Patent Description:
In general, TSN defines a set of standards (and amendments) with the aim to enable time synchronization and deterministic data delivery in converged networks where time-critical (TC) traffic coexists with other types of traffic. Thus, there is a need to provide security for TSN devices to mitigate the risks associated with disruption in TSN operation from attacks on the timing of the network. <CIT> relates to a method and system for detecting and mitigating time synchronization attacks of global positioning system, GPS, receivers. <CIT> relates to systems and methods for altering time data.

To easily identify the discussion of any element or act, the most significant digit or digits in a reference number refer to the figure number in which that element is first introduced.

The present disclosure is generally directed to reducing interference or attack vectors for systems operating based on TSN. As noted, TSN defines a set of standards (and amendments) with the aim to enable time synchronization and deterministic data delivery in converged networks where TC traffic coexists with other types of traffic. Various standards have been developed to address time-sensitive communications. Two of the more prominent standards for enabling time-sensitive communications are promulgated by the Institute of Electrical and Electronics Engineers (IEEE). For example, IEEE <NUM>. 1AS and IEEE <NUM>. 1Qbv provide systems and methods for synchronizing device clocks. IEEE <NUM>. 1AS provides a protocol for time synchronization across the network, where time sensitive devices (e.g., followers) synchronize to a leader clock; while IEEE <NUM>. 1Qbv provides for prioritizing TC traffic in the network switches using gate-controlled lists (GCLs).

<FIG> depicts a network 100a implemented according to a TSN standard (e.g., IEEE <NUM>. 1AS, IEEE <NUM>. 1Qbv, or the like). As depicted, network 100a includes origination node <NUM>, switch nodes 104a, 104b, and 104c and end node <NUM>, all communicatively coupled via communication channel <NUM>. It is noted that the number of nodes in network 100a is selected for purposes of clarity and not limitation. In practice, network 100a can include any number and combination of nodes (e.g., origination nodes, switches, end devices, etc.). Nodes in network 100a (e.g., origination node <NUM>, switch node 104a, switch node 104b, and switch node 104c, etc.) are provided a GCL table, which specifies timing for windows in which the nodes can transmit packets on communication channel <NUM>.

Switch nodes 104a, 104b, and 104c can be any number of devices in a network arranged to communicate, such as for example, electronic control units in an autonomous vehicle, an industrial system, a medical system, or the like. Additionally, communication channel <NUM> can be any of a variety of communication channels, including wired or wireless communication channels. In some implementations, all devices in network 100a will receive GCL tables. However, in some implementations, not all nodes will receive a GCL table.

Typically, GCL tables are generated in a network controller (not shown) and are designed to prioritize TC traffic and prevent lower priority traffic from accessing communication channel <NUM>, thus guaranteeing the timely delivery of TC packets within preconfigured time windows. <FIG> depicts a timing diagram 100b depicting communication windows (e.g., Qbv windows, or the like) for switches of network 100a based on GCL tables. Timing diagram 100b depicts a number of Qbv windows for multiple time periods in which packets are transmitted. For example, timing diagram 100b depicts Qbv windows 110a, 110b, and 110c in which packets 116a, 116b, and 116c, respectively are transmitted. Additionally, timing diagram 100b depicts Qbv windows 112a, 112b, and 112c in which packets 118a, 118b, and 118c, respectively are transmitted. Lastly, timing diagram 100b depicts Qbv windows 114a, 114b, and 114c in which packets 120a, 120b, and 120c, respectively are transmitted. It is noted that the communication windows referred to herein are referred to as Qbv windows or protected windows for clarity. However, other standard or techniques for forming protected communication windows to facilitate time synchronization can be used besides Qbv windows. Examples are not limited in this context.

To facilitate transmission of packets (e.g., packet 116a, etc.) during protected windows (e.g., Qbv window 110a, etc.), nodes in network 100a are time synchronized and scheduled to transmit TC packets (e.g., packet 116a, etc.) using non overlapping protected windows (e.g., Qbv window 110a, etc.). It is to be appreciated that providing latency bounded communication (e.g., as depicted in timing diagram 100b) requires tight synchronization of time between nodes in network 100a. With such dependency on time synchronization, reliable TSN operation can be disrupted by attacking the timing of the network.

