Method for detecting relay attack, vehicle and computer readable storage medium

Abstract

The application provides a relay attack detection method, a vehicle and a computer readable storage medium, and relates to the technical field of communication. The method comprises the following steps: obtaining an Nth communication duration after sending Nth information; wherein the Nth communication duration comprises a duration between sending Nth 1 feedback information and sending Nth 2 feedback information, the Nth 1 feedback information is feedback information sent by a peer device to indicate that the Nth information is received, and the Nth 2 feedback information is feedback information sent by the peer device to indicate a processing result of the Nth information; determining an Nth 1 duration threshold value and an Nth 2 duration threshold value based on the Nth information; wherein the Nth 1 duration threshold value is determined based on a processing duration of the Nth information, and the Nth 2 duration threshold value is determined based on the processing duration, the Nth information and a transmission time of the Nth 2 feedback information; and determining a detection result of the relay attack based on the Nth communication duration, the Nth 1 duration threshold value and the Nth 2 duration threshold value. The technical scheme of the application can reduce the detection false recognition rate of the relay attack.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to a method for detecting relay attacks, a vehicle, and a computer-readable storage medium. Background Technology

[0002] Digital car keys are virtual keys that replace traditional physical keys using devices such as smartphones and smartwatches. They utilize Near Field Communication (NFC) technology to unlock, start, and remotely control vehicles. NFC is a short-range, high-frequency wireless communication technology that allows for contactless, point-to-point data transmission between electronic devices.

[0003] However, relay attacks can occur between vehicles and digital car keys, posing a security risk to the vehicle. For example, attackers can amplify and forward the car key signal through a relay device, making the vehicle mistakenly believe that the digital car key is nearby. This allows them to unlock the car doors without the owner's knowledge and steal valuables from inside.

[0004] Therefore, the security of near-field communication (NFC) technologies is increasingly important, with accurate identification of relay attacks being a key requirement. Understandably, if a relay attack exists, there will be a communication delay between the digital car key and the vehicle. Current relay attack detection technologies detect the communication time between the digital car key and the vehicle; if the communication time exceeds a communication time threshold, a relay attack is identified. However, this communication time threshold is a fixed communication duration that includes relay transmission time. Some attackers can reduce the relay attack time by altering the communication methods or attacking the system, thus avoiding detection. This leads to a lower detection success rate, reduced security of digital car keys, and a decreased user experience. Summary of the Invention

[0005] This application provides a method for detecting relay attacks, which can reduce the false recognition rate of relay attacks.

[0006] To achieve the above objectives, the embodiments of this application adopt the following technical solutions: Firstly, a method for detecting relay attacks is provided. The method includes: after sending the Nth message, obtaining the Nth communication duration; wherein the Nth communication duration includes the duration between sending the N1st feedback message and sending the N2nd feedback message, the N1st feedback message being a feedback message sent by the peer device confirming receipt of the Nth message, and the N2nd feedback message being a feedback message sent by the peer device indicating the processing result of the Nth message; determining an N1st duration threshold and an N2nd duration threshold based on the Nth message; wherein the N1st duration threshold is determined based on the processing duration of the Nth message, and the N2nd duration threshold is determined based on the processing duration, the transmission time of the Nth message, and the N2nd feedback message; and determining the detection result of the relay attack based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold.

[0007] In this application, the N1st duration threshold is determined based on the processing time for the Nth information, and the N2nd duration threshold is determined based on the processing time, the transmission time of the Nth information and the N2nd feedback information. The time threshold used to determine whether a relay attack exists does not include the relay transmission time. Even if the attacker reduces the relay transmission time, it is highly likely to be identified as a relay attack, thus reducing the false identification rate.

[0008] In conjunction with the first aspect, in one possible design approach, determining the N1st and N2nd duration thresholds based on the Nth information includes: determining the N1st and N2nd duration thresholds from a preset mapping table based on the identification information of the Nth information; wherein the preset mapping table includes the mapping relationship between the identification information of multiple pieces of information, the N1st duration threshold, and the N2nd duration threshold.

[0009] In this application, by using the pre-established mapping relationship between multiple information identification information, the N1st duration threshold and the N2nd duration threshold, the N1st duration threshold and the N2nd duration threshold are obtained by directly querying the mapping relationship. This reduces the power consumption of each real-time calculation while achieving fast and accurate querying and acquisition of the N1st duration threshold and the N2nd duration threshold.

[0010] In conjunction with the first aspect, in one possible design approach, determining the N2nd duration threshold based on the Nth information includes: determining the transmission time based on the first data length of the Nth information and the second data length of the N2nd feedback information; and determining the N2nd duration threshold based on the transmission time and processing time.

[0011] In this application, the transmission time can be determined more accurately based on the data length of the information, and then the N2 duration threshold can be determined more accurately, thereby improving the accuracy of relay attack detection.

[0012] In conjunction with the first aspect, in one possible design approach, the detection result of a relay attack is determined based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold, including: if the Nth communication duration is greater than or equal to the N2nd duration threshold, the detection result is determined to be that a relay attack exists; if the Nth communication duration is less than or equal to the N1st duration threshold, the detection result is determined to be that no relay attack exists.

[0013] In this application, by setting clear comparison rules, it is possible to quickly identify whether there is a relay attack during the information transmission process, thereby improving the speed of relay attack detection.

[0014] In conjunction with the first aspect, in one possible design, the method further includes: if the Nth communication duration is greater than the N1th duration threshold and less than the N2th duration threshold, retransmitting the Nth information; obtaining the N'th communication duration; wherein the N'th communication duration includes the duration between sending the N1'th feedback information and sending the N2'th feedback information, the N1'th feedback information is the feedback information sent by the peer device confirming receipt of the retransmitted Nth information, and the N2'th feedback information is the feedback information sent by the peer device regarding the processing result of the retransmitted Nth information; if the N'th communication duration is greater than or equal to the N2th duration threshold, determining that a relay attack exists; if the N'th communication duration is less than or equal to the N1th duration threshold, determining that no relay attack exists.

