Systems, methods and apparatuses for prevention of relay attacks

Patent metadata

Field	Value
Publication number	US-10958309-B2
Application number	US-201715817820-A
Country	US
Kind code	B2
Filing date	Nov 20, 2017
Priority date	Sep 17, 2013
Publication date	Mar 23, 2021
Grant date	Mar 23, 2021

Abstract

The systems, methods and apparatuses described herein provide an apparatus configured for preventing relay attacks on a communication link between the apparatus and a communication partner. The apparatus may comprise a communication port, a timer and a processor. The processor may be configured to generate a request, transmit the request through the communication link using the communication port and start counting time using the timer, receive a response via the communication port and stop the timer, receive authentication data via the communication port, authenticate the authentication data, compare the counted time with a predefined threshold, compare a first field within the request with a second field within the response and determine whether there is a relay attack.

First claim

What is claimed is:

1. A method for an apparatus to determine whether there is a relay attack on a communication link between the apparatus and a device, the method comprising:
establishing, by the apparatus, a communication link with the device via a communication port of the apparatus;
receiving, by the apparatus via the communication link, from the device a first list of relay attack detection methods that the device is configured to execute;
comparing, by the apparatus, the first list of relay attack detection methods received from the device and a stored list of relay attack detection methods that the apparatus is configured to execute;
generating, by the apparatus, a second list of relay attack detection methods that the apparatus and the device are both configured to execute based on the comparison of the first list of relay attack detection methods received from the device and the stored list of relay attack detection methods, wherein generating the second list comprises determining which of the stored list of relay attack detection methods is also supported by the device based on the first list of relay attack detection methods received from the device such that the second list of relay attack detection methods includes a complete list of all relay attack detection methods implemented by the apparatus and supported by the device;
executing, by the apparatus, one or more relay attack detection methods of the second list; and
determining, by the apparatus, whether there is a relay attack on the communication link according to at least one result generated by the one or more relay attack detection methods executed by the apparatus.

2. The method of claim 1 , wherein each of the relay attack detection methods of the second list is associated with a weighted-value.

3. The method of claim 2 , further comprising filtering from the second list, by the apparatus, a first relay attack detection method from the relay attack detection methods of the second list based upon a respective weighted-value of the first relay attack detection method.

4. The method of claim 2 , further comprising:
obtaining, by the apparatus, at least a first result from a first relay attack detection method of the second list executed by the apparatus and a second result from a second relay attack detection method of the second list executed by the apparatus; and
discarding, by the apparatus, at least the first result or the second result based upon the weighted-value associated with each of the first and second relay attack detection methods.

5. The method of claim 2 , further comprising:
obtaining, by the apparatus, a result from each of the one or more relay attack detection methods executed by the apparatus;
determining, by the apparatus, a total weight value based on each result indicating no relay attack detected for each respective relay attack detection method; and
determining, by the apparatus, whether the total weight value satisfies a threshold.

6. The method of claim 1 , wherein the apparatus executes at least two relay attack detection methods from the second list, and wherein the apparatus executes the at least two relay attack detection methods in parallel.

7. The method of claim 1 , wherein the apparatus executes at least two relay attack detection methods from the second list, and wherein the apparatus sequentially executes the at least two relay attack detection methods.

8. The method of claim 1 , wherein the apparatus determines that the relay attack is on the communication link based in part on a delay on the communication link.

9. The method of claim 1 , wherein the apparatus executes at least two relay attack detection methods from the second list, and wherein the apparatus determines that the relay attack is on the communication link when at least one of the at least two relay attack detection methods executed generates a result indicating the relay attack is on the communication link.

10. The method of claim 1 , wherein the first list of relay attack detection methods comprises one or more relay attack detection methods, and wherein the second list of relay attack detection methods comprises one or more relay attack detection methods.

11. An apparatus for determining whether there is a relay attack, the apparatus comprising:
a communication port; and
a hardware processor configured to:
establish a communication link with a device via the communication port;
receive from the device via the communication link a first list of relay attack detection methods that the device is configured to execute;
compare the first list of relay attack detection methods received from the device and a stored list of relay attack detection methods that the apparatus is configured to execute;
generate a second list of relay attack detection methods that the apparatus and the device are both configured to execute based on the comparison of the first list of relay attack detection methods received from the device and the stored list of relay attack detection methods, wherein the hardware processor is configured to determine which of the stored list of relay attack detection methods is also supported by the device based on the first list of relay attack detection methods received from the device such that the second list of relay attack detection methods includes a complete list of all relay attack detection methods implemented by the apparatus and supported by the device;
execute one or more relay attack detection methods of the second list; and
determine whether there is a relay attack on the communication link according to a result generated by the one or more relay attack detection methods executed by the hardware processor.

12. The apparatus of claim 11 , wherein each of the relay attack detection methods of the second list is associated with a weighted-value.

13. The apparatus of claim 11 , wherein the hardware processor is further configured to filter from the second list a first relay attack detection method from the relay attack detection methods of the second list based upon a respective weighted-value of the first relay attack detection method.

14. The apparatus of claim 13 , wherein the hardware processor is further configured to:
obtain at least a first result from a first relay attack detection method of the second list executed by the hardware processor and a second result from a second relay attack detection method of the second list executed by the hardware processor; and
discard at least the first result or the second result based upon the weighted-value associated with each of the first and second relay attack detection methods.

15. The apparatus of claim 13 , wherein the hardware processor is further configured to:
obtain a result from each of the one or more relay attack detection methods executed by the hardware processor;
determine a total weight value based on each result indicating no relay attack detected for each respective relay attack detection method; and
determine whether the total weight value satisfies a threshold.

16. The apparatus of claim 11 , wherein the hardware processor executes at least two relay attack detection methods from the second list, and wherein the hardware processor executes the at least two relay attack detection methods in parallel.

17. The apparatus of claim 11 , wherein the hardware processor executes at least two relay attack detection methods from the second list, and wherein the hardware processor sequentially executes the at least two relay attack detection methods.

18. The apparatus of claim 11 , wher

Assignees

• Ologn Technologies Ag

Inventors

• Ivanchykhin Dmytro
• Ignatchenko Sergey

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04B5/20

  characterised by the transmission technique; characterised by the transmission medium · CPC title

• G06Q20/4015

  using location information · CPC title

• H04W12/122

  Counter-measures against attacks; Protection against rogue devices · CPC title

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title