Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
survey

Security of Distance-Bounding: A Survey

Published: 25 September 2018 Publication History
  • Get Citation Alerts
  • Abstract

    Distance-bounding protocols allow a verifier to both authenticate a prover and evaluate whether the latter is located in his vicinity. These protocols are of particular interest in contactless systems, e.g., electronic payment or access control systems, which are vulnerable to distance-based frauds. This survey analyzes and compares in a unified manner many existing distance-bounding protocols with respect to several key security and complexity features.

    Supplemental Material

    ZIP File - a94-avoine-suppl.pdf
    Supplemental movie, appendix, image and software files for, Security of Distance-Bounding: A Survey

    References

    [1]
    Imad M. Abbadi and Chris J. Mitchell. 2007. Digital rights management using a mobile phone. In Proceedings of the 9th International Conference on Electronic Commerce (ICEC’07). ACM, 185--194.
    [2]
    Gildas Avoine, Muhammed Ali Bingöl, Süleyman Kardaş, Cédric Lauradoux, and Benjamin Martin. 2011. A framework for analyzing RFID distance bounding protocols. J. Comput. Secur. 19, 2 (Mar. 2011), 289--317.
    [3]
    Gildas Avoine, Christian Floerkemeier, and Benjamin Martin. 2009. RFID distance bounding multistate enhancement. In Proceedings of the 10th International Conference on Cryptology in India. LNCS, Vol. 5922. Springer, 290--307.
    [4]
    Gildas Avoine and Chong Hee Kim. 2013. Mutual distance bounding protocols. IEEE Trans. Mobile Comput. 12, 5 (May 2013), 830--839.
    [5]
    Gildas Avoine, Cédric Lauradoux, and Benjamin Martin. 2011. How secret-sharing can defeat terrorist fraud. In Proceedings of the 4th ACM Conference on Wireless Network Security (WiSec’11). ACM, 145--156.
    [6]
    Gildas Avoine, Sjouke Mauw, and Rolando Trujillo-Rasua. 2015. Comparing distance bounding protocols: A critical mission supported by decision theory. Comput. Commun. 67 (2015), 92--102.
    [7]
    Gildas Avoine and Aslan Tchamkerten. 2009. An efficient distance bounding RFID authentication protocol: Balancing false-acceptance rate and memory requirement. In Proceedings of the Information Security Conference. LNCS, Vol. 5735. Springer, 250--261.
    [8]
    Paramvir Bahl and Venkata N. Padmanabhan. 2000. RADAR: An in-building RF-based user location and tracking system. In Proceedings of the 19th Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM’00). 775--784.
    [9]
    Asli Bay, Ioana Cristina Boureanu, Aikaterini Mitrokotsa, Iosif-Daniel Spulber, and Serge Vaudenay. 2012. The bussard-bagga and other distance-bounding protocols under attacks. In Proceedings of the China International Conference on Information Security and Cryptology (Inscrypt’12). LNCS, Vol. 7763. Springer.
    [10]
    Samy Bengio, Gilles Brassard, Yvo Desmedt, Claude Goutier, and Jean-Jacques Quisquater. 1991. Secure implementation of identification systems. J. Cryptol. 4, 3 (1991), 175--183.
    [11]
    Thomas Beth and Yvo Desmedt. 1990. Identification tokens - or: Solving the chess grandmaster problem. In Proceedings of the Conference on Advances in Cryptology (CRYPTO’90). LNCS, Vol. 537. Springer, 169--177.
    [12]
    Ioana Boureanu, Aikaterini Mitrokotsa, and Serge Vaudenay. 2015. Practical and provably secure distance-bounding. J. Comput. Secur. 23, 2 (2015), 229--257.
