Authenticating time sources using attestation-based methods
Systems, methods, and computer-readable media for authenticating time sources using attestation-based techniques include receiving, at a destination device, a time reference signal from a source device, the source and destination devices being network devices. The time reference signal can include a time synchronization signal or a time distribution signal. The destination device can obtain attestation information from one or more fields of the time reference signal and determine whether the source device is authentic and trustworthy based on the attestation information. The destination device can also determine reliability or freshness of the time reference signal based on the attestation information. The time reference signal can be based on a Network Time Protocol (NTP), a Precision Time Protocol (NTP), or other protocol. The attestation information can include Proof of Integrity based a Canary stamp, a hardware fingerprint, a Secure Unique Device Identification (SUDI) of the source device, or an attestation key.
1. A method comprising:
receiving, at a destination device, a time reference signal from a source device, the destination device and the source device being network devices configured to communicate in a network;
obtaining, by the destination device, attestation information from one or more fields of the time reference signal;
authenticating, by the destination device, an identify of the source device; and
verifying the trustworthiness of the time reference signal, from the time reference signal itself, based on one or more security measurements included in the attestation information as part of metadata signed by the source device.
2. The method of claim 1 , further comprising:
determining freshness of the time reference signal based on the attestation information.
3. The method of claim 1 , wherein the time reference signal comprises one or more of a time synchronization signal or a time distribution signal based on a Network Time Protocol (NTP) for time synchronization in the network, the one or more fields being included in one or more NTP messages.
4. The method of claim 3 , wherein the one or more NTP messages comprise one or more of an origin timestamp, receive timestamp, transmit timestamp, or destination timestamp, the one or more fields including one or more extension fields of a packet header of the one or more NTP messages.
5. The method of claim 1 , wherein the time reference signal comprises one or more of a time synchronization signal or a time distribution signal based on a Precision Time Protocol (PTP) for time synchronization in the network, the one or more fields being included in one or more PTP messages.
6. The method of claim 1 , wherein the time reference signal is based on a broadcast signal for time distribution or time synchronization in the network, the one or more fields being included in the broadcast signal.
7. The method of claim 1 , wherein the attestation information comprises Proof of Integrity based on one or more of a Canary stamp or a hardware fingerprint comprising Proof of Freshness of the time reference signal, a Secure Unique Device Identification (SUDI) of the source device, or an attestation key.
8. A system comprising:
one or more processors; and
a non-transitory computer-readable storage medium containing instructions which, when executed on the one or more processors, cause the one or more processors to perform operations including:
receiving, at a destination device, a time reference signal from a source device, the destination device and the source device being network devices configured to communicate in a network;
obtaining, by the destination device, attestation information from one or more fields of the time reference signal;
authenticating, by the destination device, an identify of the source device; and
verifying the trustworthiness of the time reference signal, from the time reference signal itself, based on one or more security measurements included in the attestation information as part of metadata signed by the source device.
9. The system of claim 8 , wherein the operations further comprise:
determining freshness of the time reference signal based on the attestation information.
10. The system of claim 8 , wherein the time reference signal comprises one or more of a time synchronization signal or a time distribution signal based on a Network Time Protocol (NTP) for time synchronization in the network, the one or more fields being included in one or more NTP messages.
11. The system of claim 10 , wherein the one or more NTP messages comprise one or more of an origin timestamp, receive timestamp, transmit timestamp, or destination timestamp, the one or more fields including one or more extension fields of a packet header of the one or more NTP messages.
12. The system of claim 8 , wherein the time reference signal comprises one or more of a time synchronization signal or a time distribution signal based on a Precision Time Protocol (PTP) for time synchronization in the network, the one or more fields being included in one or more PTP messages.
13. The system of claim 8 , wherein the time reference signal is based on a broadcast signal for time distribution or time synchronization in the network, the one or more fields being included in the broadcast signal.
14. The system of claim 8 , wherein the attestation information comprises Proof of Integrity based on one or more of a Canary stamp or a hardware fingerprint comprising Proof of Freshness of the time reference signal, a Secure Unique Device Identification (SUDI) of the source device, or an attestation key.
15. A non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to perform operations for controlling context-based access of data, the operations including:
receiving, at a destination device, a time reference signal from a source device, the destination device and the source device being network devices configured to communicate in a network;
obtaining, by the destination device, attestation information from one or more fields of the time reference signal;
authenticating, by the destination device, an identify of the source device; and
verifying the trustworthiness of the time reference signal, from the time reference signal itself, based on one or more security measurements included in the attestation information as part of metadata signed by the source device.
16. The non-transitory machine-readable storage medium of claim 15 , wherein the operations further comprise:
determining freshness of the time reference signal based on the attestation information.
17. The non-transitory machine-readable storage medium of claim 15 , wherein the time reference signal comprises one or more of a time synchronization signal or a time distribution signal based on a Network Time Protocol (NTP) for time synchronization in the network, the one or more fields being included in one or more NTP messages.
18. The non-transitory machine-readable storage medium of claim 17 , wherein the one or more NTP messages comprise one or more of an origin timestamp, receive timestamp, transmit timestamp, or destination timestamp, the one or more fields including one or more extension fields of a packet header of the one or more NTP messages.
19. The non-transitory machine-readable storage medium of claim 15 , wherein the time reference signal comprises one or more of a time synchronization signal or a time distribution signal based on a Precision Time Protocol (PTP) for time synchronization in the network, the one or more fields being included in one or more PTP messages.
20. The non-transitory machine-readable storage medium of claim 15 , wherein the attestation information comprises Proof of Integrity based on one or more of a Canary stamp or a hardware fingerprint comprising Proof of Freshness of the time reference signal, a Secure Unique Device Identification (SUDI) of the source device, or an attestation key.