NFC Relay Attack Detection With Encrypted Timing Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Relay attacks in contact and contactless access transactions, such as payment transactions, allow attackers to access data without authorization by using two NFC-enabled phones to relay command messages between a contactless card and a terminal, necessitating a mechanism to detect and prevent such attacks without substantial changes to existing infrastructure.
Innovation Solution
Implementing a method where devices exchange encrypted wait time extension messages with unpredictable timings and parameters, allowing comparison of time periods to detect deviations that indicate a potential relay attack, and optionally terminating the transaction if thresholds are exceeded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If relay attack detection mechanisms are implemented, then security against relay attacks is improved, but device complexity and infrastructure changes increase
Solution Approach 1:
The system performs preliminary actions by establishing encrypted communication channels and exchanging cryptographic keys before the actual access transaction occurs. The portable device and access device exchange challenge-response messages and establish security parameters in advance, so that when the relay attack attempts to intercept communications, the pre-established cryptographic bindings and timing expectations are already in place to detect the anomaly.
Solution Approach 2:
The system changes parameters by introducing timing parameters (wait time extensions) and cryptographic parameters (unpredictable numbers, encrypted values) into the transaction protocol. The portable device generates unpredictable numbers and encrypts them with cryptographic keys, then compares timing parameters between direct and relayed communications. These parameter changes create detectable differences that distinguish legitimate transactions from relay attacks without requiring major infrastructure overhaul.
2Measurement precision
If timing comparison with microsecond or nanosecond precision is required, then relay attack detection accuracy is improved, but measurement precision requirements and system complexity increase
Solution Approach 1:
The system uses cryptographic messages as intermediaries to carry timing information. Instead of directly measuring and comparing raw timing values between devices, the portable device generates unpredictable numbers, encrypts them with cryptographic keys, and embeds timing parameters within these encrypted messages. The access device receives these intermediary cryptographic messages, decrypts them, and then compares the embedded timing parameters. This intermediary layer simplifies the measurement process while maintaining microsecond or nanosecond precision.
Solution Approach 2:
The system replaces direct mechanical timing measurement with cryptographic processing. Instead of using hardware timers and direct time-stamp comparisons that would require precise synchronization and complex timing infrastructure, the system uses cryptographic key exchanges and encrypted message transmissions. The timing information is embedded within cryptographic protocols, allowing precision timing comparison through software-based cryptographic operations rather than complex hardware timing mechanisms.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method preventing relay attacks between first and second devices is disclosed. The method includes providing, by a first device, a command message, receiving a request message and providing a response message to a second device. The time period between the receipt of the command message and the transmission of the response message by the first device is compared to another time period between the time when the command message was sent and the response message was received by the second device. If those times substantially match, then the first device can have assurance that a relay attack is not occurring.