Distance Fraud Attacks Research Articles

On the optimal resistance against mafia and distance fraud in distance-bounding protocols

Distance-bounding protocols are security protocols with a time measurement phase used to detect relay attacks, whose security is typically measured against mafia-fraud and distance-fraud attacks. A prominent subclass of distance-bounding protocols, known as lookup-based protocols, use simple lookup operations to diminish the impact of the computation time in the distance calculation. Independent results have found theoretical lower bounds 12nn2+1 and 12n, where n is the number of time measurement rounds, on the security of lookup-based protocols against mafia and distance-fraud attacks, respectively. However, it is still an open question whether there exists a protocol achieving both security bounds. This article closes this question in two ways. First, we prove that the two lower bounds are mutually exclusive, meaning that there does not exist a lookup-based protocol that provides optimal protection against both types of attacks. Second, we provide a lookup-based protocol that approximates those bounds by a small constant factor. Our experiments show that, restricted to a memory size that linearly grows with n, our protocol offers strictly better security than previous lookup-based protocols against both types of fraud.

An Ultra-Lightweight Mutual Authentication Protocol Based on LPN Problem with Distance Fraud Resistant

RFID tags are one of the main enablers of the internet of things. All objects have to be equipped with an electronic product code such as RFID tags. Because of minimizing the price, RFID environments are resource-scarce, then designing ultra-lightweight authentication protocols is of great importance. Many ultra-lightweight authentication protocols such as HB family protocols are proposed. One of the most important threats against HB family protocols is a type of man-in-the-middle attack called GRS. Also, in the real world, IoT requires mutual authentication that traditional HB protocols do not support it. Besides, misconceptions about reader-tag distance could create problems in several applications especially in contactless systems such as access control and electronic payment systems, which could be damaged by distance-based frauds. In the present work, we have proposed a novel distance bounding protocol based on HB family protocols with four major characteristics: (1) it can resist terrorist, mafia, and distance fraud attacks; (2) it is a lightweight mutual authentication protocol capable of being used in low-cost IoT equipment such as NFC and RFID; (3) it employs a hard problem that be post-quantum resistant, and (4) it identifies and solves the weaknesses of HB protocols including GRS attacks. The proposed protocol has also been shown to be able to address the known weaknesses and attacks in distance frauds and HB family protocols.

Performing and mitigating force and terrorist fraud attacks against two RFID distance-bounding protocols

Radio frequency identification (RFID) systems have been used in widespread applications to identify any object. The growth of wireless systems has caused security and privacy vulnerabilities in RFID systems with limited resources and low cost provers. Authentication allows that the information is transfered between only authorized people; thus, we allow different levels of access to information for different people. Distance-bounding authentication protocols are one of the most efficient methods for authentication in RFID systems. Distance-bounding protocols have been proposed to address attacks related to location such as distance fraud attack, Mafia fraud attack, and terrorist fraud attack. In this paper, we examine the two new proposed distance-bounding protocols MP, and KA and prove that these protocols are vulnerable against terrorist fraud attack and force attack. Finally, we improve these two schemes. Then we show that our two improved protocols are resistant against the attacks.

RFID unilateral distance bounding protocols: A trade-off between mafia and distance fraud

Distance Bounding (DB) protocol is a lightweight protocol which is used in RFID, NFC and WSN. These protocols enable an entity to determine an upper bound on the physical distance to another entity as well as to authenticate the other entity. This leads to rejection of the requests located out of this distance limitation. So far, many unilateral DB protocols have been proposed to resist mafia and distance fraud attacks. In this paper, we present two unilateral DB protocols. The first one uses predefined delay and two random binary challenges (EBT1) [1] whereas the second protocol uses predefined delay and two different challenges: predefined challenges and random challenges (EBT2). The resistance of these protocols against mafia and distance fraud attacks is better than other unilateral DB protocols. By changing the two random binary challenges into predefined challenge and random challenge, we obtain better resistance to mafia fraud and lower resistance to distance fraud. In addition, the proposed protocols can be applied to passive RFID tags and do not require an extra final signature after the fast bit phase.