[0015] In this application, the detection result of a relay attack can be clearly determined when the Nth communication duration is greater than or equal to the N2nd duration threshold or less than or equal to the N1st duration threshold. However, for the Nth communication duration falling within the range of greater than the N1st duration threshold and less than the N2nd duration threshold, the detection result of a relay attack cannot be clearly determined. A determination can be made by re-initiating the same Nth message and obtaining a new communication duration. This effectively reduces the impact of random fluctuations or instantaneous interference in a single measurement, thereby increasing the probability of accurate determination under critical conditions and enhancing the robustness of relay attack detection.

[0016] In conjunction with the first aspect, in one possible design, the method further includes: when sending the Mth information, determining a first cumulative communication duration; wherein M is an integer greater than or equal to 1, the information to be sent corresponding to the preset service includes the first information to the Mth information, the first cumulative communication duration includes the sum of the communication durations of each information from the first information to the Mth information, the communication duration includes the duration between sending the P1th feedback information and sending the P2th feedback information, the P1th feedback information is the feedback information sent by the peer device confirming receipt of each information from the first information to the Mth information, and the P2th feedback information is the feedback information sent by the peer device regarding the processing result of each information from the first information to the Mth information; and determining the detection result of the relay attack based on the first cumulative communication duration, the first cumulative duration threshold, and the second cumulative duration threshold.

[0017] In this application, the cumulative delay effect that relay attacks may introduce in continuous interactions can be amplified by accumulating the total time of multiple interactions and comparing it with the corresponding cumulative threshold, making the attack characteristics more significant and improving the reliability of relay attack detection to a certain extent.

[0018] In conjunction with the first aspect, in one possible design approach, the detection result of a relay attack is determined based on a first cumulative communication duration, a first cumulative duration threshold, and a second cumulative duration threshold, including: if the first cumulative communication duration is greater than or equal to the second cumulative duration threshold, the detection result is determined to be that a relay attack exists; if the first cumulative communication duration is less than or equal to the first cumulative duration threshold, the detection result is determined to be that no relay attack exists.

[0019] In conjunction with the first aspect, in one possible design, the method further includes: when the first cumulative communication duration is greater than a first cumulative duration threshold and less than a second cumulative duration threshold, sending first target information and obtaining updated first and second cumulative duration thresholds; wherein the data length of the first target information is greater than a preset data length; obtaining the first target communication duration; wherein the first target communication duration includes the duration between sending first target feedback information and sending second target feedback information, the first target feedback information being feedback information sent by the peer device confirming receipt of the first target information, and the second target feedback information being feedback information sent by the peer device regarding the processing result of the first target information; determining the second cumulative duration; wherein the second cumulative duration is determined based on the communication duration from the first information to the first target information and the first target communication duration; when the second cumulative communication duration is greater than or equal to the updated second cumulative duration threshold, determining that a relay attack exists; when the second cumulative communication duration is less than or equal to the updated first cumulative duration threshold, determining that no relay attack exists.

[0020] In this application, for the first cumulative communication duration falling within the range of greater than the first cumulative duration threshold and less than the second cumulative duration threshold, the detection result of a relay attack cannot be clearly determined. The determination can be made by re-initiating a message with a larger data length and obtaining a new cumulative communication duration. This can effectively reduce the impact of random fluctuations or instantaneous interference in a single measurement, thereby increasing the probability of making an accurate determination when the first cumulative communication duration is greater than the first cumulative duration threshold and less than the second cumulative duration threshold, and enhancing the robustness of relay attack detection.

[0021] In conjunction with the first aspect, in one possible design approach, after sending the Nth message, the Nth communication duration is obtained, including: if no feedback information for the Nth message is received, and if it is detected that the Nth message has been resent, then the Nth message is resent again, and the N'' communication duration is determined based on the resent Nth message.

[0022] In this application, by identifying the phenomenon of retransmission of the Nth information caused by a momentary failure of the communication link, discarding the communication duration of the retransmitted Nth information, and re-measuring the communication duration, the influence of normal factors such as momentary failure of the communication link on the communication duration is effectively isolated, thereby preventing these non-aggressive delays from being falsely reported as relay attacks, and further reducing the false alarm rate of relay attacks.

[0023] Secondly, embodiments of this application provide a card reader device, including: a radio frequency communication circuit; and an anti-relay attack module; wherein the anti-relay attack module is used to perform the relay attack detection method described in the first aspect.

[0024] Thirdly, embodiments of this application provide a vehicle digital key system, including: an in-vehicle device, wherein the in-vehicle device includes the card reader device described in the second aspect above; and a mobile device storing a digital car key for wireless communication with the in-vehicle device, and for performing preset functions when the detection result indicates that there is no relay attack.

[0025] Fourthly, embodiments of this application provide a vehicle, including: a processor; and a memory for storing processor-executable instructions, wherein the processor is used to execute the relay attack detection method described in the first aspect.

[0026] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program for executing the relay attack detection method described in the first aspect.

[0027] Sixthly, embodiments of this application provide a computer program product, which includes a computer program. When the computer program is executed by the processor of a computer device, it enables the computer device to execute the relay attack detection method described in the first aspect.

[0028] The technical effects of any of the design methods in the second to fourth aspects can be found in the technical effects of different design methods in the first aspect, and will not be repeated here. Attached Figure Description

[0029] Figure 1 The diagram shown is a schematic representation of a relay attack scenario provided by an exemplary embodiment of this application.

[0030] Figure 2 The diagram shown is a flowchart illustrating a relay attack detection method provided in an exemplary embodiment of this application.

[0031] Figure 3 The diagram shown is a comparison of the absence of relay attacks and the presence of relay attacks provided by an exemplary embodiment of this application.