<FIG> depicts a network 200a, which is like network 100a except that switch 104b of network <NUM> is now compromised and depicted as compromised switch node <NUM>. In particular, the clock (not shown) of compromised switch node <NUM> can be attacked and compromised, thereby causing the Qbv window (e.g., Qbv windows 110b, 112b, and 114b) associated with compromised switch node <NUM> to be misaligned with respect to, and even overlap with, the protected windows of the other switch nodes in the data stream path (e.g., along communication channel <NUM>).

<FIG> depicts timing diagram 200b illustrating Qbv windows of compromised switch node <NUM> misaligned, and overlapping on some cases, with Qbv windows of the other switch nodes (e.g., 104a and 104c). Qbv window 110b is depicted misaligned with Qbv window 110a and Qbv window 110c and overlapping with Qbv window 110a. Likewise, Qbv window 112b is depicted misaligned with Qbv windows 112a and 112c and overlapping with Qbv window 112a. Additionally, Qbv window 114b is depicted misaligned with Qbv windows 114a and 114c and overlapping with Qbv window 114a. As a result, packets (e.g., packet 118a in the figure) arrive too late with respect to the protected window (e.g., Qbv window 112b) of compromised switch <NUM>, causing the associated packet 118b to be buffered and sent in the next protected window (e.g., 114b). As a result of the delay in transmitting packet 118b, compromised switch node <NUM> breaks the latency bound of the stream that it is serving and can result in errors or comprise the safety of the system in which the nodes are operating.

The present disclosure provides to detect attacks against networks operating under TSN protocols, such as, networks operating in accordance with IEEE <NUM>. In particular, the present disclosure provides systems and methods to detect attacks that directly affect IEEE <NUM>. 1Qbv scheduling. In general, the present disclosure provides detection of time synchronization misbehavior in networks operating in accordance with TSN protocols based on attributes associated with a key performance indicator (KPI) or KPIs, or the TSN protocol. The present disclosure uses IEEE <NUM>. 1Qbv as the TSN protocol and describes KPIs associated with IEEE <NUM>. However, it is noted that examples described herein can be applied to other TSN protocols different from IEEE <NUM>.

With some examples, systems and methods are described that detect misbehavior of TSN compliant networks based on pseudo-random delay sequence to detect the presence of "man-in-the-middle attacks" (e.g., packet delay, packet injection, etc.). Specifically, two communicating nodes in the TSN (e.g., network 100a, or the like) have a synchronized pseudo-random number generator (PRNG). On the side of the transmitter, a number received from the PRNG determines the transmission delay of the message. On the receiver side, the same number obtained from the PRNG determines the expectation on the arrival time of the message. The message can be placed in a number of different time slots and the alignment of the message with the time slots can be used to detect the presence (or absence) of an attack on the time synchronization of the TSN.

The present disclosure is relevant to various products, such as those that implement TSN capabilities, including Ethernet NICs, Wi-Fi radios, FPGA SOCs, <NUM> networks components and Edge/Client computing platforms since it provides methods to monitor these new attributes to detect attacks. This method can be instantiated in both software and hardware, which, for example, enables us to deploy it embedded in Intel's silicon applicable to several products as listed above.

The present disclosure provides time synchronization attack detection using pseudo-randomization of timing of messages within protected windows, which facilitates earlier detection (versus conventional techniques) of timing attacks in TSN devices.

<FIG> illustrates an example timing diagram <NUM> depicting a protected transmission window <NUM> in which a TC packet <NUM> is transmitted. Protected transmission window <NUM> can be based on a GCL table as outlined above. During protected transmission window <NUM>, a device (e.g., origination node <NUM>, switch node 104a, end node <NUM>, or the like) can transmit TC packets, such as TC packet <NUM>. Whereas outside of protected transmission window <NUM>, unprotected frames 308a and/or 308b can be transmitted. Often, protected transmission window <NUM> can be proceeded by guard band <NUM>. TC packet <NUM> can include data frame <NUM>, short inter frame spacing <NUM>, and acknowledgment <NUM>.

