# Vulnerability Analysis of LTE-R Train-to-Ground Communication Time Synchronization
## 4 Establishment of LTE-R Time Synchronization SPN and MC Models
### SPN Model of LTE-R Time Synchronization Process
\begin{table}
\begin{tabular}{c c} \hline \hline
**Places** & **Definition** \\ \hline \(P_{0}\) & Attacker intrusion status \\ \(P_{1}\) & Initialization of the primary clock node eNodeB \\ \(P_{2}\) & Initialization of the secondary clock node OBC \\ \(P_{3}\) & eNodeB waits to receive the Delay_Req message \\ \(P_{4}\) & OBC waits to receive Follow_up message \\ \(P_{5}\) & eNodeB receives the malicious tampered PTP message \\ \(P_{6}\) & eNodeB receives the Delay_Rep message \\ \(P_{7}\) & Complete the process of calculating clock offset \\ \(P_{8}\), \(P_{13}\) & OBC receives the malicious tampered PTP message \\ \(P_{9}\) & eNodeB time synchronization failed, entering the next cycle \\ \(P_{10}\) & eNodeB time synchronization succeeded, entering the next cycle \\ \(P_{11}\) & OBC waits to receive the Delay_Req message \\ \(P_{12}\) & Complete the process of calculating clock delay \\ \(P_{14}\) & OBC time synchronization succeeded, entering the next cycle \\ \(P_{15}\) & OBC time synchronization failed, entering the next cycle \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Definitions of places. \begin{table}
\begin{tabular}{c c} \hline \hline
**Transitions** & **Definition** \\ \hline \(t_{1}\), \(t_{2}\) & The primary and secondary clock nodes eNodeB and OBC establish \\ communication connections with each other \\ \(t_{3}\), \(t_{6}\), \(t_{14}\) & Clock nodes receive the malicious tampered PTP synchronization message \\ \(t_{4}\) & eNodeB receives Delay_Req message \\ \(t_{5}\) & OBC receives Follow_up message and calculates the value of _offset_ \\ \(t_{7}\), \(t_{10}\), \(t_{15}\) & Exception handling of tampered message \\ \(t_{8}\) & eNodeB sends Delay_Rep message \\ \(t_{9}\) & OBC sends Delay_Req message \\ \(t_{11}\) & eNodeB abnormal end \\ \(t_{12}\) & eNodeB normal end \\ \(t_{13}\) & OBC receives Delay_Rep message and calculates the value of _delay_ \\ \(t_{16}\) & It is determined that _offset_ and _delay_ meet the time threshold \\ \(t_{17}\) & It is determined that _offset_ and _delay_ do not meet the time threshold \\ \(t_{18}\) & OBC normal end \\ \(t_{19}\) & OBC abnormal end \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Definitions of transitions. In the same cycle, the slave clock node OBC waits to receive the synchronization cycle message \(P_{4}\) sent by eNodeB. Similarly, if the received message has no timestamp information in the UDP data field of its MAC frame, it is determined to be a message that has been maliciously tampered with by the attacker. The OBC synchronization fails in this cycle, and the token reaches the \(P_{8}\) state through \(t_{6}\), then reaches the OBC time synchronization end failure state \(P_{15}\), and enters the next cycle. If there is timestamp information in the UDP data field of the received message, it is determined that the OBC has received the normal Follow_up message sent by eNodeB. Then, the token arrives at \(t_{5}\), OBC calculates the _offset_ value according to the T\({}_{1}\) and T\({}_{2}\) timestamp information in the Follow_up message, and the token reaches the \(P_{7}\) state. Similarly, the OBC waits to receive the delayed response message \(P_{11}\) sent by eNodeB, and if there is no timestamp information in the UDP data of the received message, it is determined that the message has been maliciously tampered with; the OBC synchronization cycle fails, and the token reaches the \(P_{13}\) state through \(t_{14}\). Finally, the token reaches the synchronization failure state \(P_{15}\) and enters the next cycle. If a message containing timestamp information is received, it is determined to be a normal message sent by eNodeB. The token enters t\({}_{13}\) to calculate the value of the path delay according to the received timestamp. Then, according to the synchronization deviation threshold, it is judged whether the offset and delay values are legal. If they are legal, the token enters \(t_{16}\), reaches the OBC time synchronization completion state P\({}_{14}\), and enters the next cycle.