US-12619838-B2 - Systems and methods for verifying remote device proximity in RFID systems

Abstract

Systems and methods for verifying remote device proximity in RFID systems are described. To reduce the risk of relay attacks, a terminal may determine a distance of a remote device from the terminal. The terminal may send a computational challenge to the remote device and determine whether a latency of the response is within a maximum acceptable latency, indicating that the remote device is within a maximum acceptable distance. The maximum acceptable latency may be dynamically determined based on context information, such as a time of day, that may be correlated with a likelihood of attempted unauthorized accesses. The terminal may determine whether to perform an action associated with the remote device based on whether the response was received within the maximum acceptable latency.

Inventors

• John R.B. WOODWORTH
• Dean Ballew

Assignees

• CENTURYLINK INTELLECTUAL PROPERTY LLC

Dates

Publication Date

20260505

Application Date

20241206

Claims (18)

1. 1 . A method, comprising: sending, to a remote device, a computational challenge via radio frequency communication; receiving a first response to the computational challenge; dynamically determining a maximum acceptable latency for the first response, wherein the maximum acceptable latency for the first response comprises a first duration associated with the remote device generating the first response and a second duration for propagation of the computational challenge and the first response; determining whether the first response satisfies criteria, including a first criterion that is satisfied when the first response was received within the maximum acceptable latency for the first response and a second criterion that is satisfied when the first response was received after a minimum acceptable latency corresponding to the first duration for solving the computational challenge; identifying a first action associated with the remote device; in accordance with a determination that the first response satisfies the criteria, causing the first action to be performed; and in accordance with a determination that the first response does not satisfy the criteria, refraining from causing the first action to be performed.
2. 2 . The method of claim 1 , further comprising: receiving a first action request from the remote device, wherein the first action is identified based on the first action request.
3. 3 . The method of claim 1 , wherein the first action is identified based on the first response.
4. 4 . The method of claim 1 , wherein the criteria include a third criterion that is satisfied when the first response is successfully authenticated.
5. 5 . The method of claim 1 , wherein dynamically determining the maximum acceptable latency for the first response comprises determining the second duration based on context information.
6. 6 . The method of claim 5 , wherein the context information comprises a location of an electronic device associated with a registered user, a time of day, a calendar entry associated with the registered user, a usage pattern associated with the remote device, or a combination of these.
7. 7 . The method of claim 1 , wherein dynamically determining the maximum acceptable latency for the first response comprises dynamically determining the second duration based on a configuration setting of a maximum acceptable distance between a terminal and the remote device.
8. 8 . The method of claim 1 , wherein dynamically determining the maximum acceptable latency for the first response comprises selecting the second duration based on a current time of day.
9. 9 . The method of claim 1 , wherein dynamically determining the maximum acceptable latency for the first response comprises retrieving, based on context information, the maximum acceptable latency for the first response, the first duration, the second duration, or a combination of these from a storage element.
10. 10 . The method of claim 1 , further comprising: sending, to the remote device, a second computational challenge via radio frequency communication; receiving a second response to the second computational challenge; dynamically determining a maximum acceptable latency for the second response, wherein the maximum acceptable latency for the second response is different from the maximum acceptable latency for the first response; determining whether the second response satisfies one or more second criteria, including a third criterion that is satisfied when the second response is received within the maximum acceptable latency for the second response; identifying a second action associated with the remote device; in accordance with a determination that the second response satisfies the one or more second criteria, causing the second action to be performed; and in accordance with a determination that the second response does not satisfy the one or more second criteria, refraining from causing the second action to be performed.
11. 11 . A system, comprising: at least one processor; and non-transitory memory, storing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising: sending, to a remote device, a computational challenge via radio frequency communication; receiving a first response to the computational challenge; dynamically determining a maximum acceptable latency for the first response, wherein the maximum acceptable latency for the first response comprises a first duration associated with the remote device generating the response and a second duration for propagation of the computational challenge and the first response; determining whether the first response satisfies criteria, including a first criterion that is satisfied when the first response was received within the maximum acceptable latency for the first response and a second criterion that is satisfied when the first response was received after a minimum acceptable latency corresponding to the first duration for solving the computational challenge; identifying a first action associated with the remote device; in accordance with a determination that the first response satisfies the criteria, causing the first action to be performed; and in accordance with a determination that the first response does not satisfy the criteria, refraining from causing the first action to be performed.
12. 12 . The system of claim 11 , the method further comprising: receiving a first action request from the remote device, wherein the first action is identified based on the first action request.
13. 13 . The system of claim 11 , wherein the first action is identified based on the first response.
14. 14 . The system of claim 11 , wherein the criteria include a third criterion that is satisfied when the first response is successfully authenticated.
