# Vulnerability Analysis of LTE-R Train-to-Ground Communication Time Synchronization
## 6 Simulation Analysis
### OBC Vulnerability Analysis  
Among the three vulnerable nodes, and are used as the OBC to receive the average firing rate of the PTP messages sent by the attackers. The values of and are taken as 0 and 30, respectively, and the other values are taken as 1. The specific calculation results are shown in Table 5. In order to see the impact of the different protocol vulnerabilities more intuitively, the data in Table 5 are presented in a schematic diagram as shown in Figure 8.  
As shown in Table 5 and Figure 8, the effects of different \(\lambda_{5}\) and \(\lambda_{13}\) values on the steady-state probability values of each end state of a clock node are compared. As the \(\lambda_{5}\) value gradually increase, the steady-state probabilities \(P(M_{5})\) and \(P(M_{6})\) of the abnormal and normal end states of eNodeB remain unchanged; the steady-state probability \(P(M_{13})\) of the abnormal end state of the OBC slightly decreases from 0.1538 to 0.0744, and the steady-state probability \(P(M_{14})\) of the normal end state of the OBC slightly increases from 0 to 0.0372. Furthermore, as the \(\lambda_{13}\) value gradually increase, the steady-state probability  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Steady-State Probability** & **Fragile Node** & **Variation Range** & **Changing Amplitude** & **Change Trend** \\ \hline \(P(M_{5})\) & \(\lambda_{5}\) & 0.0769–0.0769 & 0 & Unchanged \\  & \(\lambda_{13}\) & 0.0714–0.0829 & 0.0115 & Almost Unchanged \\ \hline \(P(M_{6})\) & \(\lambda_{5}\) & 0.0769–0.0769 & 0 & Unchanged \\  & \(\lambda_{13}\) & 0.0714–0.0829 & 0.0115 & Almost Unchanged \\ \hline \(P(M_{13})\) & \(\lambda_{5}\) & 0.1538–0.0794 & \(-\)0.0744 & Reduces Slightly \\  & \(\lambda_{13}\) & 0.1429–0.0856 & \(-\)0.0573 & Reduces Slightly \\ \hline \(P(M_{14})\) & \(\lambda_{5}\) & 0–0.0372 & 0.0372 & Rises Slightly \\  & \(\lambda_{13}\) & 0–0.0401 & 0.0401 & Rises Slightly \\ \hline \end{tabular}
\end{table}
Table 5: Changes in the steady-state probability of each end state when and changes.  
Figure 8: Simulation results of each steady-state probability when (**a**) changes and (**b**) changes.  
\(P(M_{5})\) and \(P(M_{6})\) of the abnormal and normal end states of eNodeB slightly increase by 0.0115, the steady-state probability \(P(M_{13})\) of the abnormal end states of the OBC decrease by 0.0573 from 0.01429, and the steady-state probability \(P(M_{14})\) of the normal end states of the OBC slightly increase by 0.0401 from the initial value of 0. By comparing the changes in amplitude of the steady-state probability of the abnormal and normal end states of eNodeB and the OBC, it can be seen that the changes in\(\lambda_{5}\) and \(\lambda_{13}\) values have little impact on the steady-state probability of each end state of eNodeB, which shows that the OBC, as the slave clock of eNodeB, receives PTP messages with different degrees of attack and has little impact on the master clock of eNodeB. This conclusion is consistent with the conclusion of a previous study [13], where an experimental test platform was built to carry out ARP spoofing attacks on PTP synchronization messages. It is proved that the vulnerability analysis model of the LTE-R time synchronization network protocol in this paper is effective.