# Vulnerability Analysis of LTE-R Train-to-Ground Communication Time Synchronization
## 1 Introduction  
At present, train-to-ground communication systems of high-speed railways use the global system for mobile communications-railway (GSM-R). However, GSM-R has the problems of narrow bandwidth, less carrying services, and low throughput, making it difficult to meet the requirements for the development of intelligent and automated high-speed railways [1]. The International Union of Railways (UIC) pointed out that GSM-R should evolve to the long-term evolution for railway (LTE-R) [2]. LTE-R is the next generation of high-speed railway train-to-ground communication systems, and it adopts a flatter network architecture and all-IP packet switching modes. Compared with GSM-R, LTE-R significantly reduces network complexity and construction cost. LTE-R carries a large number of traffic safety control commands. Realizing LTE-R time synchronization is the key to ensuring the safe operation of a high-speed railway [3]. At present, the GSM-R wireless communication system uses the network time protocol (NTP) to complete train-to-ground time synchronization [4]. However, the NTP has some disadvantages, such as a low synchronization accuracy, large delay, and poor stability of the transmission process, which will make it difficult to meet the high-precision time synchronization requirements of LTE-R systems in the future [5]. Because of the above problems, in fields with high requirements for time synchronization accuracy, the use of the green time protocol (PTP) instead of the NTP has been studied [6,7]. [PERSON] [8] applied PTP technology to the test section of China's Shuohuang railway. The test result showed that PTP time synchronization technology can meet the use requirements of the wireless packet network of China's Shuohuang railway. However, the PTP adopts a multicast address and LTE-R all-IP architecture, which are more vulnerable to network attacks [9]. [PERSON] et al. [10] pointed out that denial of service(DoS) attacks, delay attacks, modification attacks, and spoofing attacks can force the clock to align with the wrong time or directly interrupt the synchronization process. [PERSON] al. [11] proposed that an attacker can establish a connection with the client by forging and spoofing the server, and then they can achieve the purpose of arbitrarily manipulating the client time. [PERSON] et al. [12] pointed out that an attacker can force the device to actively refuse to serve the target LTE terminal by sending a large number of signaling messages so as to complete a DoS attack. [PERSON] et al. [13] proposed that DoS attacks can be launched by sending spam to the target slave station through deceptive data packets. [PERSON] et al. [14] stated that encrypting the PTP can prevent some attacks but cannot prevent delay attacks, man-in-the-middle (MITM) attacks, and other attacks. In summary, atime synchronization process using the PTP will inevitably be subjected to various attacks. Therefore, in view of the above characteristics of the PTP, the major aim of this article is to analyze the vulnerable nodes that affect the LTE-R time synchronization process by using a combination of stochastic Petri nets (SPNs) and a continuous-time Markov chain (CTMC), andarelationship curve between the average firing rate of vulnerable nodes and the steady-state probability of each normal and abnormal end state of the synchronization process is obtained. This method is able to identify the most vulnerable nodes in the LTE-R time synchronization process.The specific steps of the method are as follows:Firstly, we establish an SPN model of anLTE-R time synchronization process under attack. Then, we use the method of model isomorphism to transform the SPN model into a Markov chain (MC). Last but not least, by analyzing the relationship between the average firing rate of several key vulnerable nodes and the steady-state probability of the time node, we determine the key factors that affect the vulnerability of the LTE-R time synchronization process.