15. 15 . The system of claim 11 , wherein dynamically determining the maximum acceptable latency for the first response comprises determining the second duration based on context information.
16. 16 . The system of claim 15 , wherein the context information comprises a location of an electronic device associated with a registered user, a time of day, a calendar entry associated with the registered user, a usage pattern associated with the remote device, or a combination of these.
17. 17 . The system of claim 11 , wherein dynamically determining the maximum acceptable latency for the first response comprises dynamically determining the second duration based on a configuration setting of a maximum acceptable distance between a terminal and the remote device.
18. 18 . A method, comprising: sending, to a remote device, a computational challenge via radio frequency communication; receiving a response to the computational challenge; dynamically determining a maximum acceptable latency for the response based on context information; determining whether the response satisfies criteria, including a first criterion that is satisfied when the response was received within the maximum acceptable latency and a second criterion that is satisfied when the first response was received after a minimum acceptable latency corresponding to the first duration for solving the computational challenge; identifying an action associated with the remote device; in accordance with a determination that the response satisfies the criteria, causing the action to be performed; and in accordance with a determination that the response does not satisfy the criteria, refraining from causing the action to be performed.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS This application claims the benefit of U.S. Provisional Application No. 63/609,003 filed Dec. 12, 2023, entitled “Systems and Methods for Verifying Remote Device Proximity in RFID Systems,” which is incorporated herein by reference in its entirety. BACKGROUND Some automotive key fobs are vulnerable to relay attacks in which attackers relay and amplify radio frequency (RF) signals exchanged between the fob and the corresponding vehicle to obtain unauthorized access to the vehicle. Relay attacks can also be used on other types of systems that rely on authentication using RF signals, such as credit cards that use near-field communication (NFC). It is with respect to this general technical environment that aspects of the present disclosure are directed. SUMMARY The present application describes a method including: sending, to a remote device, a computational challenge via radio frequency communication; receiving a first response to the computational challenge; dynamically determining a maximum acceptable latency for the first response, where the maximum acceptable latency includes a first duration associated with the remote device generating the first response and a second duration for propagation of the computational challenge and the first response; determining whether the first response satisfies one or more criteria, including a first criterion that is satisfied when the first response was received within the maximum acceptable latency for the first response; identifying an action associated with the remote device; in accordance with a determination that the first response satisfies the one or more criteria, causing the action to be performed; and in accordance with a determination that the first response does not satisfy the one or more criteria, refraining from causing the action to be performed. In some examples, and in combination with any of the above aspects and examples, the method further includes receiving a first action request from the remote device, where the first action is identified based on the first action request. In some examples, and in combination with any of the above aspects and examples, the first action is identified based on the first response. In some examples, and in combination with any of the above aspects and examples, the one or more criteria include a second criterion that is satisfied when the first response was received after a minimum acceptable latency corresponding to the first duration for solving the computational challenge. In some examples, and in combination with any of the above aspects and examples, the one or more criteria include a third criterion that is satisfied when the first response is successfully authenticated. In some examples, and in combination with any of the above aspects and examples, dynamically determining the maximum acceptable latency for the first response includes determining the second duration based on context information. In some examples, and in combination with any of the above aspects and examples, the context information includes a location of an electronic device associated with a registered user, a time of day, a calendar entry associated with the registered user, a usage pattern associated with the remote device, or a combination of these. In some examples, and in combination with any of the above aspects and examples, dynamically determining the maximum acceptable latency for the first response includes dynamically determining the second duration based on a configuration setting of a maximum acceptable distance between a terminal and the remote device. In some examples, and in combination with any of the above aspects and examples, dynamically determining the maximum acceptable latency for the first response includes selecting the second duration based on a current time of day. In some examples, and in combination with any of the above aspects and examples, dynamically determining the maximum acceptable latency for the first response includes retrieving the maximum acceptable latency, the first duration, the second duration, or a combination of these from a storage element. In some examples, and in combination with any of the above aspects and examples, the method further includes: sending, to the remote device, a second computational challenge via radio frequency communication; receiving a second response to the second computational challenge; dynamically determining a maximum acceptable latency for the second response, where the maximum acceptable latency for the second response is different from the maximum acceptable latency for the first response; determining whether the second response satisfies the one or more second criteria, including a criterion that is satisfied when the second response is received within the maximum acceptable latency for the second response; identifying a second action associated with the remote device; in accordance with a determination that the second response