# Reference Broadcast-Based Secure Time Synchronization for Industrial Wireless Sensor Networks
## 4 RSTS Protocol
### RSTS Synchronization
Under the benign environment, nodes \(m\) and \(s\) could receive messages from node \(r\) with valid sending timestamps. The relationship between timestamps is shown in Table 1.  
```
Input: \(G=(V,E),\hat{a}_{00}(0)=1,\hat{\beta}_{i0}(0)=0,T,\forall\ i,j\in V,e_{ij}\in E,j\in N_{i}\). Output: \(\hat{a}_{i0},\hat{\beta}_{i0},\forall\ i\in V\). 1. \(\forall\ j\in V\), if \(\tau_{j}(t)=kT,k\in N^{+}\), node \(j\) broadcasts its time \(\tau_{j}(t)\) with a random packet sequence \(seq_{ij}(t)\). 2. Upon receiving time information from node \(j\), nodes \(i,l\) records \(<\)\(\tau_{i}(t)\), \(seq_{j}(t)\)\(>\) and \(<\)\(\tau_{l}(t)\), \(seq_{j}(t)\)\(>\), \(i,l\in N_{j}\), respectively. 3. If node \(i\) is in the sync state, it broadcasts the sync time, where \[\hat{\tau}_{i0}(t)\leftarrow\hat{a}_{i0}(t)\tau_{l}(t)+\hat{\beta}_{i0}(t).\]
4. Node \(j\) forwards the sync packet received from node \(i\) to node \(l,l\in N_{j},l\
otin N_{i}\). 5. If the \(seq_{j}(t)\) matches, node \(l\) calculates \(\Delta\tau_{l0}(t)=\tau_{l0}(t)-\tau_{l}(t)\), and stores \(<\)\(\Delta\tau_{l0}(t)\), \(\tau_{l}(t)\)\(>\). 6. Upon storing \(n\) records, node \(l\) estimates \(<\hat{a}_{i0},\hat{\beta}_{i0}\)\(>\) as Equation (7) and then denotes it as the sync state. ```  
**Algorithm 1** RSTS protocol. We now consider the case that when node \(A_{1}\) attacks the synchronization process by illegitimately claiming the identity of node \(r\), nodes \(m\) and \(s\) would receive the incorrect timestamps \(\tau_{A_{1}}^{r}(k)\) simultaneously. Since the difference of received two consecutive timestamps with identity \(r\) exceeds the preset threshold, existing threshold detection-based secure synchronization protocols would regard node \(r\) as a malicious node. Therefore, secure node \(r\) would be isolated by the other nodes. On the contrary, our RSTS defense mechanism does not detect whether the received messages are valid. Note that the purpose of RSTS is to obtain a valid \(\Delta\tau_{ms}(t)=\tau_{m}(t)-\tau_{s}(t)\), where the records \(\tau_{m}(t)\) and \(\tau_{s}(t)\) are based on the same basic time. Although the sending timestamp \(\tau_{A_{1}}^{r}(k)\) from the attacker \(A_{1}\) is incorrect, the receiving timestamps of nodes \(m\) and \(s\) refer to the same reference and the difference \(\tau_{m}^{A_{1}}(k)-\tau_{s}^{A_{1}}(k)\) is correct. Hence, the invalid messages can  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \begin{tabular}{c} **Sending** \\ **Timestamps** \\ **in \(r\)** \\ \end{tabular}  & \begin{tabular}{c} **Attacker** \\ **\(A_{1}\)** \\ \end{tabular}  & \begin{tabular}{c} **Attacker** \\ **\(A_{2}\)** \\ \end{tabular}  & \begin{tabular}{c} **Attacker** \\ **\(A_{3}\)** \\ \end{tabular}  & \begin{tabular}{c} **Receiving** \\ **Timestamps** \\ **in \(m\)** \\ \end{tabular}  & \ \begin{tabular}{c} **Receiving** \\ **Timestamps** \\ **in \(s\)** \\ \end{tabular}  & \begin{tabular}{c} **Receiving** \\ **Timestamps** \\ **in \(s\)** \\ \end{tabular}  \\ \hline \(\tau_{r}(1)\) & \(\mathbf{-}\) & \(\mathbf{-}\) & \(\mathbf{-}\) & \(\mathbf{-}\) & \(\tau_{m}^{r}(1)\) & \(\tau_{s}^{r}(1)\) & Y \\ \(\mathbf{-}\) & \(\mathbf{-}\) & \(\tau_{A_{2}}^{r}(1)\) & \(\mathbf{-}\) &  
be filtered out automatically by the time difference when receiving the public timestamps from the attacker. If the attacker \(A_{2}\) advertises invalid timestamps \(\tau_{A_{2}}^{r}(k)\) with disguised identity \(r\), only node \(m\) could receive the timestamps. Based on the matching principle of the received message sequence number, there are no corresponding messages \(\tau_{s}^{A_{2}}(k)\) in node \(s\). Consequently, the destructiveness from attacker \(A_{2}\) is automatically relieved. Similarly, for attacker \(A_{3}\), the threat no longer exists by default.