RFID Reader Transponder Relay Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Transponders, such as smart cards and RFID tags, are vulnerable to relay attacks where an attacker intercepts and forwards signals between a reader and the transponder, allowing unauthorized access, and existing solutions struggle to efficiently detect such attacks due to limitations in response time measurement and authentication processes.
Innovation Solution
A system where a reader and transponder exchange binary codes based on predefined numbers to measure response time and authenticate each other simultaneously, using a method that includes sending a first binary code and receiving a second binary code to determine the validity of the connection, thereby enhancing security by detecting relay attacks with high probability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the response time measurement window is made smaller to detect relay attacks more accurately, then the security against relay attacks is improved, but the authentication process becomes more difficult to complete within the time window due to encryption/decryption requirements
Solution Approach 1:
The system performs preliminary actions by establishing a trusted relationship between reader and transponder before the actual authentication exchange. The reader stores authentication data from the transponder in advance, and both parties exchange nonces beforehand. This preliminary setup enables the subsequent authentication to complete rapidly within the tight time window, as the heavy cryptographic operations are pre-positioned rather than performed in real-time during the measurement interval.
Solution Approach 2:
The authentication process is segmented into distinct phases: a preliminary phase where authentication data and nonces are exchanged and stored, and a measurement phase where the actual authentication occurs rapidly using pre-positioned data. This segmentation allows the time-consuming encryption/decryption operations to be distributed across different time periods, with the critical measurement phase containing only lightweight verification operations that can complete within the constrained time window.
2Ease of operation
If traditional authentication methods are used, then the authentication process is simpler, but the system becomes vulnerable to relay attacks
Solution Approach 1:
The system introduces nonces as intermediary elements that mediate between the reader and transponder during authentication. These random numbers are exchanged and incorporated into cryptographic operations, creating a unique authentication session that cannot be replayed. The nonce acts as a mediator that adds security against relay attacks while maintaining the overall simplicity of the authentication flow, as the nonce exchange follows the same basic request-response pattern as traditional methods.
Solution Approach 2:
The system changes the parameter of authentication by incorporating time-sensitive elements (nonces and response time measurements) into the authentication process. Instead of using static credentials alone, the authentication now depends on dynamic parameters that change with each session. This parameter change maintains ease of operation because the process flow remains similar, but it dramatically improves security by making relayed authentication attempts detectable through timestamp validation and nonce verification.
Data Source
Figure 1
Figure 2~4
Figure 3
AI summary
Reader (201) for determining the validity of a connection to a transponder (202) wherein the reader (201) is designed to measure a response time of a transponder (202) based on a time interval between sending a first binary code based on predefined numbers to said transponder (202) and receiving a second binary code from said transponder (202) in response to the first binary code and wherein the reader (201) is designed to authenticate the transponder (202) based on the received second binary code simultaneously with the measuring of the response time.