[0032] Figure 4 The diagram shown is a flowchart illustrating a relay attack detection method provided in another exemplary embodiment of this application.

[0033] Figure 5 The diagram shown is a schematic representation of a relay attack detection device provided in an exemplary embodiment of this application. Detailed Implementation

[0034] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0035] Application Overview As described in the background section, existing relay attack detection technologies detect the communication time between the digital car key and the vehicle. If the communication time exceeds a communication time threshold, a relay attack is identified. However, this communication time threshold is a fixed duration that includes relay transmission time. Some attackers can reduce the relay attack time by altering the communication methods or attacking the system, thus avoiding detection. This leads to a decrease in the success rate of relay attack detection, reduced security of digital car keys, and a poorer user experience.

[0036] The basic principles of relay attacks will be explained in detail below, for example... Figure 1 The diagram illustrates a relay attack scenario provided by an exemplary embodiment of this application. Figure 1 As shown, this scenario includes a vehicle 100, a mobile phone 200, and a relay device 300. The relay device 300 may include mobile phone 300-1 and mobile phone 300-2.

[0037] The digital car key is set in mobile phone 200, which is the real card terminal. Mobile phone 300-1 can be used as the card terminal, and mobile phone 300-2 can be used as the real card reader terminal.

[0038] Under normal unlocking conditions, vehicle 100 can periodically send broadcast signals, and mobile phone 200 can respond to these broadcast signals to establish a wireless communication connection with vehicle 100. When the distance between mobile phone 200 and vehicle 100 is less than a distance threshold, vehicle 100 can successfully exchange some information with mobile phone 200, and then unlock the door of vehicle 100.

[0039] In the case of a relay attack unlocking, to unlock vehicle 100, one attacker can carry mobile phone 300-2, which can be forged into a digital car key, simulating mobile phone 200 to establish a wireless communication connection with vehicle 100. Another attacker can carry mobile phone 300-1, which can be forged into vehicle 100. If the distance between mobile phone 300-2 and vehicle 100 is less than a distance threshold, vehicle 100 can relay some information with mobile phone 200 through mobile phones 300-2 and 300-1. After successful information exchange, the door lock of vehicle 100 can be unlocked.

[0040] In the case of the aforementioned relay attack unlocking, since relay devices 300 (phone 300-1 and phone 300-2) need time to forward information, compared with the normal unlocking situation, the interaction between phone 200 and vehicle 100 will be delayed by some time. If the communication time between phone 200 and vehicle 100 for the interaction of one piece of information is greater than the communication time threshold, it is determined that a relay attack exists. However, the communication time threshold is a fixed communication duration threshold that includes relay transmission time. Some attackers can change the communication method or attack system used in relay attacks. For example, they can change the wireless communication between mobile phone 300-1 and mobile phone 300-2 from Wireless Fidelity (WIFI) to other communication methods, such as a proprietary 2.4G communication protocol or an Ultra Wide Band (UWB) proprietary communication protocol. Furthermore, instead of using the systems of mobile phone 300-1 and 300-2, they can use a conventional embedded system. This can reduce the relay time of a single message, thereby avoiding detection of a relay attack. This results in a lower success rate for relay attack detection, reduced security of digital car keys, and a decreased user experience.

[0041] To address the aforementioned technical problems, embodiments of this application provide a method for detecting relay attacks. The method includes: after sending the Nth message, obtaining the Nth communication duration, which includes the time between sending the N1st feedback message and sending the N2nd feedback message, where the N1st feedback message is a feedback message sent by the peer device confirming receipt of the Nth message, and the N2nd feedback message is a feedback message sent by the peer device indicating the processing result of the Nth message; then, determining an N1st duration threshold and an N2nd duration threshold based on the Nth message, where the N1st duration threshold is determined based on the processing duration of the Nth message, and the N2nd duration threshold is determined based on the processing duration, the transmission time of the Nth message, and the N2nd feedback message; and finally, determining the detection result of the relay attack based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold.

[0042] In this embodiment, the N1st duration threshold is determined based on the processing time for the Nth information, and the N2nd duration threshold is determined based on the processing time, the transmission time of the Nth information and the N2nd feedback information. The time threshold used to determine whether a relay attack exists does not include the relay transmission time. Even if the attacker reduces the relay transmission time, it is highly likely to be identified as a relay attack, thus reducing the false identification rate.

[0043] Exemplary scenario The relay attack detection method provided in this application can be applied to various wireless communication systems, including a first device and a second device. The first device and the second device can exchange information to achieve a preset target. For example, the first device is a card reader and the second device is a bank card; the card reader and the bank card can exchange information to complete a payment transaction. Alternatively, the first device is a door and the second device is a digital door key; the door and the digital door key can exchange information to open the door. Another example is a vehicle and the second device is a digital vehicle key; the vehicle and the digital door key can exchange information to unlock the car door, start the vehicle's transmitter, and perform other vehicle control functions.

[0044] The following is based on the above. Figure 1 Taking an application scenario as an example, this paper introduces the relay attack detection method provided in the embodiments of this application. For example... Figure 1 As shown, after vehicle 100 establishes a wireless communication connection with mobile phone 300-2, in order to unlock, vehicle 100 sends a message 1 to mobile phone 200. Then, vehicle 100 obtains the first communication duration. Then, vehicle 100 determines the first duration threshold and the second duration threshold based on the message 1. Then, vehicle 100 determines the detection result of relay attack based on the first communication duration, the first duration threshold and the second duration threshold.

[0045] The first communication duration includes the duration between sending feedback information 11 and sending feedback information 12. Feedback information 11 is feedback information sent by the peer device confirming receipt of information 1, and feedback information 12 is feedback information sent by the peer device regarding the processing result of information 1. The first duration threshold is determined based on the processing duration of information 1, and the second duration threshold is determined based on the processing duration and the transmission time of information 1 and feedback information 12. The relay attack detection method provided in this application can be applied to various vehicles. Vehicles include various types, such as sedans, SUVs, buses, and trucks. This application does not impose any special limitations on the specific form of the vehicle.

