Systems and methods for defeating relay attacks

Patent metadata

Field	Value
Publication number	US-9800610-B1
Application number	US-201514850989-A
Country	US
Kind code	B1
Filing date	Sep 11, 2015
Priority date	Sep 11, 2015
Publication date	Oct 24, 2017
Grant date	Oct 24, 2017

Abstract

The disclosed computer-implemented method for defeating relay attacks may include (1) buffering, in a memory buffer, an encoded signal that has been sent to a remote device, (2) detecting, within a time interval of the encoded signal being sent, a second signal that corresponds to the encoded signal, (3) determining that a strength of the second signal is above a predetermined threshold, (4) determining, based on the strength of the second signal being above the predetermined threshold, that the second signal represents a relay attack, and (5) initiating a security action to defeat the relay attack. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for defeating relay attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
buffering, in a memory buffer, an encoded signal that has been sent from a computing device to a remote device;
detecting, within a time interval of the encoded signal being sent, a second signal that corresponds to the encoded signal;
determining that a strength of the second signal is above a predetermined signal strength threshold, which is calculated based on a strength of an echo of a test signal sent from the computing device;
determining, based on the strength of the second signal being above the predetermined signal strength threshold, that the second signal represents a relay attack;
initiating a security action to defeat the relay attack.

2. The computer-implemented method of claim 1 , wherein detecting the second signal that corresponds to the encoded signal comprises:
comparing content of the second signal to content of the encoded signal in the memory buffer;
determining that the content of the second signal is identical to the content of the encoded signal.

3. The computer-implemented method of claim 1 , wherein the second signal is received at a frequency of the encoded signal such that the second signal may interfere with reception of the encoded signal by the remote device.

4. The computer-implemented method of claim 3 , further comprising:
transmitting a second encoded signal to the remote device;
detecting, within a time interval of sending the second encoded signal, a third signal, wherein the third signal is received at a frequency of the second encoded signal such that the third signal may interfere with reception of the second encoded signal by the remote device;
detecting a fourth signal, wherein a content of the fourth signal is identical to the content of the encoded signal.

5. The computer-implemented method of claim 4 , wherein:
the encoded signal includes a value in a code sequence;
the second encoded signal includes a subsequent value in the code sequence.

6. The computer-implemented method of claim 1 , further comprising calculating, based on the strength of the second signal, an estimated distance of a signal relay device from the computing device.

7. The computer-implemented method of claim 1 , wherein the security action comprises at least one of:
notifying an administrator of the relay attack;
broadcasting an audible alarm;
denying access to a function controlled by the computing device;
activating a secondary security system.

8. A system for defeating relay attacks, the system comprising:
a buffering module, stored in memory, that buffers, in a memory buffer, an encoded signal that has been sent from a computing device to a remote device;
a detection module, stored in memory, that detects, within a time interval of the encoded signal being sent, a second signal that corresponds to the encoded signal;
an analysis module, stored in memory, that:
determines that a strength of the second signal is above a predetermined signal strength threshold, which is calculated based on a strength of an echo of a test signal sent from the computing device;
determines, based on the strength of the second signal being above the predetermined signal strength threshold, that the second signal represents a relay attack;

a security module, stored in memory, that initiates a security action to defeat the relay attack;
at least one physical processor configured to execute the buffering module, the detection module, the analysis module, and the security module.

9. The system of claim 8 , wherein the detection module detects the second signal that corresponds to the encoded signal by:
comparing content of the second signal to content of the encoded signal in the memory buffer;
determining that the content of the second signal is identical to the content of the encoded signal.

10. The system of claim 8 , wherein the detection module receives the second signal at a frequency of the encoded signal such that the second signal may interfere with reception of the encoded signal by the remote device.

11. The system of claim 10 :
further comprising a transmission module, stored in memory, that transmits a second encoded signal to the remote device;
wherein the detection module:
detects, within a time interval of sending the second encoded signal, a third signal, wherein the third signal is received at a frequency of the second encoded signal such that the third signal may interfere with reception of the second encoded signal by the remote device;
detects a fourth signal, wherein a content of the fourth signal is identical to the content of the encoded signal.

12. The system of claim 11 , wherein:
the encoded signal includes a value in a code sequence;
the second encoded signal includes a subsequent value in the code sequence.

13. The system of claim 8 , wherein the security module calculates, based on the strength of the second signal, an estimated distance to a signal relay device.

14. The system of claim 8 , wherein the security action comprises at least one of:
notifying an administrator of the relay attack;
broadcasting an audible alarm;
denying access to a function controlled by the system;
activating a secondary security system.

15. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
buffer, in a memory buffer, an encoded signal that has been sent from a computing device to a remote device;
detect, within a time interval of the encoded signal being sent, a second signal that corresponds to the encoded signal;
determine that a strength of the second signal is above a predetermined signal strength threshold, which is calculated based on a strength of an echo of a test signal sent from the computing device;
determine, based on the strength of the second signal being above the predetermined signal strength threshold, that the second signal represents a relay attack;
initiate a security action to defeat the relay attack.

16. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-readable instructions cause the computing device to detect the second signal that corresponds to the encoded signal by:
comparing content of the second signal to content of the encoded signal in the memory buffer;
determining that the content of the second signal is identical to the content of the encoded signal.

17. The non-transitory computer-readable medium of claim 15 , wherein the second signal is received at a frequency of the encoded signal such that the second signal may interfere with reception of the encoded signal by the remote device.

18. The non-transitory computer-readable medium of claim 17 , wherein the one or more computer-readable instructions cause the computing device to:
transmit a second encoded signal to the remote device;
detect, within a time interval of sending the second encoded signal, a third signal, wherein the third signal is received at a frequency of the second encoded signal and may interfere with reception of the second encoded signal by the remote device;
detect a fourth signal, wherein a content of the fourth signal is identical to the content of the encoded signal.

19. The non-transitory computer-readable medium of claim 18 , wherein:
the encoded signal includes a

Assignees

• Symantec Corp

Inventors

• Lu Jin

Classifications

• G07C9/00309

  operated with bidirectional data transmission between data carrier and locks · CPC title

• G07C2009/00793

  by Hertzian waves · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G07C9/00571

  operated by interacting with a central unit · CPC title