As introduced above, the present disclosure provides that two communicating nodes (e.g., switch node 104a and switch node 104c, or origination node <NUM> and end node <NUM>, or the like) have a synchronized pseudo-random number generator (PRNG). On the side of the transmitter (e.g., origination node <NUM>, or the like) a number received from the PRNG determines a transmission delay (described in greater detail below) of the TC packet <NUM>; while on the side of the receiver (e.g., end node <NUM>, or the like) the same number obtained from the PRNG determines the expectation on the arrival time of the TC packet <NUM>. Accordingly, the transmitter can fit the TC packet <NUM> into a number of different time slots based on the PRNG while the receiver can determine adherence to transmission in the time slot based on the PRNG and thus determine the presence (or absence) of a time synchronization attack.

In general, the transmitter can delay transmission of TC packet <NUM> based on a delay time <NUM> (DT), which equals the time the protected transmission window <NUM> starts (TWstart) minus the time the TC packet <NUM> starts (Tstart) or said differently the delay between the start of protected transmission window <NUM> and the start of TC packet <NUM>. The transmitter can further control a time buffer <NUM> (TB), which equals the time the protected transmission window <NUM> ends (TWend) minus the time the TC packet <NUM> ends (Tend) or said differently the delay between the end of the TC packet <NUM> and the end of protected transmission window <NUM> time buffer (TB)).

<FIG> depict a system <NUM> including transmit node <NUM> and receive node <NUM> arranged to communicate messages based on a TSN protocol as outlined herein. In particular, transmit node <NUM> and receive node <NUM> can be ones of nodes depicted in <FIG>. As a specific example transmit node <NUM> can be representative of origination node <NUM> while receive node <NUM> can be representative of end node <NUM>. As another example, transmit node <NUM> can be representative of switch node 104a while receive node <NUM> can be representative of switch node 104c. In general, transmit node <NUM> and receive node <NUM> can be arranged to transmit messages having a delay time <NUM> and/or time buffer <NUM> based on a PRNG which is synchronized between the transmit node <NUM> and receive node <NUM>.

Transmit node <NUM> includes a processor circuit <NUM>, a clock <NUM>, memory <NUM>, PRNG <NUM>, networking circuitry <NUM>, and an antenna <NUM>. Memory <NUM> stores instructions <NUM> and PRN <NUM>. During operation, processor circuit <NUM> can execute instructions <NUM> to cause transmit node <NUM> to determine PRN <NUM> from PRNG <NUM>. Likewise, processor circuit <NUM> can execute instructions <NUM> to cause transmit node <NUM> to transmit a message (e.g., TC packet <NUM>) having a delay time <NUM> and/or <NUM> based on the PRN <NUM>.

Similarly, receive node <NUM> includes a processor circuit <NUM>, a clock <NUM>, memory <NUM>, PRNG <NUM>, networking circuitry <NUM>, and an antenna <NUM>. Memory <NUM> stores instructions <NUM> and PRN <NUM>. During operation, processor circuit <NUM> can execute instructions <NUM> to cause receive node <NUM> to determine PRN <NUM> from PRNG <NUM>. Likewise, processor circuit <NUM> can execute instructions <NUM> to cause receive node <NUM> to determine whether a message (e.g., TC packet <NUM>) is transmitted with a delay time <NUM> and/or <NUM> based on the PRN <NUM>.

It is noted that although transmit node <NUM> and receive node <NUM> are depicted wirelessly coupled via antennas <NUM> and <NUM>, implementations can be wired as well as wireless. For example, antennas <NUM> and <NUM> can be replaced with wired networking interconnects to facilitate a wired connection between networking circuitry <NUM> and <NUM>.

In some examples, PRNG <NUM> and PRNG <NUM> are cryptographic pseudo-random number generators (PRNGs) and are arranged to generate synchronized pseudo-random numbers (e.g., PRN <NUM>, or the like) independently from each other. Transmit node <NUM> can be arranged to transmit a message (e.g., TC packet <NUM>) having a delay time <NUM> based on the PRN <NUM>, a time buffer <NUM> based on the PRN <NUM>, or both <NUM> and time buffer <NUM> based on PRN <NUM>. Furthermore, the delay time <NUM> and/or time buffer <NUM> can vary provided that the protected transmission window <NUM> is not violated.

