# Vulnerability Analysis of LTE-R Train-to-Ground Communication Time Synchronization
## 4 Establishment of LTE-R Time Synchronization SPN and MC Models
### SPN Model of LTE-R Time Synchronization Process  
The steps to establish an LTE-R time synchronization scheme model based on SPN are as follows:  
1. Establish the SPN model of the LTE-R train-to-ground communication time synchronization process according to Figures 2 and 3;
2. Analyze the reachability set of the SPN model. Transform the actual transition marked on each arc into its average firing rate, and construct a continuous-time Markov chain;
3. Solve the steady-state probability according to the related theorem of Markov chain stationary distribution and Chapman-Kolmogorov equations. Suppose the steady-state probability of \(n\) reachable states is \(P[M_{i}]=x_{i}(1\leq i\leq n)\). Determine the element \(x_{i}\) in the steady-state probability set \(X=\{x_{1},\,x_{2},\,\ldots,\,x_{n}\}\) using the following system of equations: \[\left\{ \begin{array}{c}XQ=0\\ \sum\limits_{i=1}^{n}x_{i}=1\end{array} \right.\] (5) where \(Q\) is the transfer rate matrix of the Markov process, and \(n\) is the total number of states. 4. Substitute \(\lambda=\{\lambda_{1},\lambda_{2},\,\ldots,\,\lambda_{m}\}\), solve the equations, solve the stability probability of each state, and analyze the LTE-R time synchronization process according to the obtained steady-state probabilities. The LTE-R train-to-ground communication time synchronization process adopts a secondary clock node, in which eNodeB is the master clock and the OBC is the slave clock. They receive and forward time synchronization messages through the PTP time synchronization protocol. According to the operation mechanism of the LTE-R time synchronization PTP and the vulnerable characteristics of the PTP multicast address and all-IP architecture, a vulnerability analysis model of anLTE-R time synchronization process under attack based on the SPN theory is established. The SPN model is shown in Figure 5. The definitions of the SPN model places are shown in Table 1, and the definitions of transitions are shown in Table 2.  
Figure 5: SPN model of LTE-R time synchronization process under attack. In this model, eNodeB and the OBC establish the uplink synchronization relationship between them by performing random access processes at \(t_{1}\) and \(t_{2}\), respectively. According to Section 3, the attacker \(P_{0}\) can complete the ARP attack by forging the MAC frame structure, setting the destination address to the broadcast address, and modifying the message type to UDP. In this process, as a middleman, the attacker can insert themselves into the regular communication between eNodeB and the OBC and intercept the PTP message with a normal interaction timestamp. For the intercepted PTP message, the attacker can maliciously tamper with the timestamp information in the UDP data field in the MAC frame or delay the sending of the message. In one synchronization cycle of the SPN model, the master clock node eNodeB waits to receive the Delay_Reqmessage \(P_{3}\) sent by the OBC. If eNodeB receives a message without timestamp information in the UDP data field of the MAC frame, it is determined that the message has been maliciously tampered with by the attacker. The synchronization cycle fails, and the token reaches the \(P_{5}\) state through transition \(t_{3}\) and finally reaches NodeB synchronization failure state \(P_{9}\). The synchronization cycle is completed and enters the next cycle. If a PTP message with timestamp information is received, it is considered that it has been sent by the OBC and has not been maliciously tampered with; then, the token at \(P_{3}\) reaches the \(P_{6}\) state through transition \(t_{4}\), and then eNodeB sends theDelay_Rep message to the OBC at \(t_{8}\). Finally, the token reaches the OBC completion time synchronization status \(P_{10}\) and enters the next cycle.