[0046] It should be understood that the above application scenario examples are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited thereto. Rather, the embodiments of this application can be applied to any applicable scenario.

[0047] Exemplary methods Figure 2 The diagram shown is a flowchart illustrating a relay attack detection method provided in an exemplary embodiment of this application. Figure 2 The method can be performed by a first electronic device, such as Figure 1 Vehicle 100 is executed. For example... Figure 2 As shown, the detection method for this relay attack may include the following steps: 210: After sending the Nth message, obtain the Nth communication duration.

[0048] The Nth message can refer to any message sent by the first electronic device to complete a preset service.

[0049] In some embodiments, the Nth information may be an information transmission unit that meets a preset protocol format, for example, the Nth information may be an Application Protocol Data Unit (APDU).

[0050] The Nth communication duration includes the time between sending the N1st feedback message and sending the N2nd feedback message. The N1st feedback message is the feedback message sent by the peer device confirming receipt of the Nth message, and the N2nd feedback message is the feedback message sent by the peer device indicating the processing result of the Nth message. For example, Figure 3 The diagram illustrates a comparison between the absence of a relay attack and the presence of a relay attack, provided in an exemplary embodiment of this application. Figure 3 As shown in Figure (a), in the absence of a relay attack, the first electronic device can act as a card reader, the second electronic device can act as a card, and the timing time 1, i.e. the communication duration, includes the duration between tx-end1 and rx-start1. tx-end1 represents the moment when the second electronic device sends feedback information confirming that information 1 has been received, and rx-start1 represents the moment when the second electronic device sends feedback information regarding the processing result of information 1.

[0051] Specifically, in some embodiments, the duration of the Nth communication can be obtained using a timer.

[0052] like Figure 3 Figure (b) shows an example of a relay attack scenario. The timing 2, or communication duration, includes the time between tx-end2 and rx-start2. This can be the time between the relay card sending the first feedback message and sending the second feedback message. tx-end2 represents the moment when the relay card sends the feedback message confirming that information 1 has been received, and rx-start2 represents the moment when the relay card sends the feedback message regarding the processing result of information 1.

[0053] 220: Determine the N1st and N2nd duration thresholds based on the Nth information.

[0054] The N1st duration threshold is determined based on the processing time of the target device for the Nth information. Specifically, in some embodiments, the N1st duration threshold includes the sum of the processing time of the target device for the Nth information and a preset redundancy value. The target device refers to the device to which the Nth information is to be sent and the device that actually processes the Nth information, not a relay device. The processing time of the target device for the Nth information can be pre-measured and stored in the first electronic device.

[0055] For example, please continue reading Figure 3 In Figure (b), the target device refers to the device to which the Nth information is to be sent, such as the second electronic device, and T3 is used to characterize the N1th duration threshold.

[0056] The N2nd duration threshold is determined based on the processing time, the transmission time of the Nth information, and the transmission time of the feedback information. Specifically, in some embodiments, the N2nd duration threshold is the sum of the processing time and the transmission time of the Nth information and the N2nd feedback information.

[0057] It is understandable that the number of relay sub-devices in the relay device and the communication method between them cannot be determined. Therefore, the transmission time between the relay sub-devices cannot be determined. However, the transmission information and communication method between the relay device and the second electronic device can be determined. Therefore, the time between the relay device and the second electronic device can generally be determined. Therefore, in some embodiments, the transmission time of the Nth information and the N2nd feedback information includes the first duration for the relay device to send the Nth information to the second electronic device and the second duration for the second electronic device to send the N2nd feedback information to the relay device.

[0058] Please continue reading. Figure 3 In Figure (b), the first duration can be the relay forwarding time T1, which is the time it takes for the relay card reader to send information 1 to the second electronic device. The second duration can be the relay return time T2, which is the time it takes for the second electronic device to send feedback information 1 to the relay card reader. The N2nd duration threshold can be T1+T2+T3.

[0059] Specifically, in some other embodiments, the N2nd duration threshold is determined by the sum of the processing time, the transmission time of the Nth information and the N2nd feedback information, plus a preset redundancy value. For example, the N2nd duration threshold can be T1 + T2 + T3 + preset redundancy value.

[0060] Understandably, the larger the data length of the information, the longer the transmission time required. Based on the data length of the information, the transmission time can be determined more accurately, thus allowing for a more accurate determination of the N2-th duration threshold and improving the accuracy of relay attack detection. Specifically, the transmission time of the Nth information and the feedback information is determined based on the data lengths of the Nth information and the feedback information, respectively.

[0061] Furthermore, in some embodiments, it can be determined by the following formula (1): Transmission time of the Nth message and the N2nd feedback message = (Data length of the Nth message + Data length of the N2nd feedback message) 9 bits / 106 kilobits per second.

[0062] For example, if the data length of the Nth message is 255 bytes and the data length of the feedback message is 20 bytes, then the minimum time required is (255 + 20). 9bit / 106kbit / s=24ms.

[0063] In some embodiments, the first electronic device can determine the N1-th duration threshold and the N2-th duration threshold from a preset mapping table based on the identification information of the Nth information; wherein the preset mapping table includes the mapping relationship between the identification information of multiple (more than N) information, the N1-th duration threshold, and the N2-th duration threshold. In this way, by directly querying the mapping relationship to obtain the N1-th duration threshold and the N2-th duration threshold through the pre-established mapping relationship between the identification information of multiple information, the N1-th duration threshold, and the N2-th duration threshold, the power consumption of each real-time calculation is reduced while achieving fast and accurate querying and acquisition of the N1-th duration threshold and the N2-th duration threshold.

[0064] In some embodiments, the identification information may be information represented by characters.

