Search

In this study, we developed a novel method for preventing relay attacks over near field communication (NFC) using a simple interface. NFC provides standardized short-range contactless communication using one of the radio frequency identification communication channels. NFC-enabled mobile devices can exchange information in close proximity (within 4 cm). In particular, modern mobile phones have adopted NFC technology because of its promising functionalities, for example, mobile payments, Bluetooth pairing, and electronic keys. The distance limitation of NFC communication offers security advantages against passive or active attackers, but it is still vulnerable to relay attacks. During a relay attack, adversaries relay messages between two legitimate participants without any attempt at message modification. There is no requirement for knowledge of a cryptographic key or to share secrets with victims, therefore encrypting messages is not a solution that prevents relay attacks. We propose a new method for relay attack prevention, which uses a simple interface with only one button. In our scheme, the elapsed time of button pressing is used for verification. Our experimental results obtained using the proposed scheme demonstrated the accuracy of our method for verifying human users and the difficulties experienced by human attackers. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Current mobile technology gives us ubiquitous services with personal mobile devices such as smart phones, tablet PCs, and laptops. With these mobile devices, the human users may wish to exchange sensitive data with others (e.g., their friends or their colleagues) over a secure channel. Public key cryptography is a good solution for establishing this secure channel. However, it is vulnerable to man-in-the-middle attack, if the entities have no shared information. A number of techniques based on human-assisted out-of-band channels have been proposed to solve this problem. Unfortunately, these works have a common shortcoming: The human users must be colocated in close proximity. In this paper, we focus on how to construct a distance- free channel, which is not location- limited for establishing a secure channel between two users (devices). The proposed distance-free channel provides identification and authentication of the devices at the different locations using taken pictures or pre-stored images. The human user participates in the authentication process by sending and verifying an image. We describe the prototype implementation operated on a smart phone and show the experimental results when actually two smart phones share a common key using Diffie-Hellman key agreement over the proposed distance-free channel. [ABSTRACT FROM AUTHOR]