System and methods for data security using distance measurement
Systems and methods for securing data transmissions using distance measurements are disclosed. A mobile device (such as a smart phone) and a base station can use ultra-wideband technology to determine the distance between the two devices. The distance measurements produced by the mobile device and the base station can be compared, directly or indirectly by the mobile device, the base station, and/or an access device to determine whether the mobile device is present at an access device or if the mobile device is not present at the access device (as expected during a relay attack). If the mobile device is not present at the access device, the access device can prevent or cancel an interaction based on the data transfer (e.g., opening a locked door of a secure building in response to receiving an access credential from the mobile device).
1 . A base station comprising:
a processor; and
a computer readable medium, the computer readable medium comprising code, executable by the processor for performing a method comprising:
transmitting to a mobile device, a first transmission comprising a first session identifier;
receiving from the mobile device, a second transmission comprising a second session identifier and a first processing time value;
generating a first distance measurement corresponding to a distance between the mobile device and the base station using the first processing time value;
transmitting to the mobile device, a third transmission, wherein the mobile device generates a second distance measurement corresponding to the distance between the mobile device and the base station;
generating a data element using the first distance measurement, and one or more of the first session identifier, the second session identifier, and/or a mobile device identifier corresponding to the mobile device; and
transmitting the data element to an access device, wherein the access device receives a fourth transmission comprising a first cryptogram generated by the mobile device using the second distance measurement, and one or more of the first session identifier, the second session identifier, and/or the mobile device identifier, and wherein the access device validates the first cryptogram using the data element.
2 . The base station of claim 1 , wherein in the method prior to transmitting the first transmission to the mobile device, the method further comprises:
determining a location associated with the mobile device by performing a locating process with a plurality of other base stations in a base station network;
determining that the mobile device is in a destination area based on the location associated with the mobile device; and
transmitting, to the access device, a message indicating that the mobile device is in the destination area.
3 . The base station of claim 1 , wherein the method further comprises: receiving an initial transmission comprising the mobile device identifier, the initial transmission indicating that the mobile device has entered a destination area.
4 . The base station of claim 1 , wherein the method further comprises:
comparing the first distance measurement to a predetermined distance threshold; and
transmitting, a warning message to the access device, the warning message indicating that the first distance measurement exceeds the predetermined distance threshold.
5 . The base station of claim 1 , wherein the base station and the mobile device communicate via an ultra-wideband communication channel.
6 . A method comprising:
receiving, by an access device from a base station, a data element generated using a first distance measurement, and one or more of a session identifier and/or a mobile device identifier corresponding to a mobile device;
receiving, by the access device from the mobile device, an account identifier and a first cryptogram;
verifying, by the access device, the first cryptogram using the account identifier and data in the data element;
generating, by the access device, an authorization request message comprising the account identifier; and
transmitting, by the access device, the authorization request message to an authorization computer for authorization.
7 . The method of claim 6 , wherein the first cryptogram is generated using a second distance measurement, and wherein the method further comprises, before generating the authorization request message:
obtaining, by the access device, the second distance measurement from the first cryptogram; and
comparing, by the access device, the first distance measurement and the second distance measurement to a threshold to determine if a relay attack is occurring.
8 . The method of claim 7 , wherein the first distance measurement and the second distance measurement are distances between the mobile device and the base station.
9 . The method of claim 8 , wherein the first distance measurement and the second distance measurement were obtained using a ultrawideband communication channel.
10 . The method of claim 6 , wherein the authorization request message further comprise an amount.
11 . The method of claim 6 , wherein the authorization request message further comprises the first cryptogram.
12 . The method of claim 6 , wherein the data element is generated using the first distance measurement, the session identifier and the mobile device identifier.
13 . The method of claim 6 , wherein the session identifier is a nonce.
14 . The method of claim 6 , wherein the method further comprises:
receiving, by the access device, a message from the base station indicating that the mobile device is in a destination area.
15 . The method of claim 6 , wherein the mobile device is a mobile phone.
16 . An access device comprising:
a processor; and
a computer readable medium comprising code, executable by the processor, for performing a method comprising:
receiving, from a base station, a data element generated using a first distance measurement, and one or more of a session identifier and/or a mobile device identifier corresponding to a mobile device,
receiving, from the mobile device, an account identifier and a first cryptogram,
verifying the first cryptogram using the account identifier and data in the data element,
generating an authorization request message comprising the account identifier, and
transmitting the authorization request message to an authorization computer for authorization.
17 . The access device of claim 16 , wherein the access device is a POS terminal.
18 . The access device of claim 16 , wherein the authorization request message comprises an amount and the first cryptogram.
19 . The access device of claim 16 , wherein the first cryptogram is verified by creating a second cryptogram and comparing the first cryptogram with the second cryptogram.
20 . The access device of claim 16 , wherein the method further comprises:
receiving, by the access device, a message from the base station indicating that the mobile device is in a destination area.