1. N-Guard: a Solution to Secure Access to NFC tags
IEEE Conference on Communications and Network Security
30 May-1 June 2018 // Beijing // China
N-Guard: a Solution to Secure Access to NFC tags
Roberto Di Pietro, Gabriele Oligeri, Xavier Salleras and Matteo Signorini

2. IEEE CNS 2018
N-Guard

3. Outline Introduction and background
IEEE CNS 2018
N-Guard
Outline
Introduction and background
State of the art and problems tackled
NFC Cards authentication and security
NFC security solutions
Our solution: N-Guard
Information flow
Implementation
Experimental tests
Why adopting N-Guard
Conclusions

4. Introduction and background
IEEE CNS 2018
N-Guard
Introduction and background
NFC is a short-range technology (13.56 MHz).
Three different NFC modes.
Different kinds of NFC-enabled devices.
One of its most common uses are PoS payments.

5. State of the art and problems tackled
IEEE CNS 2018
N-Guard
State of the art and problems tackled
NFC Cards authentication and security
One of the first and most effective attack on NFC payment cards appeared in [1].
Read the content of a credit card and forward the stolen data to a proxy.
[1] F. Lishoy, H. Gerhard, M. Keith, and M. Konstantinos, “Practical nfc peer-to-peer relay attack using mobile phones,” in Proceedings of the 6th International Conference on Radio Frequency Identification: Security and Privacy Issues, ser. RFIDSec’

6. State of the art and problems tackled
IEEE CNS 2018
N-Guard
State of the art and problems tackled
NFC architecture security
Authors in [2] proposed a physical layer based solution to secure NFC communications from eavesdropping
Affects the signals on the initiators to hide the communications
Does not require any change to the targets
[2] R. Jin and K. Zeng, “Secnfc: Securing inductively-coupled near field communication at physical layer,” in Communications and Network Security (CNS), 2015 IEEE Conference.

7. Detecting Relay Attacks
IEEE CNS 2018
N-Guard
State of the art and problems tackled
Detecting Relay Attacks
Alice
Bob
chg
Start clock
chg
rsp
rsp
Stop clock
Store: ∆T
T MAX
Bob accepts legitimacy of Alice if and only if:
Response rsp verifies
Measured time ∆T ≤ T MAX
Food for thought:
is this a branch of SW attestation?

8. Our solution: N-Guard R = Reader S = Smartphone T = Non sensitive tag
IEEE CNS 2018
N-Guard
Our solution: N-Guard
R = Reader
S = Smartphone
T = Non sensitive tag
V = Sensitive NFC card

9. Our solution: N-Guard Information flow
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Information flow
Two main phases: selection (performed by user, just one time) and protection (automatic)
During selection, the user chooses the tags to be protected by N-Guard
The protection phase is the one actually preventing the chosen tags from being read

10. IEEE CNS 2018
N-Guard
Our solution: N-Guard
Information flow

11. Our solution: N-Guard Implementation
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Implementation
Implemented considering the Android OS platform and Google Nexus 5X phones
Problem: current NFC controllers embedded in the smartphones are not open
Solution: Proxmark3, a third party NFC chip attached to the smartphone

12. Our solution: N-Guard Implementation
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Implementation
Our solution is continuously eavesdropping the communications.
When an attacker attempts to read our protected cards is detected, the HLTA command is sent.

13. Table I: READY to IDLE reaction
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Experimental tests: Blocking unauthorized access
Message (5) tries to read the protected card.
Message (6) injects the HLTA command.
Later, in message (7) the attacker is not able to retrieve information.
Table I: READY to IDLE reaction

14. Table II: ACTIVE to HALT reaction
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Experimental tests: Blocking unauthorized access
Message (12) sends information to the attacker.
Message (13) injects the HLTA command.
Later, in message (14), the communication has been cut.
Table II: ACTIVE to HALT reaction

15. Our solution: N-Guard Experimental tests: Performance analysis
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Experimental tests: Performance analysis
Two different set of experiments have been performed.
We used our solution, along with an NFC reader and a standard NFC tag.

16. Our solution: N-Guard Experimental tests: Performance analysis
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Experimental tests: Performance analysis
Results prove a good performance.
The success rate when shifting is almost 100% up to 5cm of distance.
When lifting, the rate starts to decrease when reaching the distance of 2cm.

17. Our solution: N-Guard Experimental tests: Power consumption
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Experimental tests: Power consumption
Measurements performed using a USB dongle connected to the Proxmark3
Any noticeable increase in the power consumption is observed
Eavesdropping functionality works independently from N-Guard, thus not affecting the battery drain of the smartphone
Once an attack is detected, N-Guard requires the transmission of only one message to switch the victim tag to the HALT status
As such, we can assure that N-Guard is extremely efficient as regards the energy consumption

18. Our solution: N-Guard Why adopting N-Guard
IEEE CNS 2018
N-Guard
Our solution: N-Guard
Why adopting N-Guard
General solution (it applies to all NFC tags)
Completely transparent, and fine grained (user in control)
It works also for proprietary protocols (e.g. MasterCard)
Its adoption does not require any change to the customer’s habits, to the reader, or even to the tag
Negligible power consumption overhead

19. IEEE CNS 2018
N-Guard
Conclusions
N-Guard is a solution to prevent fraudulent extraction of sensitive data from NFC enabled devices
It relies on an NFC capable smartphone
It is able to protect standard-abiding NFC communications, as well as proprietary protocols
It is easy to implement/adopt
It has a negligible power consumption overhead

20. IEEE CNS 2018
N-Guard