[0065] 230: Determine the detection result of relay attack based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold.

[0066] In some embodiments, if the Nth communication duration is greater than or equal to the N2nd duration threshold, the detection result is determined to indicate the presence of a relay attack; if the Nth communication duration is less than or equal to the N1st duration threshold, the detection result is determined to indicate the absence of a relay attack. By setting explicit comparison rules, it is possible to quickly identify whether a relay attack exists during information transmission, thereby improving the speed of relay attack detection.

[0067] When the Nth communication duration is greater than or equal to the N2nd duration threshold or less than or equal to the N1st duration threshold, the detection result of a relay attack can be clearly determined. However, for the Nth communication duration falling within the range of greater than the N1st duration threshold and less than the N2nd duration threshold, the detection result of a relay attack cannot be clearly determined. A determination can be made by re-initiating the same Nth message and obtaining a new communication duration. This effectively reduces the impact of random fluctuations or instantaneous interference in a single measurement, thereby increasing the probability of accurate determination under critical conditions and enhancing the robustness of relay attack detection. Specifically, this can be achieved through the following steps 2310 to 2340: 2310: If the Nth communication duration is greater than the N1th duration threshold but less than the N2th duration threshold, resend the Nth information.

[0068] 2320: Obtain the N'th communication duration; wherein, the N'th communication duration includes the duration between sending the N1'th feedback information and sending the N2'th feedback information, the N1'th feedback information is the feedback information sent by the peer device confirming receipt of the retransmitted Nth information, and the N2'th feedback information is the feedback information sent by the peer device regarding the processing result of the retransmitted Nth information.

[0069] 2330: If the N'th communication duration is greater than or equal to the N2th duration threshold, the detection result is determined to be a relay attack.

[0070] 2340: If the communication duration of the N'th communication is less than or equal to the threshold of the N1th duration, the detection result is determined to be that there is no relay attack.

[0071] In other embodiments, for the Nth communication duration falling within the range of greater than the N1th duration threshold and less than the N2th duration threshold, the detection result of a relay attack cannot be definitively determined. Instead, it can be determined by re-initiating multiple identical Nth messages and obtaining new communication durations. The new communication duration can be the longest communication duration among the multiple re-initiated identical Nth messages; there can be 3, 4, or 5 such durations, but it is not limited to any one of them.

[0072] To further improve the reliability of relay attack detection, the total time spent on multiple interactions can be accumulated and compared with a corresponding accumulation threshold. This amplifies the latency accumulation effect that relay attacks may introduce during continuous interactions, making the attack characteristics more prominent and improving the reliability of relay attack detection to some extent. Specifically, this can be achieved through steps 310 to 320 as follows: 310: When sending the Mth message, determine the first cumulative communication duration.

[0073] Where M is an integer greater than or equal to 1, the information to be sent corresponding to the preset service includes the first information to the Mth information, and the first cumulative communication duration includes the sum of the communication durations of the first information to the Mth information.

[0074] The Mth message can be the last message exchanged between the first electronic device and the second electronic device to complete a preset service. For example, if the preset service is unlocking a vehicle, and the first electronic device needs to send two messages to complete this service, then the second message is the last message to complete the vehicle unlocking service. The communication duration includes the time between sending the P1 feedback information and sending the P2 feedback information. The P1 feedback information is the feedback information sent by the peer device confirming that it has received each of the first information to the Mth information. The P2 feedback information is the feedback information sent by the peer device regarding the processing result of each of the first information to the Mth information.

[0075] 320: Determine the detection result of relay attack based on the first cumulative communication duration, the first cumulative duration threshold, and the second cumulative duration threshold.

[0076] In some embodiments, if the first cumulative communication duration is greater than or equal to a second cumulative duration threshold, the detection result is determined to be a relay attack; if the first cumulative communication duration is less than or equal to the first cumulative duration threshold, the detection result is determined to be no relay attack.

[0077] When the first cumulative communication duration is greater than or equal to the second cumulative duration threshold, or less than or equal to the first cumulative duration threshold, the detection result of a relay attack can be clearly determined. However, for the first cumulative communication duration falling within the range of greater than the first cumulative duration threshold and less than the second cumulative duration threshold, the detection result of a relay attack cannot be clearly determined. A new cumulative communication duration can be obtained by re-initiating a message with a larger data length, effectively reducing the impact of random fluctuations or instantaneous interference in a single measurement. This increases the probability of making an accurate determination when the first cumulative communication duration is greater than the first cumulative duration threshold and less than the second cumulative duration threshold, thus enhancing the robustness of relay attack detection. Specifically, this can be achieved through the following steps 3210 to 3240: 3210: If the first cumulative communication duration is greater than the first cumulative duration threshold and less than the second cumulative duration threshold, send the first target information and obtain the updated first cumulative duration threshold and second cumulative duration threshold; wherein the data length of the first target information is greater than the preset data length.

[0078] For example, the preset data length can be 255 bytes. The purpose of sending the first target information is to significantly increase the cumulative latency by taking advantage of its longer inherent transmission time.

[0079] 3220: Obtain the first target communication duration; wherein, the first target communication duration includes the duration between sending the first target feedback information and sending the second target feedback information, the first target feedback information is the feedback information sent by the peer device confirming that the first target information has been received, and the second target feedback information is the feedback information sent by the peer device regarding the processing result of the first target information.

[0080] 3230: Determine the second cumulative duration; wherein the second cumulative duration is determined based on the communication duration from the first information to the first target information and the communication duration of the first target.

[0081] 3240: If the second cumulative communication duration is greater than or equal to the updated second cumulative duration threshold, the detection result is determined to be a relay attack.

[0082] 3250: If the second cumulative communication duration is less than or equal to the updated first cumulative duration threshold, the detection result is determined to be that there is no relay attack.