Analysis of relay, terrorist fraud and distance fraud attacks on RFID systems

Radio Frequency Identification (RFID) technology is used in myriad applications because of its speed of execution, ease of manufacturing and usability. In the domain of critical infrastructure protection, RFID systems are often used to identify people, objects and vehicles that enter restricted areas, and to track packages and cargo containers. Relay attacks are known to pose serious threats to the authentication protocols used in RFID systems. In 2014, Urien and Piramuthu proposed an authentication protocol that simultaneously uses a temperature sensor and a distance bounding scheme to protect RFID systems from relay attacks. They claim that the authentication protocol provides the maximum level of security against relay attacks as well as against the related terrorist fraud and distance fraud attacks. This paper shows that the Urien–Piramuthu authentication protocol is vulnerable to all three attacks with attacker success probabilities of 100%, implying that the protocol cannot protect RFID systems from the attacks.

Distance‐bounding trust protocol in anonymous radio‐frequency identification systems

SummaryBoth distance fraud attacks and relay attacks threaten radio‐frequency identification (RFID) applications but are hard to prevent. Existing approaches can neither avoid tags to response the rouge reader's challenges nor have the simultaneous feature to defend the two kinds of attacks. In a first step, this paper presents an improved distance‐bounding protocol that a tag deduces the distance to a reader and reports if the reader is honest or malicious through the output of trust values that can defend distance fraud. When multiple readers are synchronized and scheduled, we just logically threat them as one. So our solutions fix a flaw in prior work that may be leveraged by attackers to increase the successful rate of discovering relay attack. Secondly, we deploy trusted third party architecture to provide anonymity for tags in anonymous RFID systems without requiring tag identifiers. Existing distance‐based attack detection methods are not applicable in anonymous RFID systems because of the requirement of awareness of tag identifiers. This insight inspires Distance‐Bounding Trust Protocol (DBTP), which is for both distance fraud and relay attacks detection in anonymous RFID systems. DBTP can make correct decisions through trust values in accepting or rejecting a reader's challenge by establishing collaborations and trust relationship between one reader (verifier) and active tags (provers). We evaluate the performance of DBTP through theoretical analysis and extensive simulations. The results show that DBTP can detect both distance fraud and relay attacks, and it is effective to guarantee security for anonymous RFID systems. Copyright © 2015 John Wiley & Sons, Ltd.

All-or-nothing approach to protect a distance bounding protocol against terrorist fraud attack for low-cost devices

Distance bounding protocols are proposed based upon the round trip time measurements of the executed messages to prevent sensor networks against wormhole attack and to safeguard RFID systems against relay attack. In such protocols, the verifier authenticates users as well as establishing an upper bound on its physical distance between the users and itself. These protocols are also vulnerable to mafia fraud, distance fraud and terrorist fraud attacks. This paper deploys all-or-nothing method to propose a new distance bounding protocol with higher security level that can prevent terrorist fraud attack performed over the existing distance bounding protocols. Actually, the proposed protocol is the first protocol which can overcome all the three fraud attacks simultaneously with the lowest success probability of the attacks compared with the well known distance bounding protocols. Besides, the proposed protocol can be implemented on a low-cost device due to low computational cost and minimum system memory requirements.

Achieving an appropriate security level for distance bounding protocols over a noisy channel

A relay attack is probably the most popular assault that is normally executed over RFID security protocols. To protect RFID systems against this attack, distance bounding protocols are commonly employed. Within such protocols, the reader estimates an upper bound for the physical distance between the tag and itself as well as authenticating the tag. In this paper, as a general case, the concept of a distance bounding protocol is introduced with five adjustable security parameters characterized by $$p_d$$pd, $$k$$k, $$n$$n, $$t_1$$t1 and $$t_2$$t2. Since RFID systems and distance bounding protocols are principally vulnerable to noise, the security analysis for the introduced distance bounding protocol is performed over a noisy channel. With such analysis, the attacker's success probability due to mafia fraud and distance fraud attacks are obtained in a closed form through the five security parameters and the probability of erroneous transmission. The analytic results show that, with the proper selection of the mentioned security parameters in a known noisy environment, a distance bounding protocol provides the optimal attackers' success probabilities with the desirable number of iterations and memory requirements.