    [13]
    Ioana Cristina Boureanu, Aikaterini Mitrokotsa, and Serge Vaudenay. 2012. On the pseudorandom function assumption in (secure) distance-bounding protocols. In Proceedings of the Conference on Progress in Cryptology (LATINCRYPT’12). LNCS, Vol. 7496. Springer, 100--120.
    [14]
    Ioana Cristina Boureanu, Aikaterini Mitrokotsa, and Serge Vaudenay. 2013. Practical 8 provably secure distance-bounding. In Proceedings of the Information Security Conference (ISC’13). LNCS, Vol. 7807. Springer, 248--258.
    [15]
    Ioana Cristina Boureanu, Aikaterini Mitrokotsa, and Serge Vaudenay. 2013. Secure 8 lightweight distance-bounding. In Proceedings of the 2nd International Workshop on Lightweight Cryptography for Security 8 Privacy. LNCS, Vol. 8162. Springer, 97--113.
    [16]
    Ioana Cristina Boureanu, Aikaterini Mitrokotsa, and Serge Vaudenay. 2013. Towards secure distance bounding. In Proceedings of the 20th International Workshop on Fast Software Encryption (FSE’13)) LNCS, Vol. 8424. Springer.
    [17]
    Stefan Brands and David Chaum. 1993. Distance-bounding protocols. In Proceedings of the Conferene on Advances in Cryptology (EUROCRYPT’93). LNCS, Vol. 765. Springer, 344--359.
    [18]
    Laurent Bussard and Walid Bagga. 2005. Distance-bounding proof of knowledge to avoid real-time attacks. In Proceedings of the Conference on Security and Privacy in the Age of Ubiquitous Computing (IFIP’05), Vol. 181. Springer, 223--238.
    [19]
    W. Camp. 2007. Digital rights management based on device proximity. (May 2007). US Patent No. 11/164, 289.
    [20]
    Srdjan Čapkun, Levente Buttyán, and Jean-Pierre Hubaux. 2003. SECTOR: Secure tracking of node encounters in multi-hop wireless networks. In Proceedings of the ACM Workshop on Security of Ad Hoc and Sensor Networks (SASN’03). ACM, 21--32.
    [21]
    Srdjan Čapkun and Jean-Pierre Hubaux. 2006. Secure positioning in wireless networks. IEEE J. Select. Areas Commun. 24, 2 (Feb. 2006), 221--232.
    [22]
    Humphrey Cheung. 2004. How To: Building a BlueSniper Rifle. Retrieved from http://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408.html.
    [23]
    Omar Choudary and Frank Stajano. 2011. Make noise and whisper: A solution to relay attacks. In Security Protocols. LNCS, Vol. 7114. Springer, 271--283.
    [24]
    Jolyon Clulow, Gerhard P. Hancke, Markus Kuhn, and Tyler Moore. 2006. So near and yet so far: Distance-bounding attacks in wireless networks. In Proceedings of the European Workshop on Security and Privacy in Ad-Hoc and Sensor Networks (ESAS’06). LNCS, Vol. 4357. Springer, 83--97.
    [25]
    John H. Conway. 1976. On Numbers and Games. Number 6 in London Mathematical Society Monographs. Academic Press, New York, NY.
    [26]
    Cas J. F. Cremers, Kasper Bonne Rasmussen, Benedikt Schmidt, and Srdjan Čapkun. 2012. Distance hijacking attacks on distance bounding protocols. In Proceedings of the IEEE Symposium on Security and Privacy (S8P’12). 113--127.
    [27]
    Yvo Desmedt. 1988. Major securitv problems with the unforgeable (Feige)-Fiat-Shamir proofs of identity and how to overcome them. In Proceedings of the Worldwide Congress on Computer and Communications Security and Protection (SecuriCom’88). 147--159.
    [28]
    Yvo Desmedt, Claude Goutier, and Samy Bengio. 1988. Special uses and abuses of the fiat-shamir passport protocol. In Proceedings of the Advances in Cryptology (CRYPTO’87). LNCS, Vol. 293. Springer, 21--39.
