6. A method according to any of the preceding claims, characterised in that The predetermined criteria includes the measured response time stored by the reader device (210) being equal to the measured response time transmitted by the transponder device (220) in the response (402).

7. A method according to any of the preceding claims, characterised in that Additionally comprising, prior to the step of transmitting the command (231, 401, 507) from the reader device (210) to the transponder device (220): The reader device (210) transmits a previous command (503, 505) to the transponder device (220); The transponder device (220) transmits a previous response (504, 506) to the reader device (210) in response to the previous command; and The transponder device (220) stores the measured response time of the previous response (504, 506) in a transponder memory (224).

8. A reader device (210) configured for contactless communication with a transponder device (220), characterized in that The reader device comprises: Antenna (211, 212); Memory (214); and a processing unit (216), Wherein the processing unit (216) is configured to: transmitting a command (231, 401, 507) from the reader device (210) to the transponder device (220), the command (231, 401, 507) comprising a request for measured response times for a number n of previous command-response exchanges (503-506) stored by the transponder device (220); In response to the command (231, 401, 507), receiving from the transponder device (220) a response message including measured response times (403) for the previous n command-response exchanges (503-506) stored by the transponder device (220); 1-n ) response (402, 508); and Whether a predetermined criterion for a proximity check is met is determined by comparing a measured response time stored by the reader device (210) with the measured response time transmitted by the transponder device (220) in the response (402).

9. A transponder device (220) configured for contactless communication with a reader device (210), characterized in that The transponder device comprises: Antenna (222); Memory (224); and a processing unit (226), The processing unit is suitable for: measuring and storing in the memory (224) a response time during a command-response exchange with the reader device (210); receiving a command (231, 401, 507) from the reader device (210), the command (231, 401, 507) comprising a request for measured response times for a number n of previous command-response exchanges (503-506) stored in the memory (224); and In response to the command (231, 401, 507), a message is sent including the stored measured response times (403) for the previous n command-response exchanges (503-506). 1-n ) response (402, 508).

10. A communication system (200), characterized in that: include: The reader device (210) according to claim 8; as well as The transponder device (220) according to claim 9.

Images