Game theory applied to secure clock synchronization with IEEE 1588

Lisova, Elena; Uhlemann, Elisabeth; Steiner, Wilfried; Åkerberg, Johan; Björkman, Mats

doi:10.1109/ispcs.2016.7579509

Cited by 6 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A threshold can be derived for the LID attack by considering the Neyman-Pearson lemma under the assumption that two scenarios are possible, namely: H 1 -there is LID attack or H 0there is no attack, NA. Previously, we showed how the PDF of the offset measured in a node can be calculated for the considered types of delay attacks [9]. The detection coefficient was introduced to indicate the difference visible in the PDF when the network is under the attack and to show the level of adversary exposure.…”

Section: Thresholding Indicatorsmentioning

confidence: 99%

“…However, this solution requires changes to the standards. We have proposed to use distributed monitoring as a tool to detect that the network is under attack, and to prevent propagation of adversary influence by deploying relevant mitigation techniques [9]. This paper is a continuation of our work [9], where a game theory framework was proposed to investigate the interaction between a monitor and an adversary.…”

Section: Introductionmentioning

confidence: 99%

“…We have proposed to use distributed monitoring as a tool to detect that the network is under attack, and to prevent propagation of adversary influence by deploying relevant mitigation techniques [9]. This paper is a continuation of our work [9], where a game theory framework was proposed to investigate the interaction between a monitor and an adversary. The main focus of this paper is the delicate balance between the time needed for a monitor to detect an attack and the time needed for an adversary to reach its target; to keep the network unsynchronized sufficiently long to damage the application.…”

Section: Introductionmentioning

confidence: 99%

“…In Fig. 1, a delay attack is initiated at t dep , where two types of delays are presented: the solid teeth indicates a linearly increasing delay (LID), whereas the dotted teeth a constant delay (CD) [9]. In each RI there is an uncompensated error in the calculated offset that eventually brings the node into unsynchronized state.…”

Section: Introductionmentioning

confidence: 99%

“…As shown in Fig. 2, there are three possible states for the network, namely, normal (NS), quarantine (QS) and attack detected state (ADS) [9]. In NS, the monitor believes that there is no active adversary in the network and clock synchronization has not been broken.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Delay attack versus clock synchronization — A time chase

Lisova

Uhlemann

Åkerberg

et al. 2017

2017 IEEE International Conference on Industrial Technology (ICIT)

Self Cite

View full text Add to dashboard Cite

Clock synchronization is one of the most essential assets for distributed real-time systems, as sensing, control and actuation require synchronized communication to meet real-time deadlines. We propose a distributed monitoring method to detect if an adversary is interfering with the clock synchronization protocol. The monitor uses certain network indicators and a set of rules to decide about switching between Normal, Quarantine or Attack Detected states. Further, we propose a way to define thresholds for decision-making based on theoretical analysis of the indicator values influenced by an attack. In addition, we formulate the problem of adversary influence detection in the network as a detection theory problem and use it to derive an additional indicator for the network monitor. Finally, we analyze the time chase between the monitor and an adversary to investigate which factors influence the final outcome.

show abstract

Section: Thresholding Indicatorsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Delay attack versus clock synchronization — A time chase

Lisova

Uhlemann

Åkerberg

et al. 2017

2017 IEEE International Conference on Industrial Technology (ICIT)

Self Cite

View full text Add to dashboard Cite

show abstract

A Security Management Architecture for Time Synchronization Towards High Precision Networks

Zhang

et al. 2021

IEEE Access

View full text Add to dashboard Cite

Time synchronization is quickly becoming a fundamental prerequisite for a smart society. With the development of the fifth-generation (5G) network, time-sensitive networking (TSN), and the rise of highprecision networks, its accurate and reliable features have attracted an increasing amount of attention. As the most promising protocol with sub-microsecond accuracy, precision time protocol (PTP) has been widely used for network synchronization, and its proper operation and security are critical to the industries that build the infrastructure for a smart society. In order to provide synchronization security as a service, this paper presents a scheme based on software-defined networking (SDN) and network functions virtualization (NFV) principles for synchronization security. Security management is built as a virtual network function (VNF), and a mitigation mechanism is proposed to detect delay attacks and generate countermeasures. Finally, we investigate the impact of random delay attacks, constant delay attacks, and linear delay attacks and verify the performance of the proposed mitigation mechanism through experiments. The results show that the scheme is capable of detecting PTP delay attacks and mitigating their impact on time synchronization.INDEX TERMS Time synchronization, delay attacks, precision time protocol, software-defined networking, network functions virtualization, time-sensitive networking, high precision communication.

show abstract