The Applicability of Ambient Sensors as Proximity Evidence for NFC Transactions

Abstract

Abstract-Near Field Communication (NFC) has enabled mobile phones to emulate contactless smart cards. Similar to contactless smart cards, they are also susceptible to relay attacks. To counter these, a number of methods have been proposed that rely primarily on ambient sensors as a proximity detection mechanism (also known as an anti-relay mechanism). In this paper, we empirically evaluate a comprehensive set of ambient sensors for their effectiveness as a proximity detection mechanism for NFC contactless-based applications like banking, transport and high-security access controls. We selected 17 sensors available via the Google Android platform. Each sensor, where feasible, was used to record the measurements of 1,000 contactless transactions at four different physical locations. A total of 252 users, a random sample from the university student population, were involved during the field trials. After careful analysis, we conclude that no single evaluated mobile ambient sensor is suitable for proximity detection in NFC-based contactless applications in realistic deployment scenarios. Lastly, we identify a number of potential avenues that may improve their effectiveness.

Proximity Assurances Based on Natural and Artificial Ambient Environments

“…Our initial study (Shepherd et al [31]) questioned the effectiveness of ambient sensing as a proximity detection mechanism under short time frames (500ms)illustrating that numerous sensors available via the Android platform perform poorly within an operating distance of <3cm and transaction-duration of <500ms. Both threshold-and machine learning-based analyses were employed using sensor data collected from mock transactions in the field.…”

“…Similar results were also exhibited by further experimentations (Haken et al [15]) using sensors on the Apple iOS platform. Our third analysis (Gurulian et al [14]) selected seven of the best-performing sensors from our first study [31]. In this study, sensor data from genuine and relay transactions was collected from an emulated relay attack set-up, with the goal of determining whether data from relayed transactions can be distinguished from legitimate ones.…”

Good Vibrations: Artificial Ambience-Based Relay Attack Detection

“…In [24] and [25], the effectiveness of recording the natural ambient environment in short transactions (up to 500ms) was empirically evaluated, with results different from those in the existing literature. Comparison algorithms used in previous works, as well as machine learning techniques, produced a large number of false negative results.…”

“…Limited effectiveness of natural ambient sensing as a Proximity and Relay Attack Detection (PRAD) mechanism in transactions of up to 500ms has been demonstrated through empirical evaluation [24], [25]. The generation and measurement of an artificial ambient environment (AAE) based on random bits or sequences by the peripherals of the transaction devices has been proposed as an alternative.…”

On the Effectiveness of Ambient Sensing for Detecting NFC Relay Attacks

“…An optimum transaction [17] WiFi (Radio Waves) 1 second More Likely Urien et al [16] Temperature N/A -Mehrnezhad et al [23] Accelerometer 0.6 to 1.5 Seconds More Likely Thruong et al [15] GPS duration is 500ms rather than seconds. Shepherd et al [24] questioned the effectiveness of ambient sensing as a proximity detection mechanism under short time frames (< 1 second) -illustrating that a variety of sensors available via the Android platform perform poorly within an operating distance of <3cm. Both threshold-and machine learning-based analyses were employed using sensing data collected from mock transactions in the field.…”