    [29]
    Saar Drimer and Steven J. Murdoch. 2007. Keep your enemies close: Distance bounding against smartcard relay attacks. In Proceedings of the USENIX Security Symposium (USENIX’07). 1--16.
    [30]
    Ulrich Dürholz, Marc Fischlin, Michael Kasper, and Cristina Onete. 2011. A formal approach to distance bounding RFID protocols. In Proceedings of the 14th Information Security Conference (ISC’11). LNCS, Vol. 7001. Springer, 47--62.
    [31]
    Uriel Feige, Amos Fiat, and Adi Shamir. 1987. Zero knowledge proofs of identity. In Proceedings of the 19th ACM Symposium on Theory of Computing (STOC’87). 210--217.
    [32]
    Amos Fiat and Adi Shamir. 1986. How to prove yourself: Practical solutions to identification and signature problems. In Proceedings of the Conference on Advances in Cryptology (CRYPTO’86) LNCS, Vol. 263. Springer, 186--194.
    [33]
    Marc Fischlin and Cristina Onete. 2013. Subtle kinks in distance-bounding: An analysis of prominent protocols. In Proceedings of the 6th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WISEC’13). 195--206.
    [34]
    Marc Fischlin and Cristina Onete. 2013. Terrorism in distance bounding: Modeling terrorist-fraud resistance. In Proceedings of the International Conference on Applied Cryptography and Network Security (ACNS’13). LNCS, Vol. 7954. Springer, 414--431.
    [35]
    Aurélien Francillon, Boris Danev, and Srdjan Čapkun. 2011. Relay attacks on passive keyless entry and start systems in modern cars. In Proceedings of the Network and Distributed System Security Symposium.
    [36]
    Lishoy Francis, Gerhard Hancke, and Keith Mayes. 2013. A practical generic relay attack on contactless transactions by using NFC mobile phones. Int. J. RFID Secur. Cryptogr. 2, 1 (Dec. 2013), 92--106.
    [37]
    Lishoy Francis, Gerhard P. Hancke, Keith Mayes, and Konstantinos Markantonakis. 2010. Practical NFC peer-to-peer relay attack using mobile phones. In Proceedings of the Workshop on RFID Security. LNCS, Vol. 6370. Springer, 35--49.
    [38]
    Mohammad Ghavami, Lachlan B. Michael, and Ryuji Kohno. 2004. Ultra Wideband Signals and Systems in Communication Engineering. Wiley, New York, NY.
    [39]
    Tzipora Halevi, Haoyu Li, Di Ma, Nitesh Saxena, Jonathan Voris, and Tuo Xiang. 2013. Context-aware defenses to RFID unauthorized reading and relay attacks. IEEE Trans. Emerg. Top. Comput. 1, 2 (Dec. 2013), 307--318.
    [40]
    Gerhard P. Hancke. 2006. Practical attacks on proximity identification systems (short paper). In Proceedings of the IEEE Symposium on Security and Privacy IEEE (S&P’’’06). IEEE, 328--333.
    [41]
    Gerhard P. Hancke. 2010. Design of a secure distance-bounding channel for RFID. J. Netw. Comput. Appl. 34, 3 (May 2010), 877--887.
    [42]
    Gerhard P. Hancke and Markus Kuhn. 2005. An RFID distance bounding protocol. In Proceedings of the Conference on Security and Privacy for Emerging Areas in Communication Networks (SecureComm’05). IEEE, 67--73.
    [43]
    Gerhard P. Hancke and Markus Kuhn. 2008. Attacks on time-of-flight distance bounding channels. In Proceedings of the 1st ACM Conference on Wireless Network Security (WiSec’08). ACM, 194--202.
    [44]
    Gerhard P. Hancke, Keith Mayes, and Konstantinos Markantonakis. 2009. Confidence in smart token proximity: Relay attacks revisited. Comput. Secur. 28, 7 (Jun. 2009), 615--627.