<FIG> illustrates a logic flow <NUM> that can be implemented by a transmitting device (e.g., origination node <NUM>, switch node 104a, transmit node <NUM>, etc.) to provide for detection of timing attacks, in accordance with non-limiting example(s) of the present disclosure. Logic flow <NUM> can begin at block <NUM> "generate a pseudo-random number (PRN)" where a PRN can be generated. For example, processor circuit <NUM> can execute instructions <NUM> to generate a PRN <NUM> via PRNG <NUM>.

Continuing to block <NUM> "transmit a message in a TSN protected window with a delay time and/or time buffer based on the PRN" a message can be transmitted in a TSN protected window with a delay time (DT) and/or a time buffer (TB) based on the PRN. For example, processor circuit <NUM> can execute instructions <NUM> to cause transmit node <NUM> to transmit a message (e.g., TC packet <NUM>) in a TSN protected window, or Qbv window (e.g., protected transmission window <NUM>) with a DT (e.g., delay time <NUM>) and/or a TB (e.g., time buffer <NUM>) based on the PRN <NUM>.

It is important to note that a mapping exists between the PRN (e.g., generated at block <NUM>) and the DT and/or TB. However, the actual delay slot (e.g., refer to <FIG>) does not necessarily need to have an actual <NUM>:<NUM> correlation to the PRN. That is, a mapping between the PRB and the delay can exist and be agreed upon by the communicating parties (e.g., origination node <NUM> and end node <NUM>, or the like). The mapping can be randomized and/or can be dynamic (e.g., change over time).

<FIG> illustrates a logic flow <NUM> that can be implemented by a receiving device (e.g., end node <NUM>, switch node 104c, receive node <NUM>, etc.) to receive a message and detect potential timing synchronization attacks, in accordance with non-limiting example(s) of the present disclosure. Logic flow <NUM> can begin at block <NUM> "generate a pseudo-random number (PRN)" where a PRN can be generated. For example, processor circuit <NUM> can execute instructions <NUM> to generate a PRN <NUM> via PRNG <NUM>.

Continuing to block <NUM> "receive a message in a TSN protected window with a delay time (DT) and a time buffer (TB)" a message is received in a TSN protected window with a DT and a TB. For example, processor circuit <NUM> can execute instructions <NUM> to cause receive node <NUM> to receive a message (e.g., TC packet <NUM>) in a TSN protected window, or Qbv window (e.g., protected transmission window <NUM>) where the message is transmitted with a DT (e.g., delay time <NUM>) and a TB (e.g., time buffer <NUM>) relative to the protected window.

Continuing to decision block <NUM> "DT and/or TB consistent with the PRN" a determination is made as to whether the DT and/or the TB is consistent with the PRN. For example, processor circuit <NUM> can execute instructions <NUM> to determine whether the DT (e.g., delay time <NUM>) and/or the TB (e.g., time buffer <NUM>) associated with the message (e.g., TC packet <NUM>) received at block <NUM> is consistent with the PRN generated at block <NUM>. It is noted that the order of block <NUM> and <NUM> can be reversed where a packet can be received and then a PRN generated to check the packet timing. This is explained in greater detail below.

From decision block <NUM>, logic flow <NUM> can continue to block <NUM> or can return to block <NUM>. For example, logic flow <NUM> can continue from decision block <NUM> to block <NUM> based on a determination that the DT and/or the TB is not consistent with the PRN while logic flow <NUM> can return to block <NUM> from decision block <NUM> based on a determination that the DT and/or the TB is consistent with the PRN.

At block <NUM> "trigger detection of possible timing attack" an alert of a possible timing synchronization attack can be triggered. For example, processor circuit <NUM> can execute instructions <NUM> to generate an alert indicating that a possible timing synchronization attack is detected. In some examples, processor circuit <NUM> can execute instructions <NUM> to send the alert or an indication of the alert to a management entity of the TSN of devices in which receive node <NUM> is operating.

