This paper establishes a fundamental theory of secure clock synchronization. Accurate clock synchronization is the backbone of systems managing power distribution, financial transactions, telecommunication operations, database services, etc. Some clock synchronization (time transfer) systems, such as the global navigation satellite systems, are based on one-way communication from a master to a slave clock. Others, such as the network transport protocol, and the IEEE 1588 precision time protocol (PTP), involve two-way communication between the master and slave. This paper shows that all one-way time transfer protocols are vulnerable to replay attacks that can potentially compromise timing information. A set of conditions for secure two-way clock synchronization is proposed and proved to be necessary and sufficient. It is shown that IEEE 1588 PTP, although a two-way synchronization protocol, is not compliant with these conditions, and is therefore insecure. Requirements for secure IEEE 1588 PTP are proposed, and a second example protocol is offered to illustrate the range of compliant systems.
@cite_5 propose measuring the propagation delays during initialization of clock synchronization and monitoring the propagation delays during the normal operation of the time synchronization protocol. However, @cite_5 does not prove that such a defense would be sufficient to prevent the delay attacks.
@cite_5
2101764391 2130677190 1970745521 2143229717 2617639307 2118537895 2146468366 2035918100 2153168129 2012845506 1982852503 2137536023 2234682834 2059435667 2140560546 2114925953 2115885621 2058455332 2114658430 2112612200
Recently, a few efficient timing synchronization protocols for wireless sensor networks (WSNs) have been proposed with the goal of maximizing the accuracy and minimizing the power utilization. This paper proposes novel clock skew estimators assuming different delay environments to achieve energy-efficient network-wide synchronization for WSNs. The proposed clock skew correction mechanism significantly increases the re-synchronization period, which is a critical factor in reducing the overall power consumption. The proposed synchronization scheme can be applied to the conventional protocols without additional overheads. Moreover, this paper derives the Cramer-Rao lower bounds and the maximum likelihood estimators under different delay models and assumptions. These analytical metrics serves as good benchmarks for the thus far reported experimental results In this paper specific variants of delay attacks are examined. First, the Network Time Protocol is regarded. Second, delay attacks and implications on the time synchronization of the Precise Time Protocol are described. In particular, consequences for the offset calculation O prox are regarded. At the end of the paper possible countermeasurements are described. We initiate a study of bounded clock synchronization under a more severe fault model than that proposed by Lamport and Melliar-Smith [1985]. Realistic aspects of the problem of synchronizing clocks in the presence of faults are considered. One aspect is that clock synchronization is an on-going task, thus the assumption that some of the processors never fail is too optimistic. To cope with this reality, we suggest self-stabilizing protocols that stabilize in any (long enough) period in which less than a third of the processors are faulty. Another aspect is that the clock value of each processor is bounded. A single transient fault may cause the clock to reach the upper bound. Therefore, we suggest a bounded clock that wraps around when appropriate.We present two randomized self-stabilizing protocols for synchronizing bounded clocks in the presence of Byzantine processor failures. The first protocol assumes that processors have a common pulse, while the second protocol does not. A new type of distributed counter based on the Chinese remainder theorem is used as part of the first protocol. Recent advances in miniaturization and low-cost, low-power design have led to active research in large-scale networks of small, wireless, low-power sensors and actuators. Time synchronization is critical in sensor networks for diverse purposes including sensor data fusion, coordinated actuation, and power-efficient duty cycling. Though the clock accuracy and precision requirements are often stricter than in traditional distributed systems, strict energy constraints limit the resources available to meet these goals.We present Reference-Broadcast Synchronization, a scheme in which nodes send reference beacons to their neighbors using physical-layer broadcasts. A reference broadcast does not contain an explicit timestamp; instead, receivers use its arrival time as a point of reference for comparing their clocks. In this paper, we use measurements from two wireless implementations to show that removing the sender's nondeterminism from the critical path in this way produces high-precision clock agreement (1.85 ± 1.28μsec, using off-the-shelf 802.11 wireless Ethernet), while using minimal energy. We also describe a novel algorithm that uses this same broadcast property to federate clocks across broadcast domains with a slow decay in precision (3.68 ± 2.57μsec after 4 hops). RBS can be used without external references, forming a precise relative timescale, or can maintain microsecond-level synchronization to an external timescale such as UTC. We show a significant improvement over the Network Time Protocol (NTP) under similar conditions. Due to the increasing dependency of critical