Lightweight Distance Bounding Protocol against Relay Attacks

Traditional authentication protocols are based on cryptographic techniques to achieve identity verification. Distance bounding protocols are an enhanced type of authentication protocol built upon both signal traversal time measurement and cryptographic techniques to accomplish distance verification as well as identity verification. A distance bounding protocol is usually designed to defend against the relay attack and the distance fraud attack. As there are applications to which the distance fraud attack is not a serious threat, we propose a streamlined distance bounding protocol that focuses on the relay attack. The proposed protocol is more efficient than previous protocols and has a low false acceptance rate under the relay attack.

Security Analysis of YKHL Distance Bounding Protocol with Adjustable False Acceptance Rate

A distance bounding protocol enables one entity to determine an upper bound on the physical distance to the other entity as well as to authenticate the other entity. It measures the round-trip time of exchanged messages that normally consist of n rounds of a single-bit challenge and a single-bit response. Let FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</sub> and FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">D</sub> be the false acceptance rate against mafia fraud attack and distance fraud attack, respectively. Brands and Chaum designed the first distance bounding protocol that has (FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</sub> , FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">D</sub> ) = ((½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> , (½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> ). Recently Yum et al. proposed a flexible distance bounding protocol, in IEEE Communications Letters, asserting that its false acceptance rate (FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</sub> , FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">D</sub> ) can be chosen from ((½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> , (½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> ) to ((¼) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> , ( <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">3</sup> / <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">4</sub> ) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> ). However, we introduce a new attack that achieves a higher false accep tance rate, where (FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</sub> , FAR <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">D</sub> ) varies from ((½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> , (½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> ) to ((½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> , (½) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> / <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> ).

Distance Bounding Protocol with Adjustable False Acceptance Rate

At Eurocrypt 1993, Brands and Chaum introduced distance bounding protocols to defend against mafia fraud attack and distance fraud attack. A distance bounding protocol usually consists of n rounds of a single-bit challenge and a single-bit response, which determines the distance between communicating entities by measuring the round-trip time of signals. Let FARM and FARD be the false acceptance rate against the mafia fraud attack and the distance fraud attack, respectively. The state-of-the-art distance bounding protocols in terms of the false acceptance rate have either (FARM,FARD) = ((1/2)n, (1/2)n) or (FARM,FARD) = (4(3/8)n, (7/8)n). We introduce a flexible distance bounding protocol whose false acceptance rate (FARM,FARD) can be chosen from ((1/2)n, (1/2)n) to ((1/4)n, (3/4)n).

Distance bounding protocols for RFID enhanced by using void-challenges and analysis in noisy channels

RFID systems are vulnerable to different attacks related to the location; distance fraud attack, relay attack and terrorist attack. The main countermeasure against these attacks is the use of proto...

Distance bounding protocols for RFID enhanced by using void‐challenges and analysis in noisy channels

AbstractRFID systems are vulnerable to different attacks related to the location; distance fraud attack, relay attack and terrorist attack. The main countermeasure against these attacks is the use of protocols capable of measuring the round trip time of single challenge‐response bit. In this paper, we consider a modification of these protocols applying a new feature; the ‘void challenges’. This way, the success probability for an adversary to access to the system decreases. We use as reference‐point the most popular of this kind of protocols, the Hancke and Kuhn's protocol, to show the improvements achieved when different cases are analysed. Copyright © 2008 John Wiley &amp; Sons, Ltd.