Distance Bounding Protocols Research Articles

The distance-bounding protocol based on Russian cryptographic algorithms

The distance-bounding protocol based on Russian cryptographic algorithms

Privacy-Preserving Location Authentication for Low-altitude UAVs: A Blockchain-based Approach

Efficient and trusted regulation of unmanned aerial vehicles (UAVs) is an essential but challenging issue in the future era of Internet of Low-altitude Intelligence, due to the difficulties in UAVs' identity recognition and location matching, potential for falsified information reporting, etc. To address this challenging issue, in this paper, we propose a blockchain-based UAV location authentication scheme, which employs a distance bounding protocol to establish a location proof, ensuring the authenticity of UAV positions. To preserve the privacy of UAVs, anonymous certificates and zero-knowledge proof are used. The security of the proposed scheme is analyzed. Experiments demonstrate the efficiency and feasibility of the proposed scheme.

Cross-Layer RF Distance Bounding Scheme for Passive and Semi-passive Ubiquitous Computing Systems

Distance Bounding protocols have surfaced as an appealing security measure in ubiquitous computing systems with access control provisions whereby the physical proximity of a user becomes significantly important for its explicit privileges and assurances. These systems employ cryptographic protocols to ensure security. However, security vulnerabilities have been demonstrated that exploit not only the cryptographic protocol but the physical implementation of the protocol itself. Distance Bounding resolves this problem by tightly integrating cryptographic security with the physical layer through a cross-layer security design. The core idea is to employ physical proximity as a security fingerprint to ensure that the legitimate entity (namely ‘prover’) lies within an agreed spatial range of another entity (‘verifier’). While a large number of Distance Bounding protocols have been proposed in the past, they mainly focus on designing a secure authentication scheme integrated with a suitable distance measurement approach, disregarding multiple concerns in the practical realization of these protocols – which we termed as a cross-layer problem. Only a few practical Distance Bounding realizations have been demonstrated which however focus on some selected cross-layer design parameters. As a result, either these protocols are impractical as a realizable system, or in most cases, an attacker can easily exploit cross-layer vulnerabilities especially if the prover is a resource-constrained entity such as a fully passive or battery-assisted access control token. This requires formulation of a careful prover design while ensuring that secure authentication and precise ranging are tightly integrated in a cross-layer manner for a realizable system. To resolve these issues, we first present a holistic approach to designing a secure Distance Bounding system by identifying essential cross-layer parameters. While analyzing the salient Distance Bounding realizations, we observe them to be designed for a single-bit communication channel. We optimize the communication bit rate by incorporating a high-order modulation technique in our proposed scheme to achieve higher date rates while ensuring the overall integrity of cross-layer design parameters. Besides, we specifically analyze the effects of the prover's impedance mismatch on link efficacy and security. This is a significant factor which depicts the allowable tolerances in the prover's impedance from design to manufacturing phases. Lastly, we present a comparison between prior approaches and our proposed scheme while introducing Qualitative Measure Matrix (QMM-I) and Quantitative Measure Matrix (QMM-II), which are devised from cross-layer design parameters for a secure Distance Bounding realization.

On the optimal resistance against mafia and distance fraud in distance-bounding protocols

Distance-bounding protocols are security protocols with a time measurement phase used to detect relay attacks, whose security is typically measured against mafia-fraud and distance-fraud attacks. A prominent subclass of distance-bounding protocols, known as lookup-based protocols, use simple lookup operations to diminish the impact of the computation time in the distance calculation. Independent results have found theoretical lower bounds 12nn2+1 and 12n, where n is the number of time measurement rounds, on the security of lookup-based protocols against mafia and distance-fraud attacks, respectively. However, it is still an open question whether there exists a protocol achieving both security bounds. This article closes this question in two ways. First, we prove that the two lower bounds are mutually exclusive, meaning that there does not exist a lookup-based protocol that provides optimal protection against both types of attacks. Second, we provide a lookup-based protocol that approximates those bounds by a small constant factor. Our experiments show that, restricted to a memory size that linearly grows with n, our protocol offers strictly better security than previous lookup-based protocols against both types of fraud.

