Detecting clock synchronization attacks with pseudo-randomization of frames in the protected window
Systems and methods to detect attacks on the clocks of devices in time sensitive networks are described. Particularly, the disclosed systems and methods provide detection and mitigation of timing synchronization attacks based on pseudo-random numbers generated and used to select and authenticate timing of transmission of messages in protected transmission windows.
1 . A computing apparatus comprising:
a processor circuitry; and
a memory storing instructions that, when executed by the processor circuitry, causes the processor circuitry to:
receive a message during a protected transmission window of a data stream, wherein the protected transmission window is a communication window in which the message is transmitted;
generate a pseudo-random number (PRN); and
authenticate the message based on the PRN.
2 . The computing apparatus of claim 1 , the instructions when executed by the processor circuitry causes the processor circuitry to:
determine a delay time (DT) of a plurality of DTs of the message relative to the protected transmission window; and
determine whether the DT of the plurality of DTs is authentic based on the PRN.
3 . The computing apparatus of claim 1 , the instructions when executed by the processor circuitry causes the processor circuitry to:
identify a time buffer (TB) of a plurality of TBs of the message relative to the protected transmission window; and
determine whether the TB of the plurality of TBs is authentic based on the PRN.
4 . The computing apparatus of claim 1 , the instructions when executed by the processor circuitry causes the processor circuitry to:
generate a random sequence of bits based on the PRN; and
determine whether the message comprises the random sequence of bits.
5 . The computing apparatus of claim 1 , the instructions when executed by the processor circuitry causes the processor circuitry to determine whether a timing of the message transmission relative to the protected transmission window is authentic based on the PRN.
6 . The computing apparatus of claim 1 , the instructions when executed by the processor circuitry causes the processor circuitry to generate an alert of a possible timing synchronization attack based on a determination that a timing of the message transmission relative to the protected transmission window is not authentic.
7 . The computing apparatus of claim 1 , wherein the data stream is established in accordance with the Institute of Electrical and Electronics Engineers (IEEE) 802.1AS and/or 802.1Qbv standards.
8 . A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by circuitry of a computer, cause the computer to:
receive a message during a protected transmission window of a data stream, wherein the protected transmission window is a communication window in which the message is transmitted;
generate a pseudo-random number (PRN); and
authenticate the message based on the PRN.
9 . The non-transitory computer-readable storage medium of claim 8 , the instructions when executed by the circuitry of the computer cause the computer to:
determine a delay time (DT) of a plurality of DTs of the message relative to the protected transmission window; and
determine whether the DT of the plurality of DTs is authentic based on the PRN.
10 . The non-transitory computer-readable storage medium of claim 8 , the instructions when executed by the circuitry of the computer cause the computer to:
identify a time buffer (TB) of a plurality of TBs of the message relative to the protected transmission window; and
determine whether the TB of the plurality of TBs is authentic based on the PRN.
11 . The non-transitory computer-readable storage medium of claim 8 , the instructions when executed by the circuitry of the computer cause the computer to:
generate a random sequence of bits based on the PRN; and
determine whether the message comprises the random sequence of bits.
12 . The non-transitory computer-readable storage medium of claim 8 , the instructions when executed by the circuitry of the computer cause the computer to determine whether a timing of the message transmission relative to the protected transmission window is authentic based on the PRN.
13 . The non-transitory computer-readable storage medium of claim 8 , the instructions when executed by the circuitry of the computer cause the computer to generate an alert of a possible timing synchronization attack based on a determination that a timing of the message transmission relative to the protected transmission window is not authentic.
14 . The non-transitory computer-readable storage medium of claim 8 , wherein the data stream is established in accordance with the Institute of Electrical and Electronics Engineers (IEEE) 802.1AS and/or 802.1Qbv standards.
15 . A computing-implemented method, comprising:
receiving a message during a protected transmission window of a data stream, wherein the protected transmission window is a communication window in which the message is transmitted;
generating a pseudo-random number (PRN); and
authenticating the message based on the PRN.
16 . The computing-implemented method of claim 15 , authenticating the message based on the PRN comprising:
determining a delay time (DT) of a plurality of DTs of the message relative to the protected transmission window; and
determining whether the DT of the plurality of DTs is authentic based on the PRN.
17 . The computing-implemented method of claim 15 , authenticating the message based on the PRN comprising:
identifying a time buffer (TB) of a plurality of TBs of the message relative to the protected transmission window; and
determining whether the TB of the plurality of TBs is authentic based on the PRN.
18 . The computing-implemented method of claim 15 , authenticating the message based on the PRN comprising:
generating a random sequence of bits based on the PRN; and
determining whether the message comprises the random sequence of bits.
19 . The computing-implemented method of claim 15 , authenticating the message based on the PRN comprising:
determining whether the timing of the message transmission relative to the protected transmission window is authentic based on the PRN; and
generating an alert of a possible timing synchronization attack based on a determination that the timing of the message transmission relative to the protected transmission window is not authentic.
20 . The computing-implemented method of claim 15 , wherein the data stream is established in accordance with the Institute of Electrical and Electronics Engineers (IEEE) 802.1AS and/or 802.1Qbv standards.