Electronic authentication systems

Patent metadata

Field	Value
Publication number	US-9779402-B2
Application number	US-201615265151-A
Country	US
Kind code	B2
Filing date	Sep 14, 2016
Priority date	Jun 6, 2013
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

Methods and devices are provided for use in detecting relay attacks between devices in a communications network. One method includes sending first data by a first device to a second device, and receiving, by the first device, a communication from the second device where the communication comprises second data generated at the second device and a time parameter related to the generation of the second data. The method also includes measuring a total transmission time at the first device between sending the first data and receiving the communication, and determining a further time parameter related to the generation of the second data based at least in part on the measured total transmission time. The method then further includes determining the presence of a relay attack between the first and second devices in dependence on a comparison of the time parameter and the further time parameter.

First claim

What is claimed is:

1. A computer-implemented method of detecting relay attacks between first and second devices in a communications network, the method comprising:
sending first data, by the first device, to the second device;
receiving, by the first device, a communication from the second device, the communication comprising second data generated at the second device and a time parameter related to the generation of the second data;
measuring a total transmission time at the first device between sending the first data and receiving the communication;
determining a further time parameter related to the generation of the second data, based at least in part on the measured total transmission time; and
determining the presence of a relay attack between the first and second devices in dependence on a comparison of the time parameter and the further time parameter.

2. The method of claim 1 , wherein determining the presence of the relay attack includes comparing, by the first device, the time parameter and the further time parameter, and determining if a difference between the time parameter and the further time parameter exceeds a predetermined threshold.

3. The method of claim 1 , further comprising receiving, by the first device, a further communication from the second device over an encrypted channel, the further communication including the first and second data and the time parameter.

4. The method of claim 3 , wherein determining the presence of the relay attack includes checking, by the first device, if the first and second data in the encrypted further communication match the first data sent by the first device and the second data received by the first device in the communication.

5. The method of claim 4 , wherein determining the presence of the relay attack further includes comparing, by the first device, the time parameter and the further time parameter, and determining if a difference between the time parameter and the further time parameter exceeds a predetermined threshold.

6. The method of claim 1 , wherein the communication received from the second device further includes an estimate, by the second device, of the total transmission time.

7. The method of claim 6 , wherein determining the presence of the relay attack further includes comparing, by the first device, the measured total transmission time and the estimate of the total transmission time by the second device, and determining if a difference between the measured total transmission time and the estimate of the total transmission time is within a predetermined threshold.

8. The method of claim 1 , wherein the communication received from the second device further includes an estimate, by the second device, of the time to send the communication from the second device over the communications network to the first device; and
wherein determining the presence of the relay attack further includes determining, by the first device, whether the estimate of the time to send the communication total transmission time exceeds a predetermined threshold.

9. The method of claim 1 , wherein the first device includes a point of interaction; and/or
wherein the second device includes a transaction device.

10. A computer-implemented method of detecting relay attacks between first and second devices in a communications network, the method comprising:
receiving first data, by the second device, from the first device;
generating, by the second device, second data;
determining a time parameter related to the generation of the second data; and
sending, by the second device, the second data and the time parameter to the first device, to thereby enable the presence of a relay attack to be determined;
wherein determining the time parameter related to the generation of the second data includes measuring, by a timer of the second device, a time required by the second device to generate the second data.

11. The method of claim 10 , wherein the second data includes a random number.

12. The method of claim 10 , wherein the second device includes a transaction device.

13. The method of claim 10 , wherein sending the second data and the time parameter to the first device includes:
generating a communication comprising the second data and the time parameter, by the second device, according to a Diffie-Hellman protocol; and
sending the second data and the time parameter to the first device via the communication.

14. The method of claim 13 , wherein generating the communication includes applying a randomly generated blinding factor and a static public key to the communication.

15. A point of interaction arranged to detect relay attacks in a communications network between the point of interaction and a transaction device, the point of interaction comprising an input, an output, and a processor coupled to the input and the output; wherein the processor is configured to:
send first data from the output to the transaction device;
receive, at the input, a communication from the transaction device, the communication comprising second data generated at the transaction device and a time parameter related to the generation of the second data;
measure a total transmission time at the point of interaction between sending the first data and receiving the communication;
determine a further time parameter related to the generation of the second data from the measured total transmission time; and
determine the presence of a relay attack between the point of interaction and the transaction device in dependence on a comparison of the time parameter and the further time parameter.

16. The point of interaction of claim 15 , wherein the processor is further configured, in connection with determining the presence of the relay attack, to compare the time parameter and the further time parameter and determine if a difference between the time parameter and the further time parameter exceeds a predetermined threshold.

17. The point of interaction of claim 16 , wherein the processor is further configured to receive, at the input, a further communication from the transaction device over an encrypted channel, the further communication including the first and second data and the time parameter.

18. The point of interaction of claim 17 , wherein the processor is further configured, in connection with determining the presence of the relay attack, to determine whether the first and second data in the encrypted further communication match the first data sent by the point of interaction and the second data received by the transaction device in the communication.

19. A computer-implemented method of detecting relay attacks between first and second devices in a communications network, the method comprising:
receiving first data, by the second device, from the first device;
generating, by the second device, second data;
determining a time parameter related to the generation of the second data, the time parameter including an estimated time related to the generation of the second data; and
sending, by the second device, the second data and the time parameter to the first device, to thereby enable the presence of a relay attack to be determined.

20. The method of claim 19 , wherein sending the second data and the time parameter to the first device includes:
generating a communication comprising the second data and the time parameter, by the second device, according to a Diffie-Hellman protocol; and
sending the second data and the time parameter to the first device via the communication.

Assignees

• Mastercard International Inc

Inventors

• Garrett Duncan
• Roberts Dave
• Smets Patrik

Classifications

• H04L2209/08

  Randomization, e.g. dummy operations or using noise · CPC title

• G06Q20/409

  Device specific authentication in transaction processing · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• G06Q20/102

  Bill distribution or payments · CPC title

• G06Q20/3829

  involving key management · CPC title