[0083] Understandably, by identifying the phenomenon of retransmission of the Nth information caused by a momentary failure of the communication link, discarding the communication duration of the retransmitted Nth information, and re-measuring the communication duration, the impact of normal factors such as momentary failure of the communication link on the communication duration is effectively isolated, thereby preventing these non-aggressive delays from being falsely reported as relay attacks, and further reducing the false alarm rate of relay attacks.

[0084] Specifically, in step 210, if no feedback information for the Nth information is received, and the retransmission of the Nth information is detected, the Nth information is retransmitted again. The N'' communication duration is then determined based on the retransmitted Nth information, and the detection result of the relay attack is determined based on the N'' communication duration. The specific process of relay attack detection is described in the preceding and following texts and will not be repeated here.

[0085] The following uses APDU as an example to introduce the relay attack detection method provided in the embodiments of this application. For example, Figure 4 The diagram shown is a flowchart illustrating a relay attack detection method provided in another exemplary embodiment of this application. Figure 4 The method can be performed by a first electronic device, such as Figure 1 Vehicle 100 is executing, Figure 4 Zhongyu Figure 2 The same steps are detailed above and will not be repeated here. Figure 4 As shown, the detection method for this relay attack may include the following steps: 410: Initializes the communication time of a single APDU to zero, and initializes the total communication time of APDUs to zero.

[0086] The communication time of a single APDU is a specific example of the Nth message mentioned earlier, referring to any message sent by the first electronic device to complete a preset service, and its communication time is a specific example of the Nth communication duration mentioned earlier. The total communication time of the APDU is a specific example of the first cumulative communication duration mentioned earlier.

[0087] This step involves initializing the flag for recording the communication time of a single APDU; specifically, clearing the communication time of the previous APDU to zero. It also involves initializing the flag for recording the total communication time of all APDUs; specifically, clearing the communication time of the previous total APDU to zero. This facilitates the subsequent recording of the communication time of both individual APDUs and the total communication time of all APDUs.

[0088] 420: Get the maximum and minimum thresholds for total APDU communication time.

[0089] The maximum and minimum communication time thresholds for the total APDU refer to the aforementioned second cumulative duration threshold and first cumulative duration threshold, respectively.

[0090] 430: Get the maximum and minimum threshold values ​​for the current single APDU.

[0091] The maximum and minimum thresholds for a single APDU currently refer to the aforementioned N1-th duration threshold and N2-th duration threshold, respectively.

[0092] After sending the current single APDU, obtain the maximum and minimum thresholds for the current single APDU.

[0093] 440: Determine if the relay flag is the first flag.

[0094] A relay flag is a flag used to record and transmit the detection result of a current relay attack. For example, the first flag indicates that a relay attack has been detected and the next APDU should be terminated; the second flag indicates that no relay attack has been detected and the next APDU can be sent.

[0095] Specifically, if the relay flag is determined to be the first flag, then step 450 is executed; if the relay flag is determined to be the second flag, then step 460 is executed.

[0096] 450: Stop sending the next APDU.

[0097] 460: Data exchange.

[0098] Data exchange refers to the data interaction between the first electronic device sending an APDU and receiving feedback information for that APDU.

[0099] 470: Get the actual communication time of the current single APDU.

[0100] The actual communication time of a single APDU refers to the Nth communication duration mentioned above.

[0101] 480: Determine if there is a retransmission of the current APDU.

[0102] A retransmission occurs when the current APDU is retransmitted without receiving feedback information. If a retransmission is detected for the current APDU, proceed to step 4120.

[0103] 490: Determine whether the actual communication time of the current single APDU is greater than or equal to the maximum threshold of the current single APDU.

[0104] If it is determined that the actual communication time of the current single APDU is greater than or equal to the maximum threshold of the current single APDU, proceed to step 4100. If it is determined that the actual communication time of the current single APDU is less than the maximum threshold of the current single APDU, proceed to step 4110.

[0105] 4100: Set the relay flag to the first flag and stop sending the next APDU.

[0106] 4110: Determine whether the actual communication time of the current single APDU is less than the minimum threshold of the current single APDU.

[0107] If it is determined that the actual communication time of the current single APDU is less than the minimum threshold of the current single APDU, proceed to step 4130. If it is determined that the actual communication time of the current single APDU is greater than or equal to the minimum threshold of the current single APDU, proceed to step 4120.

[0108] 4120: Resend the current APDU and remeasure the communication duration.

[0109] 4130: Set the relay flag to the second flag and set the total communication time of the APDU to the sum of the actual communication time of the current single APDU and the actual communication time of all previous APDUs.

[0110] 4140: Determine if this is the last APDU.

[0111] If it is determined that the current APDU is the last APDU, proceed to step 4160; if it is determined that the current APDU is not the last APDU, proceed to step 4150.

[0112] 4150: Send the next APDU.

[0113] 4160: Determine whether the total communication time of APDU is greater than or equal to the maximum threshold of total APDU communication time.

[0114] If the total communication time of APDUs is determined to be greater than or equal to the maximum threshold for total APDU communication time, proceed to step 4170. If the total communication time of APDUs is determined to be less than the maximum threshold for total APDU communication time, proceed to step 4180.

[0115] 4170: Set the relay flag to the first flag and stop sending the next APDU.

[0116] 4180: Determine whether the total communication time of APDUs is less than or equal to the minimum threshold for total APDU communication time.

[0117] If the total communication time of APDUs is determined to be less than or equal to the minimum threshold for total APDU communication time, proceed to step 4190. If the total communication time of APDUs is determined to be greater than the minimum threshold for total APDU communication time, proceed to step 4200.

[0118] 4190: The relay flag is set to the second flag and authentication is successful.

[0119] 4200: Send a long APDU.

[0120] Sending a long APDU is a specific example of sending the first target information mentioned earlier. It will not be repeated here. After sending the long APDU, the 420 procedure and subsequent steps are executed in a loop.