PASPORT: A Secure and Private Location Proof Generation and Verification Framework

Abstract: Recently, there has been a rapid growth in locationbased systems and applications in which users submit their location information to service providers in order to gain access to a service, resource, or reward. We have seen that in these applications, dishonest users have an incentive to cheat on their location. Unfortunately, no effective protection mechanism has been adopted by service providers against these fake location submissions. This is a critical issue that causes severe consequences for these applications. Motivated by this, we propose the Privacy-Aware and Secure Proof Of pRoximiTy (PASPORT) scheme in this article to address the problem. Using PASPORT, users submit a location proof (LP) to service providers to prove that their submitted location is true. PASPORT has a decentralized architecture designed for ad hoc scenarios in which mobile users can act as witnesses and generate LPs for each other. It provides user privacy protection as well as security properties, such as unforgeability and non transferability of LPs. Furthermore, the PASPORT scheme is resilient to prover–prover collusions and significantly reduces the success probability of Prover–Witness collusion attacks. To further make the proximity checking process private, we propose P-TREAD, a privacy-aware distance bounding protocol and integrate it into PASPORT. To validate our model, we implement a prototype of the proposed scheme on the Android platform. Extensive experiments indicate that the proposed method can efficiently protect location-based applications against fake submissions

Deep-Learning-Aided RF Fingerprinting for NFC Relay Attack Detection

Near field communication (NFC) has been a widely used radiofrequency identification (RFID) technology, credited to its convenience and security features. However, the transmitted signals can be easily eavesdropped or relayed in an open wireless channel. One of the challenges is relay attack, where an attacker simply relays the signal and bypasses encryption or other means in the application layer. Prior works on relay attack countermeasures have focused on distance-bounding protocols or ambient-based solutions. This paper focuses on ISO/IEC 14443-A and proposes an NFC relay detection method based on RF fingerprinting of transmitted wireless signals in the physical layer. To this end, we first designed and implemented two realizations of NFC relay attacks, wired and wireless relays, and built an SDR-based testbed. We collected the normal and relayed signals of four NFC tags, and the answer to request type A (ATQA) segments were selected for RF fingerprinting. The created dataset comprised 66,366 samples, with four tags’ normal and wired relayed signals and the wireless relayed signals. The dataset was then fed into a deep CNN for training. Finally, our experiment results showed that the method effectively distinguished normal and relayed signals with a high accuracy of 99%, confirming that RF fingerprinting can be a promising countermeasure to NFC relay attacks.

Revisiting Error-Correction in Precommitment Distance-Bounding Protocols

Distance-bounding (DB) protocols are used to verify the physical proximity of two devices. DB can be used to establish trusted ad-hoc connections in the industrial Internet-of-Things, e.g., nodes can verify they are deployed in the same location and monitoring the same piece of equipment. Thresholds and error correction codes (ECCs) are two methods to provide error-resilience for DB protocols working in noisy environments. However, the threshold method adds overheads and the ECC method increases the adversary success probability, compared to threshold, when implemented in precommitment DB protocols. In this article, we investigate the ECC method and demonstrate that designers can mitigate increased adversary success probability by using nonsystematic codes. To demonstrate this idea, we compare a prominent precommitment protocol by Brands and Chaum (BC) integrated with different types of ECCs with two existing error-resilience methods, showing how nonsystematic codes provide improved protocol security. Moreover, We further evaluate the BC protocol with nonsystematic ECCs and discuss how to configure protocols to minimize the protocol failure rate, while maintaining adequate attack success probability.

So Near and Yet So Far – Symbolic Verification of Distance-Bounding Protocols

The continuous adoption of Near Field Communication (NFC) tags offers many new applications whose security is essential (e.g., contactless payments). In order to prevent flaws and attacks, we develop in this article a framework allowing us to analyse the underlying security protocols, taking into account the location of the agents and the transmission delay when exchanging messages. We propose two reduction results to render automatic verification possible relying on the existing verification tool ProVerif . Our first result allows one to consider a unique topology to catch all possible attacks. The second result simplifies the security analysis when considering Terrorist fraud. Then, based on these results, we perform a comprehensive case study analysis (27 protocols), in which we obtain new proofs of security for some protocols and detect attacks on some others.

A Secure Distance-Bounding Protocol with Mutual Authentication

Distance-bounding protocol is a useful primitive in resisting distance-based attacks. Currently, most of the existing distance-bounding protocols usually do not take the reuse of nonces in designing the protocols into consideration. However, there have been some literature studies showing that nonce repetition may lead to the leakage of the shared key between protocol participants. Aikaterini et al. introduced a countermeasure that could serve as a supplementary in most distance-bounding systems allowing nonce repetition. However, their proposal only holds against passive attackers. In this paper, we introduce an active attack model and show that their countermeasure is insecure under the proposed active attack model. We also discover that all existing distance-bounding protocols with mutual authentication are vulnerable to distance-based attacks if a short nonce is applied under the proposed active model. To address this security concern, we propose a new distance-bounding protocol with mutual authentication to prevent distance-based attacks under the active adversary model. A detailed security analysis is presented for the proposed distance-bounding protocol with mutual authentication.

A new secure authentication based distance bounding protocol.