<FIG> illustrates a timing diagram <NUM> showing the DT and TB of a message transmitted a protected window, in accordance with non-limiting example(s) of the present disclosure. For example, this figure depicts TC packet <NUM> transmitted in protected transmission window <NUM> with delay time <NUM> and time buffer <NUM>. Further, this figure depicts start time slots <NUM> associated with delay time <NUM>.

As outlined above, transmit node <NUM> can transmit messages, for example, based on logic flow <NUM> where the start of the transmission of TC packet <NUM> will not start at the beginning protected transmission window <NUM>. That is, transmit node <NUM> inserts a random delay based on PRN <NUM> to cause the start of the transmission of TC packet <NUM> within the protected transmission window <NUM> to coincide with one of start time slots <NUM>. As such, delay time <NUM> will be based on the PRN. It is noted that the granularity and number of possible start time slots <NUM> can be configured following the functional and security requirements of the TSN system or end application.

Given the added randomness associated with the PRN <NUM>, each transmission of a message (e.g., TC packet <NUM>) starts in a different point in time within the protected transmission window <NUM>, which makes it infeasible to be replicated by an entity that does not have access to the PRN <NUM>. In this manner, the same PRN (e.g., PRN <NUM>) is generated by the transmitter (e.g., transmit node <NUM>) and receiver (receive node <NUM>) and transmission of the message beginning at one of start time slots <NUM> can be made based on the PRN <NUM> and also validated, by the receiving entity, based on the PRN <NUM>.

<FIG> illustrates timing diagram <NUM> showing the DT and TB of a message transmitted a protected window, in accordance with non-limiting example(s) of the present disclosure. As outlined above, transmit node <NUM> can transmit messages, for example, based on logic flow <NUM> where the time buffer <NUM> of TC packet <NUM> relative to protected transmission window <NUM> is based on PRN <NUM>. More specifically, the timing of the end of the TC packet <NUM> within protected transmission window <NUM> can be selected to coincide with end time slots <NUM> based on the PRN. It is noted that the granularity and number of possible end time slots <NUM> can be configured following the functional and security requirements of the TSN system or end application.

It is noted that often the TC packet <NUM> typically ends with acknowledgment <NUM>. The present disclosure provides that the length of size of TC packet <NUM> is modified based on the PRN <NUM> such that the end of TC packet <NUM> coincides with the desired <NUM>. In some examples, the TC packet <NUM> can be modified by adding a number of bits (e.g., added bits <NUM>), which can be <NUM>, <NUM>, or random bits. In a specific example, TC packet <NUM> can be modified by inserting added bits <NUM> based on PRN <NUM>. As such, in addition to validating the TC packet <NUM> based on end time slots <NUM> of time buffer <NUM>, the receiver (e.g., receive node <NUM>) can validate the TC packet <NUM> based on the added bits <NUM>.

<FIG> illustrates computer-readable storage medium <NUM>. Computer-readable storage medium <NUM> may comprise any non-transitory computer-readable storage medium or machine-readable storage medium, such as an optical, magnetic or semiconductor storage medium. In various embodiments, computer-readable storage medium <NUM> may comprise an article of manufacture. In some embodiments, computer-readable storage medium <NUM> may store computer executable instructions <NUM> with which circuitry (e.g., processor circuit <NUM>, processor circuit <NUM>, PRNG <NUM>, PRNG <NUM>, radio circuitry <NUM>, radio circuitry <NUM>, or the like) can execute. For example, computer executable instructions <NUM> can include instructions to implement operations described with respect to logic flow <NUM>. As another example, computer executable instructions <NUM> can include instructions to implement operations described with respect to logic flow <NUM>. Examples of computer-readable storage medium <NUM> or machine-readable storage medium may include any tangible media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. Examples of computer executable instructions <NUM> may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, and the like.

