Proximity Check Using Measured Frame Delay Against Relay Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Contactless interfaces are vulnerable to relay attacks, where unauthorized third parties relay information between a transponder and reader device without physical proximity, necessitating a proximity check to prevent fraudulent transactions.
Innovation Solution
A method involving a reader device transmitting a command to a transponder device to measure and exchange actual frame delay times for multiple previous command-response exchanges, allowing comparison to determine genuine proximity, and aborting further exchanges if the criterion is not met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a very short time window is used for proximity check to reduce relay attack risk, then security against relay attacks is improved, but the PICC reaction time demands become too strong and the acceptable time window reduces over time
Solution Approach 1:
The patent changes the parameter being checked from a fixed expected response time to the actual measured frame delay time (FDT). By measuring the real FDT for each command-response exchange and using it as the basis for proximity verification, the system adapts to varying PICC reaction times without compromising security. This resolves the contradiction by making the security check flexible enough to accommodate different reaction time requirements while still detecting relay attacks.
Solution Approach 2:
The patent implements feedback by having the PICC store and return the actual measured FDT values for previous command-response exchanges. The PCD receives this feedback and compares the returned FDT with its own measurements to verify proximity. This feedback mechanism allows the system to adapt to actual performance characteristics while maintaining security, resolving the contradiction between strict time windows and operational flexibility.
2Device complexity
If a fixed expected transponder device response time is used for proximity check, then the proximity verification process is simplified, but the method becomes vulnerable to relay attacks with sophisticated timing
Solution Approach 1:
The patent changes the verification parameter from a predetermined expected response time to the actual measured frame delay time. Instead of comparing against a fixed threshold, the system measures and verifies the actual FDT that occurs during communication. This maintains relative simplicity while significantly improving resistance to relay attacks, as the actual measured time is much harder to fake than an expected time value.
Solution Approach 2:
The patent performs preliminary measurement of the frame delay time during normal command-response exchanges before the actual proximity verification takes place. The PICC stores the measured FDT values in advance, and these pre-measured values are then used for verification. This preliminary action allows the system to have accurate timing data ready without adding complexity to the verification process itself, while maintaining high security.
3Reliability
If the acceptable time window is reduced over time to counter sophisticated relays, then security is maintained, but the PICC reaction time demands become increasingly unrealistic
Solution Approach 1:
The patent makes the time window dynamic by using the actual measured FDT as the basis for verification rather than a fixed predetermined value. The system adapts to the actual timing characteristics of each PICC device and each communication exchange. This dynamic approach maintains security against sophisticated relays while automatically adjusting to realistic PICC reaction times, eliminating the need to continuously reduce the time window to unrealistic levels.
Solution Approach 2:
The patent changes the verification parameter from a static predetermined time value to a dynamic measured FDT value that reflects actual communication conditions. This parameter change allows the system to maintain security while accommodating the natural variations in PICC reaction time without requiring increasingly stringent and unrealistic time constraints.
Data Source
AI summary
The disclosure relates to performing a proximity check to determine whether a transponder device is in proximity of a reader device. In an example embodiment, a method of performing a proximity check to determine whether a transponder device is in proximity of a reader device comprises: transmitting a command from the reader device to the transponder device, the command including a request for a measured response time for a number n of previous command-response exchanges stored by the transponder device; in response to receiving the command at the transponder device, transmitting a response to the reader device, the response including a measured response time stored by the transponder device for the previous n command-response exchanges; and determining whether a predetermined criterion for the proximity check is fulfilled by comparing a measured response time stored by the reader device with the measured response time transmitted by the transponder device in the response.