Precision time protocol attack strategies and their resistance to existing security extensions

Cybersecurity - Tập 4 Số 1 - 2021
Waleed Alghamdi1, Michael Schukat1
1School of Computer Science, National University of Ireland, Galway, Ireland

Tóm tắt

AbstractThe IEEE 1588 precision time protocol (PTP) is very important for many industrial sectors and applications that require time synchronization accuracy between computers down to microsecond and even nanosecond levels. Nevertheless, PTP and its underlying network infrastructure are vulnerable to cyber-attacks, which can stealthily reduce the time synchronization accuracy to unacceptable and even damage-causing levels for individual clocks or an entire network, leading to financial loss or even physical destruction. Existing security protocol extensions only partially address this problem. This paper provides a comprehensive analysis of strategies for advanced persistent threats to PTP infrastructure, possible attacker locations, and the impact on clock and network synchronization in the presence of security protocol extensions, infrastructure redundancy, and protocol redundancy. It distinguishes between attack strategies and attacker types as described in RFC7384, but further distinguishes between the spoofing and time source attack, the simple internal attack, and the advanced internal attack. Some experiments were conducted to demonstrate the impact of PTP attacks. Our analysis shows that a sophisticated attacker has a range of methodologies to compromise a PTP network. Moreover, all PTP infrastructure components can host an attacker, making the comprehensive protection of a PTP network against a malware infiltration, as for example exercised by Stuxnet, a very tedious task.

Từ khóa


Tài liệu tham khảo

Alghamdi W, Schukat M (2017) Advanced methodologies to deter internal attacks in PTP time synchronization networks. In: 28th Irish signals and systems conference (ISSC), Killarney, 20-21 June 2017. pp 1-6. IEEE

Baize E (2012) Developing secure products in the age of advanced persistent threats. IEEE Sec & Priv 10:88–92. https://doi.org/10.1109/MSP.2012.65

Chen D (2013) Secure 1588 in HeNB / Femtocell application. Paper presented at the Time & Sync in Telecoms, Lisbon

Chen T, Abu-Nimeh S (2011) Lessons from stuxnet. Comp 44:91–93

Cho DX, Nam HH (2019) A method of monitoring and detecting APT attacks based on unknown domains. Proc Comp Sci 150:316–323

Dadheech K, Choudhary A, Bhatia G (2018, 2018) De-militarized zone: a next level to network security. In: Second international conference on inventive communication and computational technologies (ICICCT), Coimbatore, pp 595–600

Dalmas M, Rachadel H, Silvano G, Dutra C (2015, 2015) Improving PTP robustness to the byzantine failure. In: IEEE international symposium on precision clock synchronization for measurement, control, and communication (ISPCS), Beijing, pp 111–114

DeCusatis C, Lynch RM, Kluge W, Houston J, Wojciak P, Guendert S (2019) Impact of Cyberattacks on precision time protocol. IEEE Trans Inst Meas 69:2172–2181. https://doi.org/10.1109/TIM.2019.2918597

Donoghue KO, Sibold D, Fries S (2017) New security mechanisms for network time synchronization protocols. In: IEEE international symposium on precision clock synchronization for measurement, control, and communication (ISPCS), California, pp 1–6

Estrela PV, Neusüß S, Owczarek W (2014, 2014) Using a multi-source NTP watchdog to increase the robustness of PTPv2 in financial industry networks. In: Precision clock synchronization for measurement, control, and communication (ISPCS), IEEE international symposium on, Austin. IEEE, pp 87–92

Garner GM (2008) IEEE 1588 Version 2, vol 8. ISPCS, Ann Arbor, pp 1–89

IEEE Standard for a Precision Clock Synchronization Protocol for Networked Measurement and Control Systems (2008) IEEE Std 1588–2008 (Revision of IEEE Std 1588–2002), pp 1–269. https://doi.org/10.1109/IEEESTD.2008.4579760

IEEE Standard for a Precision Clock Synchronization Protocol for Networked Measurement and Control Systems (2020) IEEE Std 1588–2019 (Revision ofIEEE Std 1588–2008), pp 1–499

IEEE Standard for Local and Metropolitan Area Networks: Media Access Control (MAC) Security (2006) IEEE Std 802.1AE-2006, pp 1–150. https://doi.org/10.1109/IEEESTD.2006.245590

Itkin E, Wool A (2020) A security analysis and revised security extension for the precision time protocol. IEEE Trans Dep Sec Com 17:22–34. https://doi.org/10.1109/TDSC.2017.2748583

Knapp ED, Langill JT (2015) Industrial network security: securing critical infrastructure networks for smart grid, SCADA, and other industrial control systems

Koskiahde T, Kujala J (2016) PTP monitoring in redundant network. In: IEEE international symposium on precision clock synchronization for measurement, control, and communication (ISPCS), Stockholm, pp 1–5

Langner R (2011) Stuxnet: dissecting a cyberwarfare weapon. IEEE Sec Priv 9:49–51

Mills DL (1991) Internet time synchronization: the network time protocol. IEEE Trans Comm 39:1482–1493

Mizrahi T (2011) Time synchronization security using IPsec and MACsec. In: Proceedings of the International IEEE Symposium on Precision Clock Synchronization for Measurement Control and Communication, Munich, pp 38–43

Mizrahi T (2014) Security requirements of time protocols in packet switched networks. In: RFC 7384 https://tools.ietf.org/html/rfc7384

Moussa B, Kassouf M, Hadjidj R, Debbabi M, Assi C (2020) An extension to the precision time protocol (PTP) to enable the detection of cyber attacks. IEEE Trans Ind Info 16:18–27. https://doi.org/10.1109/TII.2019.2943913

Neyer J, Gassner L, Marinescu C (2019) Redundant schemes or how to counter the delay attack on time synchronization protocols. In: IEEE international symposium on precision clock synchronization for measurement, control, and communication (ISPCS), Portland, pp 1–6

Önal C, Kirrmann H (2012) Security improvements for IEEE 1588 annex K: implementation and comparison of authentication codes. In: International IEEE symposium on precision clock synchronization for measurement control and communication (ISPCS). IEEE, San Francisco, pp 1–6

Pathan Y, Dalvi A, Pillai A, Patil D, Reed D (2014) Analysis of selective packet delay attack on IEEE 1588 precision time protocol. Technical Report, University of Colorado at Boulder

Quintero-Bonilla S, Martín del Rey A (2020) A new proposal on the advanced persistent threat: a survey. App Scie 10:3874

Shannon J (2013) Improved techniques for time synchronization over WiFi and wireless sensor networks. Dissertation, National University of Ireland, Galway

Shannon J, Melvin H, Ruzzelli AG (2012) Dynamic flooding time synchronization protocol for WSNs. In: IEEE global communications conference (GLOBECOM). IEEE, Anaheim, pp 365–371

Shereen E, Bitard F, Dán G, Sel T, Fries S (2019) Next steps in security for time synchronization: experiences from implementing IEEE 1588 v2.1. In: IEEE international symposium on precision clock synchronization for measurement, control, and communication (ISPCS), Portland, pp 1–6

Shpiner A, Revah Y, Mizrahi T (2013) Multi-path Time Protocols. In: IEEE International Symposium on Precision Clock Synchronization for Measurement, Control and Communication (ISPCS) Proceedings, Lemgo, pp 1–6

Stallings W (2006) Cryptography and network security: principles and practices. New Jersey: Pearson Education India

Vacca JR (2017) Computer and information security handbook. San Francisco: Morgan Kaufmann

Thông tin
Thông tin xuất bản

Cybersecurity

Tập 4 Số 1

Thông tin tác giả