As outlined, the present disclosure provides techniques to determine or identify time synchronization attacks based on synchronized PRNGs. The present techniques can be implemented by circuitry and/or implemented in instructions executable by circuitry in a variety of systems, such as, for example, Ethernet network interface cards, Wi-Fi radios, field programmable gate array (FPGA) system-on-chips (SOCs), <NUM> networks components, autonomous vehicles, or Edge/Client computing platforms. As such an example system using autonomous vehicles is provided.

<FIG> illustrates a system <NUM> including a number of connected vehicles, such as vehicle 902a, vehicle 902b, vehicle 902c, vehicle 902d, vehicle 902e, and vehicle 902f. Vehicle 902a to vehicle 902f are depicted traveling on a roadway <NUM> with a roadside unit (RSU) <NUM> adjacent to the roadway <NUM>. Although these figures illustrate the RSU <NUM> being arranged at a side of the roadway <NUM>, it may be understood that the RSU <NUM> may be arranged anywhere (e.g., top, bottom, etc.) near the roadway <NUM> or in any fashion that allows the RSU <NUM> to communicate with the vehicles (and vice versa). RSU <NUM> may be mobile (e.g., one of vehicles, or the like) and travel on roadway <NUM> with the vehicles. Moreover, it may be understood that vehicles 902a to vehicle 902f may not be limited to motor-based vehicles (e.g., gas, diesel, electric), but may be any suitable vehicle configured to perform vehicle-to-vehicle (V2V) and/or vehicle-to-anything (V2X) communication, such as railed vehicles (e.g., trains, trams), watercraft (e.g., ships, boats), aircraft (airplanes, spaceships, satellites, etc.) and the like.

Vehicle 902a to vehicle 902f and RSU <NUM> can communicate with each other over network <NUM>. In general, communication between devices (e.g., vehicle 902a to vehicle 902f and RSU <NUM>, or the like) can be facilitated by RSU <NUM> acting as a routing node for network <NUM>. For example, RSU <NUM> can provide network <NUM> to facilitate a Wi-Fi communication scheme. Said differently, vehicle 902a to vehicle 902f and RSU <NUM> can be arranged to communicate in compliance with one or more standards, and for example, send messages via network <NUM> where network <NUM> operates based on one or more standards. For example, the communication schemes of the present disclosure, may be based on one or more communication standards, such as, for example, one of the <NUM> or <NUM> standards promulgated by the Institute of Electrical and Electronic Engineers (IEEE), cellular and long-term evolution (LTE) standards promulgated by the <NUM>rd Generation Partnership Project (3GPP). Additionally, the messages communicated via network <NUM> may be based on one or more standards, such as, SAE J2735, which defines BSM, among other messages.

During operation, vehicle 902a to vehicle 902f and/or RSU <NUM> can be arranged to transmit (e.g., via network <NUM>, or the like) information elements comprising indications of data related to travel on roadway <NUM> (e.g., vehicle platoon information, autonomous vehicle information roadway safety information, etc.). As a specific example, vehicle 902b can transmit a message via network <NUM> including indications of data (e.g., speed of vehicle 902b, trajectory of vehicle 902b, position of vehicle 902b, acceleration of vehicle 902b, etc.). Other ones of the vehicles (e.g., vehicle 902a, vehicle 902c, etc.) or RSU <NUM> can receive the message transmitted by vehicle 902b via network <NUM>. As another example, the devices (e.g., RSU <NUM>, vehicle 902a, etc.) can be arranged to send and receive basic safety messages (BSM), cooperative awareness messages (CAM), decentralized environmental notification messages (DENM), or the like via network <NUM>.

Claim 1:
A computing-implemented method for detection of timing attacks (<NUM>), the method comprising:
generating (<NUM>) a pseudo-random number, PRN; and
transmitting (<NUM>) a message during a protected transmission window of a data stream based on the PRN, a plurality of switching nodes communicating via the data stream, wherein a one of the plurality of switching nodes can independently generate the PRN,
wherein two communicating nodes in a time-sensitive network, TSN, comprising the plurality of switching nodes, a transmitter, and a receiver have a synchronized pseudo-random number generator, PRNG, wherein on the side of the transmitter, a number received from the PRNG determines a transmission delay of a message, and wherein on the receiver side, the same number obtained from the PRNG determines an expectation on the arrival time of the message.