[0121] Exemplary device Figure 5 The diagram shown is a schematic representation of a relay attack detection device provided in an exemplary embodiment of this application. Figure 5 As shown, the relay attack detection device 500 includes: an acquisition module 510, a determination module 520, and a detection module 530.

[0122] The acquisition module 510 is used to acquire the Nth communication duration after sending the Nth information; wherein the Nth communication duration includes the duration between sending the N1st feedback information and sending the N2nd feedback information, the N1st feedback information is the feedback information sent by the peer device confirming receipt of the Nth information, and the N2nd feedback information is the feedback information sent by the peer device regarding the processing result of the Nth information; the determination module 520 is used to determine the N1st duration threshold and the N2nd duration threshold based on the Nth information; wherein the N1st duration threshold is determined based on the processing duration of the Nth information, and the N2nd duration threshold is determined based on the processing duration, the transmission time of the Nth information and the N2nd feedback information; the detection module 530 is used to determine the detection result of the relay attack based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold.

[0123] According to one embodiment of this application, the determining module 520 is used to determine the N1st duration threshold and the N2nd duration threshold based on the Nth information, including: determining the N1st duration threshold and the N2nd duration threshold from a preset mapping table based on the identification information of the Nth information; wherein, the preset mapping table includes the mapping relationship between the identification information of multiple pieces of information, the N1st duration threshold and the N2nd duration threshold.

[0124] According to one embodiment of this application, the determining module 520 is used to determine the N2nd duration threshold based on the Nth information, including: determining the transmission time based on the first data length of the Nth information and the second data length of the N2nd feedback information; and determining the N2nd duration threshold based on the transmission time and processing time.

[0125] According to one embodiment of this application, the detection module 530 is used to determine the detection result of a relay attack based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold, including: if the Nth communication duration is greater than or equal to the N2nd duration threshold, the detection result is determined to be that a relay attack exists; if the Nth communication duration is less than or equal to the N1st duration threshold, the detection result is determined to be that no relay attack exists.

[0126] According to one embodiment of this application, the detection module 530 is further configured to: resend the Nth information if the Nth communication duration is greater than the N1st duration threshold and less than the N2nd duration threshold; obtain the N'th communication duration; wherein the N'th communication duration includes the duration between sending the N1'th feedback information and sending the N2'th feedback information, the N1'th feedback information is feedback information sent by the peer device confirming receipt of the resent Nth information, and the N2'th feedback information is feedback information sent by the peer device regarding the processing result of the resent Nth information; if the N'th communication duration is greater than or equal to the N2nd duration threshold, determine that a relay attack exists; if the N'th communication duration is less than or equal to the N1st duration threshold, determine that no relay attack exists.

[0127] According to one embodiment of this application, the detection module 530 is further configured to determine a first cumulative communication duration when sending the Mth information; wherein M is an integer greater than or equal to 1, the information to be sent corresponding to the preset service includes the first information to the Mth information, the first cumulative communication duration includes the sum of the communication durations of each information from the first information to the Mth information, the communication duration includes the duration between sending the P1th feedback information and sending the P2th feedback information, the P1th feedback information is the feedback information sent by the peer device confirming that each information from the first information to the Mth information has been received, and the P2th feedback information is the feedback information sent by the peer device regarding the processing result of each information from the first information to the Mth information; and the detection result of the relay attack is determined based on the first cumulative communication duration, the first cumulative duration threshold, and the second cumulative duration threshold.

[0128] According to one embodiment of this application, the detection module 530 is configured to determine that a relay attack exists when the first cumulative communication duration is greater than or equal to a second cumulative duration threshold; and to determine that no relay attack exists when the first cumulative communication duration is less than or equal to the first cumulative duration threshold.

[0129] According to one embodiment of this application, the detection module 530 is further configured to: send first target information and obtain updated first and second cumulative duration thresholds when the first cumulative communication duration is greater than a first cumulative duration threshold and less than a second cumulative duration threshold; wherein the data length of the first target information is greater than a preset data length; obtain the first target communication duration; wherein the first target communication duration includes the duration between sending the first target feedback information and sending the second target feedback information, the first target feedback information being feedback information sent by the peer device confirming receipt of the first target information, and the second target feedback information being feedback information sent by the peer device regarding the processing result of the first target information; determine the second cumulative duration; wherein the second cumulative duration is determined based on the communication duration from the first information to the first target information and the first target communication duration; determine the detection result as a relay attack when the second cumulative communication duration is greater than or equal to the updated second cumulative duration threshold; and determine the detection result as no relay attack when the second cumulative communication duration is less than or equal to the updated first cumulative duration threshold.

[0130] According to one embodiment of this application, the determining module 520 is used to determine the N'' communication duration based on the retransmission of the Nth information if the Nth information is detected after the Nth information has been sent and no feedback information for the Nth information has been received.

[0131] Embodiments of this application provide a card reader device, including: a radio frequency communication circuit; and an anti-relay attack module; wherein the anti-relay attack module is used to execute the relay attack detection method provided in any of the above embodiments.

[0132] An embodiment of this application provides a vehicle digital key system, including: an in-vehicle device, wherein the in-vehicle device includes the aforementioned card reader device; and a mobile device storing a digital car key for wireless communication with the in-vehicle device, and for performing preset functions when the detection result indicates that no relay attack exists.

[0133] Embodiments of this application provide a vehicle, including: a processor; and a memory for storing processor-executable instructions, wherein the processor is used to execute the relay attack detection method provided in any of the above embodiments.

[0134] This application also provides a computer-readable storage medium storing a computer program for executing the relay attack detection method provided in any of the above embodiments.

[0135] This application also provides a computer program product, which includes a computer program. When the computer program is executed by the processor of a computer device, it enables the computer device to execute the relay attack detection method provided in any of the above embodiments.

[0136] All of the above-mentioned optional technical solutions can be combined in any way to form optional embodiments of this application, and will not be described in detail here.