infrastructure on synchronized clocks, network time synchronization protocols have become an attractive target for attackers. We identify data origin authentication as the key security objective and suggest to employ recently proposed high-performance digital signature schemes (Ed25519 and MQQ-SIG)) as foundation of a novel set of security measures to secure multicast time synchronization. We conduct experiments to verify the computational and communication efficiency for using these signatures in the standard time synchronization protocols NTP and PTP. We propose additional security measures to prevent replay attacks and to mitigate delay attacks. Our proposed solutions cover 1-step mode for NTP and PTP and we extend our security measures specifically to 2-step mode (PTP) and show that they have no impact on time synchronization's precision. In this paper, we study the global clock synchronization problem for wireless sensor networks. Based on belief propagation, we propose a fully distributed algorithm which has low overhead and can achieve scalable synchronization. It is also shown analytically that the proposed algorithm always converges for strongly connected networks. Simulation results show that the proposed algorithm achieves better accuracy than consensus algorithms. Furthermore, the belief obtained at each sensor provides an accurate prediction on the algorithm's performance in terms of MSE. We study contention resolution in a multiple-access channel such as the Ethernet channel. In the model that we consider, n users generate messages for the channel according to a probability distribution. Raghavan and Upfal have given a protocol in which the expected delay (time to get serviced) of every message is O(log n ) when messages are generated according to a Bernoulli distribution with generation rate up to about 1 10. Our main results are the following protocols: (a) one in which the expected average message delay is O(1) when messages are generated according to a Bernoulli distribution with a generation rate smaller than 1 e , and (b) one in which the expected delay of any message is O(1) for an analogous model in which users are synchronized (i.e., they agree about the time), there are potentially an infinite number of users, and messages are generated according to a Poisson distribution with generation rate up to 1 e . (Each message constitutes a new user.) To achieve (a), we first show how to simulate (b) using n synchronized users, and then show how to build the synchronization into the protocol. The problem of synchronizing clocks of processes in a fully connected network is considered. It is proved that, even if the clocks all run at the same rate as real time and there are no failures, an uncertainty of e in the message delivery time makes it impossible to synchronize the clocks of n processes any more closely than e(1−1 n ). A simple algorithm is given that achieves this bound. In this paper, we study the wireless synchronization problem which requires devices activated at different times on a congested single-hop radio network to synchronize their round numbering. We assume a collection of n synchronous devices with access to a shared band of the radio spectrum, divided into F narrowband frequencies. We assume that the communication medium suffers from unpredictable, perhaps even malicious interference, which we model by an adversary that can disrupt up to t frequencies per round. Devices begin executing in different rounds and the exact number of participants is not known in advance. We first prove a lower bound, demonstrating that at least Ω(log2n (F-t)loglogn + Ft F-t logn) rounds are needed to synchronize. We then describe two algorithms. The first algorithm almost matches the lower bound, yielding a running time of O(F F - t log2n + Ft F - t logn) rounds. The second algorithm is adaptive, terminating in O(t′ log3n) rounds in good executions, that is, when the devices begin executing at the same time, and there are never more than t′ frequencies disrupted in any given round, for some t′ With increasing prevalence of mobile wireless devices with WiFi and Bluetooth capability, new applications that can make use of limited contact opportunities when the devices are physically close are emerging. Proximity-based social networking, and location specific dissemination of advertisements and events, are some such applications. Discovering such services is a challenging problem due to energy budget limitations, user mobility, and nonuniformity and the time-varying nature of energy budgets across users. It is important to rapidly discover such mobile services to make use of limited contact opportunities. To support such applications, we seek to design a localized discovery scheme that can minimize the expected contact latency between mobile phones with limited energy budgets. All the existing neighbor discovery schemes assume lack of any time synchronization. However, in practice sufficiently accurate time synchronization can be achieved with existing time synchronization techniques. We propose Recursive Binary Time Partitioning (RBTP), a scheme that determines how the devices should wake up and sleep to achieve minimal contact latency with other nearby devices. RBTP achieves provable performance bound and outperforms state-of-the-art asynchronous protocols for smartphones. When compared with the optimum scheme, the contact latency is shown to be within a factor of (9 8) in the expected case and 2 in the worst case. We examine the problem of determining the relative time