This paper establishes a fundamental theory of secure clock synchronization. Accurate clock synchronization is the backbone of systems managing power distribution, financial transactions, telecommunication operations, database services, etc. Some clock synchronization (time transfer) systems, such as the global navigation satellite systems, are based on one-way communication from a master to a slave clock. Others, such as the network transport protocol, and the IEEE 1588 precision time protocol (PTP), involve two-way communication between the master and slave. This paper shows that all one-way time transfer protocols are vulnerable to replay attacks that can potentially compromise timing information. A set of conditions for secure two-way clock synchronization is proposed and proved to be necessary and sufficient. It is shown that IEEE 1588 PTP, although a two-way synchronization protocol, is not compliant with these conditions, and is therefore insecure. Requirements for secure IEEE 1588 PTP are proposed, and a second example protocol is offered to illustrate the range of compliant systems.
In @cite_1 , it is remarked that the clock offset computed between multiple master clocks over a symmetric channel must be zero, and thus, if multiple master clocks are available, they can detect any malicious delay introduced by an adversary. However, this defense does not consider the possibility that the adversary may only delay the packets sent to the slave nodes.
@cite_1
2564348914
We introduce the distributed gradient clock synchronization problem. As in traditional distributed clock synchronization, we consider a network of nodes equipped with hardware clocks with bounded drift. Nodes compute logical clock values based on their hardware clocks and message exchanges, and the goal is to synchronize the nodes' logical clocks as closely as possible, while satisfying certain validity conditions. The new feature of gradient clock synchronization (GCS for short) is to require that the skew between any two nodes' logical clocks be bounded by a nondecreasing function of the uncertainty in message delay (call this the distance) between the two nodes. That is, we require nearby nodes to be closely synchronized, and allow faraway nodes to be more loosely synchronized. We contrast GCS with traditional clock synchronization, and discuss several practical motivations for GCS, mostly arising in sensor and ad hoc networks. Our main result is that the worst case clock skew between two nodes at distance d from each other is Ω(d + log D log log D), where D is the diameter1 of the network. This means that clock synchronization is not a local property, in the sense that the clock skew between two nodes depends not only on the distance between the nodes, but also on the size of the network. Our lower bound implies, for example, that the TDMA protocol with a fixed slot granularity will fail as the network grows, even if the maximum degree of each node stays constant. In a network of clocks, we consider a given reference node to determine the time evolution t. We introduce and analyze a stochastic model for clocks, in which the relative speedup of a clock, called the skew, is characterized by some given stochastic process. We study the problem of synchronizing clocks in a network, which amounts to estimating the instantaneous relative skews and relative offsets by exchange of time-stamped packets across the links of the network. We present a scheme for obtaining measurements in a communication link. We develop an algorithm for optimal filtering of measurements across a link (i; j) in order to estimate the logarithm of the relative speedup of node j with respect to node i, and we further study some implementation issues. We also present a scheme for pairwise offset estimation based on skew estimates. We study the properties of our algorithms and provide theoretical guarantees on their performance. We also develop an online centralized model-based asynchronous algorithm for optimal filtering of the time-stamps in the entire network, and an efficient distributed suboptimal scheme. A critical issue in applications involving networks of wireless sensors is their ability to synchronize, and mitigate the fading propagation channel effects. Especially when distributed “slave” sensors (nodes) reach-back to communicate with the “master” sensor (gateway), low power cooperative schemes are well motivated. Viewing each node as an antenna element in a multi-input multi-output (MIMO) multi-antenna system, we design pilot patterns to estimate the multiple carrier frequency offsets (CFO), and the multiple channels corresponding to each node-gateway link. Our novel pilot scheme consists of non-zero pilot symbols along with zeros, which separate nodes in a time division multiple access (TDMA) fashion, and lead to low complexity schemes because CFO and channel estimators per node are decoupled. The resulting training algorithm is not only suitable for wireless sensor networks, but also for synchronization and channel estimation of single- and multi-carrier MIMO systems. We investigate the performance of our estimators analytically, and with simulations. We present a distributed clock synchronization algorithm that guarantees an exponentially improved bound of O(log D) on the clock skew between neighboring nodes in any graph G of diameter D. In light of the lower bound of Omega(log D log log D), this result is almost tight. Moreover, the global clock skew between any two nodes, particularly nodes that are not directly connected, is bounded by O(D), which is optimal up to a constant factor. Our algorithm further ensures that the clock values are always within a linear envelope of real time. A better bound on the accuracy with respect to real time cannot be achieved in the absence of an external timer. These results all hold in a general model where both the clock drifts and the message delays may vary arbitrarily within pre-specified bounds.