    [45]
    Orhun Kara, Süleyman Kardaş, Muhammed Ali Bingöl, and Gildas Avoine. 2010. Optimal security limits of RFID distance bounding protocols. In Proceedings of the Workshop on RFID Security. LNCS, Vol. 6370. Springer, 220--238.
    [46]
    Süleyman Kardaş, Mehmet Sabir Kiraz, Muhammed Ali Bingöl, and Hüseyin Demirci. 2011. A novel RFID distance bounding protocol based on physically unclonable functions. In Proceedings of the Workshop on RFID Security. LNCS, Vol. 7055. Springer, 78--93.
    [47]
    Ziv Kfir and Avishai Wool. 2005. Picking virtual pockets using relay attacks on contactless smartcard systems. In Proceedings of the Conference on Security and Privacy for Emerging Areas in Communication Networks (SecureComm’05). IEEE, 47--58.
    [48]
    Chong Hee Kim and Gildas Avoine. 2009. RFID distance bounding protocol with mixed challenges to prevent relay attacks. In Proceedings of the International Conference on Cryptology and Network Security (CANS’09). LNCS, Vol. 5888. Springer, 119--133.
    [49]
    Chong Hee Kim and Gildas Avoine. 2011. RFID distance bounding protocols with mixed challenges. IEEE Trans Wireless Commun. 10, 5 (2011), 1618--1626.
    [50]
    Chong Hee Kim, Gildas Avoine, François Koeune, François-Xavier Standaert, and Olivier Pereira. 2008. The swiss-knife RFID distance bounding protocol. In Proceedings of the International Conference on Information Security and Cryptology (ICISC’08). LNCS, Vol. 5461. Springer, 98--115.
    [51]
    Sjouke Mauw, Jorge Toro Pozo, and Rolando Trujillo-Rasua. 2016. A class of precomputation-based distance-bounding protocols. In Proceedings of the 1st IEEE European Symposium on Security and Privacy (Euro S&P).
    [52]
    Sjouke Mauw, Jorge Toro Pozo, and Rolando Trujillo-Rasua. 2016. Optimality results on the security of lookup-based protocols. In Proceedings of the Workshop on RFID Security. LNCS. Springer.
    [53]
    Aikaterini Mitrokotsa, Christos Dimitrakakis, Pedro Peris-Lopez, and Julio C. Hernandez-Castro. 2010. Reid et al.’s distance bounding protocol and mafia fraud attacks over noisy channels. IEEE Commun. Lett. 14, 2 (Feb. 2010), 121--123.
    [54]
    Jorge Munilla, Andres Ortiz, and Alberto Peinado. 2006. Distance bounding protocols with void-challenges for RFID. In Proceedings of the Workshop on RFID Security. Ecrypt.
    [55]
    Jorge Munilla and Alberto Peinado. 2008. Distance bounding protocols for RFID enhanced by using void-challenges and analysis in noisy channels. Wireless Commun. Mobile Comput. 8, 9 (Jan. 2008), 1227--1232.
    [56]
    Jorge Munilla and Alberto Peinado. 2008. Security analysis of tu and piramuthu’s protocol. In Proceedings of the Conference on New Technologies, Mobility and Security (NTMS’08). IEEE, 1--5.
    [57]
    Jorge Munilla and Alberto Peinado. 2009. Enhanced low-cost RFID protocol to detect relay attacks. Wireless Commun. Mobile Comput. 10, 3 (Mar. 2009), 361--371.
    [58]
    Ventzislav Nikov and Marc Vauclair. 2008. Yet Another Secure Distance-Bounding Protocol. Cryptology ePrint Archive, Report 2008/319. (2008).
    [59]
    Pedro Peris-Lopez, Julio C. Hernandez-Castro, Juan M. Estevez-Tapiador, Esther Palomar, and Jan C. A. van der Lubbe. 2010. Cryptographic puzzles and distance-bounding protocols: Practical tools for RFID security. In Proceedings of the IEEE Annual International Conference on RFID 2010. 45--52.