[0137] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0138] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0140] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0141] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0142] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program verification codes, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0143] It should be noted that in the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0144] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0145] The above are merely preferred embodiments of this application and are not intended to limit this application. Any modifications or equivalent substitutions made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for detecting relay attacks, characterized in that, The method includes: After sending the Nth message, the Nth communication duration is obtained; wherein, the Nth communication duration includes the duration between sending the N1st feedback message and sending the N2nd feedback message, the N1st feedback message is the feedback message sent by the peer device confirming that the Nth message has been received, and the N2nd feedback message is the feedback message sent by the peer device regarding the processing result of the Nth message; The N1st and N2nd duration thresholds are determined based on the Nth information; wherein the N1st duration threshold is determined based on the processing time for the Nth information, and the N2nd duration threshold is determined based on the processing time, the transmission time of the Nth information, and the N2nd feedback information. The detection result of the relay attack is determined based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold.

2. The relay attack detection method according to claim 1, characterized in that, The determination of the N1st and N2nd duration thresholds based on the Nth information includes: Based on the identification information of the Nth information, the N1st duration threshold and the N2nd duration threshold are determined from a preset mapping table; wherein, the preset mapping table includes the mapping relationship between the identification information of multiple information, the N1st duration threshold and the N2nd duration threshold.

3. The relay attack detection method according to claim 1, characterized in that, Determining the N2-th duration threshold based on the Nth information includes: The transmission time is determined based on the first data length of the Nth information and the second data length of the N2nd feedback information; Based on the transmission time and the processing duration, the N2nd duration threshold is determined.

4. The relay attack detection method according to claim 1, characterized in that, The determination of the relay attack detection result based on the Nth communication duration, the N1st duration threshold, and the N2nd duration threshold includes: If the Nth communication duration is greater than or equal to the N2th duration threshold, the detection result is determined to indicate the presence of a relay attack. If the Nth communication duration is less than or equal to the N1th duration threshold, the detection result is determined to be that there is no relay attack.

5. The relay attack detection method according to claim 4, characterized in that, The method further includes: If the Nth communication duration is greater than the N1st duration threshold and less than the N2nd duration threshold, the Nth information is retransmitted. Obtain the N'th communication duration; wherein, the N'th communication duration includes the duration between sending the N1'th feedback information and sending the N2'th feedback information, the N1'th feedback information is the feedback information sent by the peer device confirming receipt of the retransmitted Nth information, and the N2'th feedback information is the feedback information sent by the peer device regarding the processing result of the retransmitted Nth information; If the N'th communication duration is greater than or equal to the N2th duration threshold, the detection result is determined to be a relay attack. If the N'th communication duration is less than or equal to the N1th duration threshold, the detection result is determined to be that there is no relay attack.

6. The relay attack detection method according to claim 4, characterized in that, The method further includes: When sending the Mth information, a first cumulative communication duration is determined; where M is an integer greater than or equal to 1, the information to be sent corresponding to the preset service includes the first information to the Mth information, the first cumulative communication duration includes the sum of the communication durations of each information from the first information to the Mth information, the communication duration includes the duration between sending the P1th feedback information and sending the P2th feedback information, the P1th feedback information is the feedback information sent by the peer device confirming that each information from the first information to the Mth information has been received, and the P2th feedback information is the feedback information sent by the peer device regarding the processing result of each information from the first information to the Mth information; The detection result of relay attack is determined based on the first cumulative communication duration, the first cumulative duration threshold, and the second cumulative duration threshold.

7. The relay attack detection method according to claim 6, characterized in that, The determination of the relay attack detection result based on the first cumulative communication duration, the first cumulative duration threshold, and the second cumulative duration threshold includes: If the first cumulative communication duration is greater than or equal to the second cumulative duration threshold, the detection result is determined to be a relay attack. If the first cumulative communication duration is less than or equal to the first cumulative duration threshold, the detection result is determined to be that there is no relay attack.

8. The relay attack detection method according to claim 7, characterized in that, The method further includes: If the first cumulative communication duration is greater than the first cumulative duration threshold and less than the second cumulative duration threshold, the first target information is sent, and the updated first cumulative duration threshold and second cumulative duration threshold are obtained; wherein, the data length of the first target information is greater than the preset data length; Obtain the first target communication duration; wherein, the first target communication duration includes the duration between sending the first target feedback information and sending the second target feedback information, the first target feedback information is feedback information sent by the peer device confirming receipt of the first target information, and the second target feedback information is feedback information sent by the peer device regarding the processing result of the first target information; A second cumulative duration is determined; wherein the second cumulative duration is determined based on the communication duration from the first information to the first target information and the first target communication duration; If the second cumulative communication duration is greater than or equal to the updated second cumulative duration threshold, the detection result is determined to be a relay attack. If the second cumulative communication duration is less than or equal to the updated first cumulative duration threshold, the detection result is determined to be that there is no relay attack.

9. The relay attack detection method according to claim 1, characterized in that, The step of obtaining the Nth communication duration after sending the Nth information includes: if no feedback information is received for the Nth information, and if it is detected that the Nth information has been resent, then the Nth information is resent again, and the N'' communication duration is determined based on the resent Nth information.

10. A card reader device, characterized in that, include: Radio frequency communication circuits; A relay attack prevention module; wherein the relay attack prevention module is used to perform the relay attack detection method according to any one of claims 1 to 9.

11. A vehicle digital key system, characterized in that, include: Vehicle-mounted equipment, wherein the vehicle-mounted equipment includes the card reader device as described in claim 10; The mobile device stores a digital car key for wireless communication with the vehicle-mounted equipment, and performs preset functions if the detection result indicates that there is no relay attack.

12. A vehicle, characterized in that, include: processor; Memory used to store the processor's executable instructions. The processor is used to execute the relay attack detection method according to any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for executing the relay attack detection method according to any one of claims 1 to 9.

Images