delay between IMU and camera data streams. The primary difficulty is that the correspondences between measurements from the sensors are not initially known, and hence, the time delay cannot be computed directly. We instead formulate time delay calibration as a registration problem, and introduce a calibration algorithm that operates by aligning curves in a three-dimensional orientation space. Results from simulation studies and from experiments with real hardware demonstrate that the delay can be accurately calibrated. cessing, integration, filtering, etc. If the delays are incorrectly estimated, then any fusion algorithm will produce suboptimal results. At best, this will degrade the accuracy of the output—in the worst case, it may lead to significant navigation errors. In this paper, we examine the problem of determining the relative time delay between inertial and visual sensor measure- ments. It may be possible in some cases to directly synchronize the sensors using a hardware timing signal. Our interest here is primarily in low-cost "black box" IMUs and cameras, for which direct time synchronization is not possible. We assume that there is a constant but unknown time shift (delay) when the different sensor measurements arrive and are timestamped at a centralized receiver. In this paper, we describe a global distributed solution that enables the simultaneous performance of time synchronization and positioning in ultra-wideband (UWB) ad hoc networks. On the one hand, the proposed synchronization scheme basically relies on cooperative two-way-ranging time-of-arrival transactions and a diffusion algorithm that ensures the convergence of clock parameters to average reference values in each node. Although the described solution is generic at first sight, its sensitivity to time-of-arrival accuracy imposes the choice of an impulse-radio ultra-wideband physical layer in the very context. On the other hand, a distributed algorithm coupled with this synchronization scheme mitigates the impact of non-line-of-sight ranging errors on positioning accuracy without any additional protocol hook. More particularly, the realistic UWB ranging error models we use take into account UWB channel effects, as well as detection noises and relative clock drifts. Then, it is demonstrated that a cooperative and distributed maximization of the log-likelihood of range estimates can reduce the uncertainty on estimated positions in comparison with classical distributed weighted least squares approaches. Finally, the proposed distributed maximum log-likelihood algorithm proves to preserve a reasonable level of complexity in each node by approximating asynchronously the positive gradient direction of the log-likelihood function. For both distributed synchronization and positioning algorithms, simulation results are provided to illustrate the relevance of such a solution. The convergence and precision of synchronization algorithms based on the theory of pulse-coupled oscillators is evaluated on programmable radios. Measurements in different wireless topologies show that such algorithms reach precisions in the low microsecond range. Based on the observation that phase rate deviation among radios is a limiting factor for the achievable precision, we propose a distributed algorithm for automatic phase rate equalization and show by experiments that an improved precision below one microsecond is possible in the given setups. It is also experimentally demonstrated that the stochastic nature of coupling is a key ingredient for convergence to synchrony. The proposed scheme can be applied in wireless systems for distributed synchronization of transmission slots, or sleep cycles. Abstract This note considers the problem of synchronizing a network of digital clocks: the clocks all run at the same rate, however, an initial state of the network may place the clocks in arbitrary phases. The problem is to devise a protocol to advance or retard clocks so that eventually all clocks are in phase. The solutions presented in this note are protocols in which all processes are identical and use a constant amount of space per process. One solution is a deterministic protocol for a tree network; another solution is a probabilistic protocol for a network of arbitrary topology. We consider streaming over a blockage channel with long feedback delay, as arises in, e.g., real-time satellite communication from a comm-on-the-move (COTM) terminal. For this problem, we introduce a definition of delay that captures the real-time nature of the problem, which we show grows at least as fast as O(log(k)) for memoryless channels, where k corresponds to the number of packets in the transmission. Moreover, a tradeoff exists between this delay and a natural notion of throughput we introduce to capture the bandwidth requirements of the communication. We develop and analyze an efficient "multi-burst" transmission (MBT) protocol for achieving good delay-throughput tradeoffs within this framework, which we show to be robust and near-optimal within the class of retransmission protocols with fixed schedules. The MBT protocol can be augmented with coding for additional performance gains. Simulations validate the new protocols, including when peak bandwidth and delay constraints are imposed. The power of two well-known consistency conditions for shared-memory multiprocessors, sequential consistency and linearizability , is compared. The cost measure studied is the worst-case response time in distributed implementations of virtual shared memory supporting one of