    [60]
    Pedro Peris-Lopez, Julio C. Hernandez-Castro, Juan M. Estevez-Tapiador, and Jan C. A. van der Lubbe. 2009. Shedding Some Light on RFID Distance Bounding Protocols and Terrorist Attacks. CoRR abs/0906.4618 (2009).
    [61]
    Kasper Bonne Rasmussen. 2011. Primitives for Secure Localization and Location Verification. Ph.D. Dissertation. ETH Zurich.
    [62]
    Kasper Bonne Rasmussen, Claude Castelluccia, Thomas S. Heydt-Benjamin, and Srdjan Čapkun. 2009. Proximity-based access control for implantable medical devices. In Proceedings of the ACM Conference on Computer and Communications Security. ACM, 43--53.
    [63]
    Kasper B. Rasmussen and Srdjan Čapkun. 2010. Realization of RF distance bounding. In Proceedings of the USENIX Security Symposium (USENIX’10). USENIX, 389--402.
    [64]
    Jason Reid, Juan Gonzalez Nieto, Tee Tang, and Bouchra Senadji. 2007. Detecting relay attacks with timing based protocols. In Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security (ASIACCS’07). ACM, 204--213.
    [65]
    Dave Singelée and Bart Preneel. 2007. Distance bounding in noisy environments. In Proceedings of the Security and Privacy in Ad-hoc and Sensor Networks (ESAS’07). LNCS, Vol. 4572. Springer, 101--115.
    [66]
    Mohammad Reza Sohizadeh Abyaneh. 2011. Security analysis of two distance-bounding protocols. In Proceedings of the Workshop on RFID Security. LNCS, Vol. 7055. Springer, 94--107.
    [67]
    Frank Stajano, Ford-Long Wong, and Bruce Christianson. 2010. Multichannel protocols to prevent relay attacks. In Proceedings of the 14th International Conference on Financial Cryptography and Data Security (FC’10). LNCS, Vol. 6052. Springer, 4--19.
    [68]
    Rolando Trujillo-Rasua. 2013. Complexity of distance fraud attacks in graph-based distance bounding. In Mobile and Ubiquitous Systems: Computing, Networking, and Services. Springer.
    [69]
    Rolando Trujillo-Rasua, Benjamin Martin, and Gildas Avoine. 2010. The poulidor distance-bounding protocol. In Proceedings of the Workshop on RFID Security. LNCS, Vol. 6370. Springer, 239--257.
    [70]
    Rolando Trujillo-Rasua, Benjamin Martin, and Gildas Avoine. 2014. Distance bounding facing both mafia and distance frauds. IEEE Trans. Wireless Commun. 13, 10 (2014), 5690--5698.
    [71]
    Yu-Ju Tu and Selwyn Piramuthu. 2007. RFID distance bounding protocols. In Proceedings of the International EURASIP Workshop on RFID Technology.
    [72]
    Pascal Urien and Selwyn Piramuthu. 2014. Elliptic curve-based RFID/NFC authentication with temperature sensor input for relay attacks. Decis. Support Syst. 59 (Oct. 2014), 28--36.
    [73]
    Serge Vaudenay. 2013. On modeling terrorist frauds. In Proceedings of the International Conference on Provable Security (ProvSec’13). LNCS, Vol. 8209. Springer, 1--20.
    [74]
    Serge Vaudenay. 2015. Private and secure public-key distance bounding - application to NFC. In Proceedings of the Conference on Financial Cryptography and Data Security (FC’15). LNCS, Vol. 8975. Springer, 207--216.
    [75]
    Brent R. Waters and Edward W. Felten. 2003. Secure, Private Proofs of Locations. Technical Report TR-667-03. Princeton Computer Science.
    [76]
    Dae Hyun Yum, Jin Seok Kim, Sung Je Hong, and Pil Joong Lee. 2011. Distance bounding protocol for mutual authentication. IEEE Trans. Wireless Commun. 10, 2 (2011), 592--601.

