Method to eliminate clock synchronization from undesired clock sources
In one embodiment, methods for monitoring devices within a network by a controller are described. The method may include receiving a first request from a first device to authenticate a role of the first device as a grandmaster in a precision time protocol (PTP). Additionally, the method may include granting the first request designating the role of the first device as the grandmaster. The method may further include receiving a second request from a second device to authenticate that a clock announce message is from an authorized grandmaster. Additionally, the method may include determining whether the first device is authorized to send the clock announce message to the second device and, based on the determining, sending a message granting or denying permission for the first device to sync with the second device.
1. A method performed at least partly by a controller that monitors devices within a network, the method comprising:
receiving a first request from a first device to authenticate a role of the first device as a grandmaster in a precision time protocol (PTP);
granting the first request designating the role of the first device as the grandmaster;
receiving a second request from a second device to authenticate that a clock announce message from the first device is from an authorized grandmaster;
determining whether the first device is authorized to send the clock announce message to the second device; and
in response to determining the first device is authorized to send the clock announce message, sending to the second device a message indicating that the first device is authorized as the grandmaster and granting permission for the second device to sync with the first device; or
in response to determining that the first device is not authorized to perform the clock announce message, sending to the second device, a message indicating that the first device is not authorized as the grandmaster and denying permission for the second device to sync with the first device.
2. The method of claim 1 , wherein the first request comprises a clock ID of the first device.
3. The method of claim 2 , wherein granting the first request designating the role of the first device as the grandmaster further comprises:
determining that the clock ID of the first device is included in a pool of permitted device IDs; and
authenticating that the role of the grandmaster is a permitted role associated with the clock ID of the first device.
4. The method of claim 1 , wherein granting the first request designating the role of the first device as the grandmaster further comprises:
analyzing clock quality attributes associated with the first device, the clock quality attributes including at least one of a clock accuracy or a clock class; and
determining that at least one of the clock accuracy or the clock class satisfies a clock quality threshold.
5. The method of claim 1 , further comprising:
receiving a third request from the second device to authenticate a role of the second device as a slave in the PTP; and
granting the third request designating the role of the second device as the slave.
6. The method of claim 1 , wherein granting the first request further comprises:
providing the first device with a key in response to authenticating the role of the first device as the grandmaster, the key comprising a private key.
7. The method of claim 6 , wherein the second request from the second device includes the key.
8. The method of claim 1 , further comprising:
receiving, from the second device and after a threshold period of time has elapsed, an authentication and authorization request to validate authenticity and authorization of the first device to act as the grandmaster;
determining whether the first device is authenticated and authorized to act as the grandmaster; and
in response to determining the first device is authenticated to act as the grandmaster, sending to the second device a second message indicating that the first device is authorized to act as the grandmaster and permitting the second device to continue syncing with the first device; or
in response to determining that the first device is not authenticated or not authorized to act as the grandmaster, sending to the second device, a second message indicating that the first device is not authorized and denying permission for the second device to continue syncing with the first device.
9. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a first request from a first device to authenticate a role of the first device as a grandmaster in a PTP;
granting the first request designating the role of the first device as the grandmaster;
receiving a second request from a second device to authenticate that a clock announce message from the first device is from an authorized grandmaster;
determining whether the first device is authorized to send the clock announce message to the second device; and
in response to determining the first device is authorized to send the clock announce message, sending to the second device a message indicating that the first device is authorized as the grandmaster and granting permission for the second device to sync with the first device; or
in response to determining that the first device is not authorized to perform the clock announce message, sending to the second device, a message indicating that the first device is not authorized as the grandmaster and denying permission for the second device to sync with the first device.
10. The system of claim 9 , wherein the first request comprises a clock ID of the first device.
11. The system of claim 10 , wherein granting the first request designating the role of the first device as the grandmaster further comprises:
determining that the clock ID of the first device is included in a pool of permitted device IDs; and
authenticating that the role of grandmaster is a permitted role associated with the clock ID of the first device.
12. The system of claim 9 , wherein granting the first request designating the role of the first device as the grandmaster further comprises:
analyzing clock quality attributes associated with the first device, the clock quality attributes including at least one of a clock accuracy or a clock class; and
determining that at least one of the clock accuracy or the clock class satisfies a clock quality threshold.
13. The system of claim 9 , the operations further comprising:
receiving a third request from the second device to authenticate a role of the second device as a slave in the PTP; and
granting the third request designating the role of the second device as the slave.
14. The system of claim 9 , wherein granting the first request further comprises:
providing the first device with a key in response to authenticating the role of the first device as the grandmaster, the key comprising a private key.
15. The system of claim 14 , wherein the second request from the second device includes the key.
16. The system of claim 9 , further comprising:
receiving, from the second device and after a threshold period of time has elapsed, an authentication and authorization request to validate authenticity and authorization of the first device to act as the grandmaster;
determining whether the first device is authenticated and authorized to act as the grandmaster; and
in response to determining the first device is authenticated to act as the grandmaster, sending to the second device a second message indicating that the first device is authorized to act as the grandmaster and permitting the second device to continue syncing with the first device; or
in response to determining that the first device is not authenticated or not authorized to act as the grandmaster, sending to the second device, a second message indicating that the first device is not authorized and denying permission for the second device to continue syncing with the first device.
17. A network device comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
sending an authentication request to a controller of a network to designate a role of the network device as a grandmaster in a precision time protocol (PTP);
receiving a grant of authentication from the controller designating the role of the network device as the grandmaster, wherein the grant of authentication comprises a private key;
sending a secured clock announce message to a second device within the network; and
performing a best master clock algorithm (BMCA) with the second device to synchronize a clock of the second device with a clock of the network device.
18. The network device of claim 17 , wherein the secured clock announce message comprises a tag-length-value (TLV), the TLV comprising a proof of integrity that the network device is authenticated to act as the grandmaster.
19. The network device of claim 18 , wherein the proof of integrity comprises a signature encrypted using the private key.
20. The network device of claim 17 , wherein the secured clock announce message comprises the private key.