A Countermeasure against Relay Attack in NFC Payment

Near Field Communication (NFC) is a convenient short range contactless communication method that is receiving more and more attentions for its simplicity to support mobile payment. Influential industry players, such as Apple, Google and Samsung have integrated NFC technology in their mobile payment applications, i.e. Apple Pay, Android Pay and Samsung Pay, respectively. To deploy NFC for mobile payment, one of the most significant concern is its security. In this article, we proposed a countermeasure to fight against Replay attacks. While some existing work has proposed to set a time bound to prevent relay attack based on the assumption that a relay attack will take much longer time to complete than a normal NFC transaction. Existing approaches however did not address the situation when cloud-based authentication is involved and may confuse it as a relay attack. We extended the time-bound approach in this work and presents a comprehensive estimate of normal transactions versus relayed transactions. A prototype Android application was also built to prove the correctness of the proposed approach.