Contactless Access Control Based on Distance Bounding

Abstract

Contactless access control systems are critical for security but often vulnerable to relay attacks. In this paper, we define an integrated security and privacy model for access control using distance bounding (DB) which is the most robust solution to prevent relay attacks. We show how a secure DB protocol can be converted to a secure contactless access control protocol. Regarding privacy (i.e., keeping anonymity in strong sense to an active adversary), we show that the conversion does not always preserve privacy but it is possible to study it on a case by case basis. Finally, we provide two example protocols and prove their security and privacy according to our new models.

NFCGate: Opening the Door for NFC Security Research with a Smartphone-Based Toolkit

“…While this simplifies the usage for many applications, it only measures the distance to some recipient, not necessarily the intended one. In contrast, an implementation on the application layer can ensure the correct recipient, but requires every application to implement their own, incompatible DB protocol [15,26,39].…”

Secure Contactless Payment

“…In contactless payment, we consider the similar adversarial and communication model with the access control (AC) security model by Kılınç and Vaudenay [21]. The parties in AC: a controller, a reader, a tag correspond to the parties contactless payment: an issuer, a terminal, a card, respectively.…”

“…Instances of honest parties cannot be run in parallel. -The adversaries can change the location of honest instances (but they move at a limited speed) or can activate them (See [21] for details). -Adversaries can create the database.…”