    Cited By

    View all
    • (2024)Privacy-preserving location authentication for low-altitude UAVs: A blockchain-based approachSecurity and Safety10.1051/sands/20240043(2024004)Online publication date: 16-Apr-2024
    • (2024)Cross-Layer RF Distance Bounding Scheme for Passive and Semi-passive Ubiquitous Computing SystemsComputers and Security10.1016/j.cose.2023.103633137:COnline publication date: 12-Apr-2024
    • (2024)Software-based remote memory attestation using quantum entanglementQuantum Information Processing10.1007/s11128-024-04421-x23:6Online publication date: 27-May-2024
    • Show More Cited By

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Computing Surveys
    ACM Computing Surveys  Volume 51, Issue 5
    September 2019
    791 pages
    ISSN:0360-0300
    EISSN:1557-7341
    DOI:10.1145/3271482
    • Editor:
    • Sartaj Sahni
    Issue’s Table of Contents
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 25 September 2018
    Accepted: 01 March 2017
    Revised: 01 February 2017
    Received: 01 July 2014
    Published in CSUR Volume 51, Issue 5

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. Information security
    2. contactless
    3. cryptography
    4. distance fraud
    5. distance-bounding
    6. mafia fraud
    7. proximity check
    8. relay attacks
    9. terrorist fraud

    Qualifiers

    • Survey
    • Research
    • Refereed

    Data Availability

    a94-avoine-suppl.pdf: Supplemental movie, appendix, image and software files for, Security of Distance-Bounding: A Survey https://dl.acm.org/doi/10.1145/3264628#avoine.zip

    Funding Sources

    • H2020 Marie Skłodowska-Curie
    • Flemish IWT SBO project MobCom
    • Luxembourg National Research Fund (FNR)
    • European Commission
    • COST Action IC1403 (Cryptacus)
    • IAP Programme P6/26 BCRYPT of the Belgian State
    • Research Council K.U.Leuven: GOA TENSE

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)120
    • Downloads (Last 6 weeks)9
    Reflects downloads up to

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Privacy-preserving location authentication for low-altitude UAVs: A blockchain-based approachSecurity and Safety10.1051/sands/20240043(2024004)Online publication date: 16-Apr-2024
    • (2024)Cross-Layer RF Distance Bounding Scheme for Passive and Semi-passive Ubiquitous Computing SystemsComputers and Security10.1016/j.cose.2023.103633137:COnline publication date: 12-Apr-2024
    • (2024)Software-based remote memory attestation using quantum entanglementQuantum Information Processing10.1007/s11128-024-04421-x23:6Online publication date: 27-May-2024
    • (2023)Time for changeProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620239(19-36)Online publication date: 9-Aug-2023
    • (2023)Integrated secure distance bounding and hardware-based security: A case study for the insurance claim verification of farmers during COVID-19Open Research Europe10.12688/openreseurope.15448.13(40)Online publication date: 23-Feb-2023
    • (2023)LeopardSeal: Detecting Call Interception via Audio Rogue Base StationsProceedings of the 21st Annual International Conference on Mobile Systems, Applications and Services10.1145/3581791.3596846(410-422)Online publication date: 18-Jun-2023
    • (2023)Protecting HRP UWB Ranging System Against Distance Reduction AttacksProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security10.1145/3576915.3623145(622-635)Online publication date: 15-Nov-2023
    • (2023)Generic and Universal Local Cryptocurrency: LCoin2023 5th Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS)10.1109/BRAINS59668.2023.10317036(1-4)Online publication date: 11-Oct-2023
    • (2023)A survey on indoor positioning security and privacyComputers and Security10.1016/j.cose.2023.103293131:COnline publication date: 1-Aug-2023
    • (2023)On the optimal resistance against mafia and distance fraud in distance-bounding protocolsComputer Communications10.1016/j.comcom.2023.07.033210:C(69-78)Online publication date: 1-Oct-2023
    • Show More Cited By

    View Options

    Get Access

    Login options

    Full Access

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    HTML Format

    View this article in HTML Format.

    HTML Format

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media