Man-in-the-middle extender defense in data communications
A method of determining whether a received message at a communications device is from a legitimate second device may include building a message intended for a legitimate second device, generating a time delay using a secret key known to the device and the legitimate second device, sending the built message to the legitimate second device, starting a timer at the time of sending the built message, receiving a response to the sent message, determining a response time of the received response based on a time value of the timer, determining an acceptable receive window of time based on the generated time delay, determining whether the determined response time is within the determined acceptable receive window of time, and when the determined response time is within the determined acceptable receive window of time, recognizing the received response as a legitimate message from the legitimate second device.
1. A utility meter comprising:
a processor;
a transceiver communicably coupled with the processor, the transceiver configured to communicate over a network; and
a memory communicably coupled with the processor, the memory storing instructions that, when executed by the processor, direct the processor to:
build a message, as a built message, intended for a mobile device associated with a user, the built message including a copy of a secret key known by the utility meter and the mobile device associated with the user, wherein the utility meter comprises a relay device;
generate a time delay using the secret key known by the utility meter and the mobile device associated with the user;
send, via the transceiver, the built message to the mobile device associated with the user;
start a time counter at a zero time of sending the built message;
receive a response to the built message;
determine a response time of the response based on a time value of the time counter;
determine an acceptable receive window of time based on the time delay;
determine whether the response time is within the acceptable receive window of time; and
in response to the response time being outside the acceptable receive window of time, proceeding with one or more precautionary measures, the one or more precautionary measures including at least re-sending the built message.
2. The utility meter of claim 1 , wherein the secret key is provided to the utility meter prior to building the message intended for the mobile device associated with the user.
3. The utility meter of claim 1 , wherein the secret key is provided to the utility meter in a message previously received from the mobile device associated with the user.
4. The utility meter of claim 1 , wherein the time delay takes into account message processing time at the mobile device associated with the user.
5. The utility meter of claim 1 , wherein the time delay takes into account expected network latency.
6. The utility meter of claim 1 , wherein the copy of the secret key comprises an encrypted copy of the secret key.
7. A method comprising:
building, via a processor of a utility meter, a built message intended for a mobile device associated with a user, the built message including a copy of a secret key known by the utility meter and the mobile device associated with the user;
generating, via the processor, a time delay using the secret key known to the utility meter and to the mobile device associated with the user;
sending, via a transceiver of the utility meter over a network, the built message to the mobile device associated with the user;
starting a timer of the utility meter at a time of sending the built message;
receiving, via the transceiver, a response to the built message;
determining a response time of the response based on a time value of the timer;
determining an acceptable receive window of time based on the time delay;
determining that the response time is outside the acceptable receive window of time; and
proceeding with one or more precautionary measures in response to the response time being outside the acceptable receive window of time, the one or more precautionary measures including at least re-sending the built message.
8. The method of claim 7 , wherein the generating the time delay includes generating the time delay to take into account message processing time at the mobile device associated with the user.
9. The method of claim 7 , wherein the generating the time delay includes generating the time delay to take into account expected network latency.
10. The method of claim 7 , wherein the copy of the secret key comprises an encrypted copy of the secret key.
11. At least one non-transitory computer-readable medium having computer program logic stored thereon, the computer program logic including instructions that, when executed by a processor of a utility meter, cause the processor to:
build a built message intended for a mobile device associated with a user, the built message including a copy of a secret key known by the utility meter and the mobile device associated with the user, wherein the utility meter comprises a relay device;
generate a time delay using the secret key known to the utility meter and to the mobile device associated with the user;
send, via a transceiver of the utility meter over a network, the built message to the mobile device associated with the user;
start a time counter of the utility meter at a zero time of sending the built message;
receive, via the transceiver, a response to the built message;
determine a response time of the response based on a time value of the time counter;
determine an acceptable receive window of time based on the time delay;
determine whether the response time is within the acceptable receive window of time; and
in response to the response time being outside the acceptable receive window of time, proceeding with one or more precautionary measures, the one or more precautionary measures including at least re-sending the built message.
12. The at least one non-transitory computer-readable medium of claim 11 , wherein generating the time delay includes generating the time delay to take into account message processing time at the mobile device associated with the user.
13. The at least one non-transitory computer-readable medium of claim 11 , wherein generating the time delay includes generating the time delay to take into account expected network latency.
14. The at least one non-transitory computer-readable medium of claim 11 , wherein the copy of the secret key comprises an encrypted copy of the secret key.
15. A mobile device comprising:
a processor;
a transceiver communicably coupled with the processor; and
a memory communicably coupled with the processor, the memory storing instructions that, when executed by the processor, direct the processor to:
receive a message from a utility meter over a network, the utility meter comprising a relay device;
record, in the memory, a receive time of the message;
build a reply message intended for the utility meter, the reply message including a copy of a secret key known by the mobile device and the utility meter;
generate a time delay using a time counter started at a zero time of receiving the message, the time delay being based at least in part on the secret key known by the mobile device and the utility meter;
intentionally delay sending the reply message to the utility meter based on the receive time and the time delay; and
send, via the transceiver, the reply message to the utility meter after the intentional delay.
16. The mobile device of claim 15 , wherein the copy of the secret key comprises an encrypted copy of the secret key.
17. The mobile device of claim 15 , wherein the time delay takes into account message processing time at the utility meter.
18. The mobile device of claim 15 , wherein the time delay takes into account expected network latency.
19. The utility meter of claim 1 , wherein the relay device includes a signed root certificate.
20. The method of claim 7 , wherein proceeding with the one or more precautionary measures includes sending a request for further device authentication.
21. The method of claim 7 , wherein proceeding with the one or more precautionary measures includes sending an error message.