the two conditions. Three types of shared-memory objects are considered: read write objects, FIFO queues, and stacks. If clocks are only approximately synchronized (or do not exist), then for all three object types it is shown that linearizability is more expensive than sequential consistency. We show that, for all three data types, the worst-case response time is very sensitive to the assumptions that are made about the timing information available to the system. Under the strong assumption that processes have perfectly synchronized clocks, it is shown that sequential consistency and linearizability are equally costly. We present upper bounds for linearizability and matching lower bounds for sequential consistency. The upper bounds are shown by presenting algorithms that use atomic broadcast in a modular fashion. The lower-bound proofs for the approximate case use the technique of “shifting,” first introduced for studying the clock synchronization problem. We introduce the continuous time asynchronous channel as a model for time jitter in a communication system with no common clock between the transmitter and the receiver. We have obtained a simple characterization for an optimal zero-error self-synchronizable code for the asynchronous channel. The capacity of this channel is determined by both a combinatorial approach and a probabilistic approach. Our results unveil the somewhat surprising fact that it is not necessary for the receiver clock to resynchronize with the transmitter clock within a fixed maximum time in order to achieve reliable communication. This means that no upper limit should be imposed on the run lengths of the self-synchronization code as in the case of run-length limited (RLL) codes which are commonly used in magnetic recording. Solutions for time synchronization based on coupled oscillators operate in a self-organizing and adaptive manner and can be applied to various types of dynamic networks. The basic idea was inspired by swarms of fireflies, whose flashing dynamics shows an emergent behavior. This article introduces such a synchronization technique whose main components are “inhibitory coupling” and “self-adjustment.” Based on this new technique, a number of contributions are made. First, we prove that inhibitory coupling can lead to perfect synchrony independent of initial conditions for delay-free environments and homogeneous oscillators. Second, relaxing the assumptions to systems with delays and different phase rates, we prove that such systems synchronize up to a certain precision bound. We derive this bound assuming inhomogeneous delays and show by simulations that it gives a good estimate in strongly-coupled systems. Third, we show that inhibitory coupling with self-adjustment quickly leads to synchrony with a precision comparable to that of excitatory coupling. Fourth, we analyze the robustness against faulty members performing incorrect coupling. While the specific precision-loss encountered by such disturbances depends on system parameters, the system always regains synchrony for the investigated scenarios. Modern shared-memory multiprocessors use complex memory system implementations that include a variety of non-trivial and interacting optimizations. More time is spent in verifying the correctness of such implementations than in designing the system. In particular, large-scale Distributed Shared Memory (DSM) systems usually rely on a directory cache-coherence protocol to provide the illusion of a sequentially consistent shar ed address space. Verifying that such a distributed protocol satisfies sequential consistency is a difficult task. Current formal protocol verification techniques [18] complement simulation, but ar e some what nonintuitive to system designers and verifiers, and they do not scale well to practical systems. In this paper, we examine a new reasoning technique that is precise and (we find) intuitive. Our technique is based on Lamport’ s logical clocks, which were originally used in distributed systems. We make modest extensions to Lamport’ s logical clocking scheme to assign timestamps to r elevant protocol events to construct a total ordering of such events. Such total orderings can be used to verify that the requirements of a particular memory consistency model have been satisfied. We apply Lamport clocks to prove that a non-trivial directory protocol implements sequential consistency. T o do this, we describe an SGI Origin 2000-like protocol [12] in detail, provide a timestamping scheme that totally orders all protocol events, and then prove sequential consistency (i.e., a load always returns the value of the “last” stor e to the same address in timestamp order). We propose two protocols that provide scalable causal consistency for both partitioned and replicated data stores using dependency matrices (DM) and physical clocks. The DM protocol supports basic read and update operations and uses two-dimensional dependency matrices to track dependencies in a client session. It utilizes the transitivity of causality and sparse matrix encoding to keep dependency metadata small and bounded. The DM-Clock protocol extends the DM protocol to support read-only transactions using loosely synchronized physical clocks. We implement the two protocols in Orbe, a distributed key-value store, and evaluate them experimentally. Orbe scales out well, incurs relatively small overhead over an eventually consistent key-value store, and outperforms an existing system that uses explicit dependency tracking to provide scalable causal consistency.