Numerous systems are being employed in daily life where two entities authenticate each other over a range of distance. The distance involved is relatively small, but still attacks were documented. The distance bounding (DB) protocol was introduced to cater to security requirements. The schemes, however, are still prone to several threats; mainly the Relay Attack (Terrorist and Mafia Fraud). In Mafia Fraud, an attempts are made to get accepted as the prover either by replaying of messages or by the help a malicious key. In Terrorist fraud, an attempt is made to extract the secret from the verifying entity, either by extracting the key from the message captured or by physically tempering the verifying/proving entity. Therefore the mitigation of these attacks needs to be done; as to not put computational overhead on the scheme. The paper presents a comprehensive and comparative performance analysis of twelve DB protocols based on defined metrics. It also proposes a protocol which incorporates the design elements needed for added security, is computationally easy to implement and resistant to most of the threats mentioned. Analysis of the protocol is carried out against the security requirements.

A Spectrum-Efficient Cross-Layer RF Distance Bounding Scheme

Distance bounding protocols guarantee a credible distance upper bound between the devices which require the spatial distance as a security parameter to defend Mafia Fraud attacks. However, in RF systems, the realization of distance bounding protocol faces obstacles due to low spectrum efficiency, since the distance bound estimation consumes a significant amount of frequency band in existing schemes. This hinders RF distance bounding from being practically deployed, especially in commonly used ISM bands. In this work, we propose an alternative, spectrum-efficient scheme for RF distance bounding. We build the physical layer as well as a protocol design based on SFCW signal and SFCW ranging. Thus, comparing existing schemes that consume many frequency bands, our scheme frees many spectrum resources. We propose solutions to the unique challenges facing such an SFCW-based scheme design, namely, data communication over unintelligent SFCW signals, and secure synchronization in the SFCW-based challenge-response exchange. We evaluate our scheme via the security analysis and physical layer simulations. The results show (i) its resistance to attacks commonly concerned in distance bounding, (ii) the feasibility of the physical layer design such as accurate ranging and data communication function, and (iii) the communication noise tolerance and the ability of multipath signal discrimination.

Secure, Accurate, and Practical Narrow-Band Ranging System

Relay attacks pose a serious security threat to wireless systems, such as, contactless payment systems, keyless entry systems, or smart access control systems. Distance bounding protocols, which allow an entity to not only authenticate another entity but also determine whether it is physically close by, effectively mitigate relay attacks. However, secure implementation of distance bounding protocols, especially of the time critical challenge-response phase, has been a challenging task. In this paper, we design and implement a secure and accurate distance bounding protocol based on Narrow-Band signals, such as Bluetooth Low Energy (BLE), to particularly mitigate relay attacks. Narrow-Band ranging, specifically, phase-based ranging, enables accurate distance measurement, but it is vulnerable to phase rollover attacks. In our solution, we mitigate phase rollover attacks by also measuring time-of-flight (ToF) to detect the delay introduced by such attacks. Therefore, our protocol effectively combines the best of both worlds: phase-based ranging for accuracy and time-of-flight (ToF) measurement for security. To demonstrate the feasibility and practicality of our solution, we prototype it on NXP KW36 BLE chips and evaluate its performance and relay attack resistance. The obtained precision and accuracy of the presented ranging solution are 2.5 cm and 30 cm, respectively, in wireless measurements.

An Ultra-Lightweight Mutual Authentication Protocol Based on LPN Problem with Distance Fraud Resistant

RFID tags are one of the main enablers of the internet of things. All objects have to be equipped with an electronic product code such as RFID tags. Because of minimizing the price, RFID environments are resource-scarce, then designing ultra-lightweight authentication protocols is of great importance. Many ultra-lightweight authentication protocols such as HB family protocols are proposed. One of the most important threats against HB family protocols is a type of man-in-the-middle attack called GRS. Also, in the real world, IoT requires mutual authentication that traditional HB protocols do not support it. Besides, misconceptions about reader-tag distance could create problems in several applications especially in contactless systems such as access control and electronic payment systems, which could be damaged by distance-based frauds. In the present work, we have proposed a novel distance bounding protocol based on HB family protocols with four major characteristics: (1) it can resist terrorist, mafia, and distance fraud attacks; (2) it is a lightweight mutual authentication protocol capable of being used in low-cost IoT equipment such as NFC and RFID; (3) it employs a hard problem that be post-quantum resistant, and (4) it identifies and solves the weaknesses of HB protocols including GRS attacks. The proposed protocol has also been shown to be able to address the known weaknesses and attacks in distance frauds and HB family protocols.

A general and efficient distance bounding protocol with multi-objective optimisation for RFID applications over a noisy channel

A general and efficient distance bounding protocol with multi-objective optimisation for RFID applications over a noisy channel

A general and efficient distance bounding protocol with multi-objective optimisation for RFID applications over a noisy channel

A general and efficient distance bounding protocol with multi-objective optimisation for RFID applications over a noisy channel

Dynamic Membership Management in Anonymous and Deniable Distance Bounding

For secure location proof in many applications, distance bounding protocols are considered as one of the useful tools that can be used in practice. In distance bounding protocols, a prover and a verifier can measure the distance between them by performing an interactive protocol. In general, the verifier is regarded as an honest service provider, and thus, an adversarial verifier is not considered for security analysis. However, we cannot ignore the possibility of the corruption of the verifier, which can spoil the prover’s privacy. To handle the security problem, a prover-anonymous and deniable distance bounding protocol is proposed, which can guarantee the privacy of the prover even though the verifier is corrupted. In this paper, we review the prover-anonymous and deniable distance bounding protocol in terms of the membership management, and we show that the communication overhead in the protocol for each membership change is O(n) where n is the number of users. Then, we propose an improved membership management technique, which can efficiently support membership change in terms of the communication overhead. The improved technique requires O(1) for each membership change instead of O(n), as in the existing protocol.

On Detecting Relay Attacks on RFID Systems Using Qubits

As RFID technology is being widely used in access control systems to identify and track both objects and people, relay attacks on RFID systems continue to pose serious threats to security. To mitigate relay attacks, distance bounding protocols can be used. Until recently, all distance bounding protocols were based on classical cryptography and communication techniques. In this paper, we take a closer look at a recently proposed protocol by Jannati and Ardeshir-Larijani [Quantum Information Processing 2016, 18] to detect relay attacks using qubits. We first observe that the protocol has a weakness which allows an adversary to mount a successful attack on the protocol. We then propose a countermeasure to restore security and compare the fixed protocol with the state of the art.

Energy-Efficient Distance-Bounding with Residual Charge Computation

Real-time location systems are often required in industrial applications. In addition to securely determining an item's location, these systems also need to accommodate energy-limited tracking tokens. Distance-bounding protocols enable a Verifier to cryptographically determine an upper-bound on the physical distance to a Prover by measuring the round-trip time of specially designed challenge-response messages. This type of protocols serve as countermeasure to three common attacks on location-based systems and have been extensively studied with the goal of achieving optimal security bounds for the respective attacks. In this paper, we propose a new energy-efficient distance-bounding protocol that protects against all three common attacks in a distance-bounding scenario with improved security bounds. We provide a new approach to combining the response registers and Prover's key to determine responses. Furthermore, the protocol design allows offline pre-computation of the function f used to determine the Prover's response registers. This results in faster protocol execution, the reader does not wait for the tag to compute any cryptographic function during the protocol execution, and also allows passive tokens to effectively use residual energy after the preceding transaction to compute response registers for the next protocol run.

Access Control for Implantable Medical Devices

The telemetry incorporate in the new generation of Implantable Medical Devices (IMDs) allows remote access and re-programming without interfering with the daily routine of their holders. Despite the benefits of this new feature, such remote access raises new threats related to the access of unauthorized entities to IMDs. Cardiac implants represent the most deployed types of IMD nowadays. Current solutions, to control their remote access, usually use a single feature for authentication. However, this feature is easily replicable, making these authentication schemes vulnerable to attacks. To overcome this limitation, we propose in this article a distance bounding protocol to manage access control of IMDs: ACIMD. ACIMD combines two security mechanisms, namely, identity verification (authentication) and proximity verification (distance checking). The authentication mechanism, formally and informally verified, conforms to the ISO/IEC 9798-2 standard. The distance checking is performed using the whole Electrocardiogram (ECG) signal and relies on the correlation coefficient (comparing an external versus an internal ECG signal) in the Hadamard domain. We evaluate the accuracy and security of ACIMD access control using ECG signals of 199 individuals recorded over 24 hours while considering three adversary strategies. Our results show that ACIMD is 92.92 percent accurate.

PASPORT: A Secure and Private Location Proof Generation and Verification Framework

Recently, there has been a rapid growth in location-based systems and applications in which users submit their location information to service providers in order to gain access to a service, resource, or reward. We have seen that in these applications, dishonest users have an incentive to cheat on their location. Unfortunately, no effective protection mechanism has been adopted by service providers against these fake location submissions. This is a critical issue that causes severe consequences for these applications. Motivated by this, we propose the Privacy-Aware and Secure Proof Of pRoximiTy (PASPORT) scheme in this article to address the problem. Using PASPORT, users submit a location proof (LP) to service providers to prove that their submitted location is true. PASPORT has a decentralized architecture designed for ad hoc scenarios in which mobile users can act as witnesses and generate LPs for each other. It provides user privacy protection as well as security properties, such as unforgeability and nontransferability of LPs. Furthermore, the PASPORT scheme is resilient to prover–prover collusions and significantly reduces the success probability of Prover–Witness collusion attacks. To further make the proximity checking process private, we propose P-TREAD, a privacy-aware distance bounding protocol and integrate it into PASPORT. To validate our model, we implement a prototype of the proposed scheme on the Android platform. Extensive experiments indicate that the proposed method can efficiently protect location-based applications against fake submissions.