Time recovery from attacks on delayed authentication

Patent metadata

Field	Value
Publication number	US-12395487-B2
Application number	US-202318373160-A
Country	US
Kind code	B2
Filing date	Sep 26, 2023
Priority date	Sep 26, 2023
Publication date	Aug 19, 2025
Grant date	Aug 19, 2025

Abstract

Techniques to perform time recovery from attacks on delayed authentication in a time synchronized network are described. One embodiment comprises a method for decoding time information and a message authentication code (MAC) from a time message, the time information to synchronize a local clock for a device to a network time of a time synchronized network (TSN), and the MAC to authenticate the time message, determining whether the time message is authentic using the MAC, discarding the time information when the time message is not authentic, performing a bounded search to identify authentic time information using the MAC, and passing the authentic time information to a clock manager to synchronize the local clock to the network time of the TSN when the authentic time information is identified. Other embodiments are described and claimed.

First claim

What is claimed is:

1. A method, comprising:
decoding time information and a message authentication code (MAC) from a time message, the time information to synchronize a local clock for a device to a network time of a time synchronized network (TSN), and the MAC to authenticate the time message;
determining whether the time message is authentic using the MAC;
discarding the time information when the time message is not authentic;
performing a bounded search to identify authentic time information using the MAC; and
passing the authentic time information to a clock manager to synchronize the local clock to the network time of the TSN when the authentic time information is identified.

2. The method of claim 1 , comprising performing the bounded search within a defined search range represented by a number of bits of an information field of the time message used to carry the time information.

3. The method of claim 1 , comprising receiving the time message from a clock leader in the TSN, wherein the time information represents a reference time from the clock leader, the reference time to comprise an origin time for the time message.

4. The method of claim 1 , comprising:
receiving a security message associated with the time message; and
decoding a security key for the MAC of the time message from the security message.

5. The method of claim 1 , comprising:
receiving the MAC, a security key for the MAC, and the time information as input to a hash-based MAC (HMAC) cryptographic algorithm used to generate the MAC;
calculating a second MAC using the HMAC cryptographic algorithm;
determining the time message is authentic when the MAC matches the second MAC; and
determining the time message is not authentic when the MAC does not match the second MAC.

6. The method of claim 1 , comprising:
extracting a base time and a suffix from a last valid time update to the local clock;
identifying a search range defined by a number of bits representing the suffix;
modifying a value for one or more bits in the suffix;
determining whether a combination of the base time and the modified suffix is authentic using the MAC and a security key for the MAC; and
identifying the combination of the base time and the modified suffix as the authentic time information when the combination is authentic.

7. The method of claim 1 , comprising terminating the bounded search to identify the authentic time information using the MAC when the authentic time information is identified or a timer for the search reaches an upper boundary of a defined time period.

8. The method of claim 1 , comprising performing the bounded search to identify the authentic time information using parallel processing operations to decrease a search time to within a single synchronization cycle.

9. A computing apparatus comprising:
a processing circuitry; and
a memory storing instructions that, when executed by the processing circuitry, cause the processing circuitry to:
decode time information and a message authentication code (MAC) from a time message, the time information to synchronize a local clock for a device to a network time of a time synchronized network (TSN), and the MAC to authenticate the time message;
determine whether the time message is authentic using the MAC;
discard the time information when the time message is not authentic;
perform a bounded search to identify authentic time information using the MAC; and
pass the authentic time information to a clock manager to synchronize the local clock to the network time of the TSN when the authentic time information is identified.

10. The computing apparatus of claim 9 , the processing circuitry to perform the bounded search within a defined search range represented by a number of bits of an information field of the time message used to carry the time information.

11. The computing apparatus of claim 9 , the processing circuitry to receive the time message from a clock leader in the TSN, wherein the time information represents a reference time from the clock leader, the reference time to comprise an origin time for the time message.

12. The computing apparatus of claim 9 , the processing circuitry to:
receive a security message associated with the time message; and
decode a security key for the MAC of the time message from the security message.

13. The computing apparatus of claim 9 , the processing circuitry to:
receive the MAC, a security key for the MAC, and the time information as input to a hash-based MAC (HMAC) cryptographic algorithm used to generate the MAC;
calculate a second MAC using the HMAC cryptographic algorithm;
determine the time message is authentic when the MAC matches the second MAC; and
determine the time message is not authentic when the MAC does not match the second MAC.

14. The computing apparatus of claim 9 , the processing circuitry to:
extract a base time and a suffix from a last valid time update to the local clock;
identify a search range defined by a number of bits representing the suffix;
modify a value for one or more bits in the suffix;
determine whether a combination of the base time and the modified suffix is authentic using the MAC and a security key for the MAC; and
identify the combination of the base time and the modified suffix as the authentic time information when the combination is authentic.

15. A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a processing circuitry, cause the processing circuitry to:
decode time information and a message authentication code (MAC) from a time message, the time information to synchronize a local clock for a device to a network time of a time synchronized network (TSN), and the MAC to authenticate the time message;
determine whether the time message is authentic using the MAC;
discard the time information when the time message is not authentic;
perform a bounded search to identify authentic time information using the MAC; and
pass the authentic time information to a clock manager to synchronize the local clock to the network time of the TSN when the authentic time information is identified.

16. The computer-readable storage medium of claim 15 , comprising instructions that when executed by a processing circuitry, cause the processing circuitry to perform the bounded search within a defined search range represented by a number of bits of an information field of the time message used to carry the time information.

17. The computer-readable storage medium of claim 15 , comprising instructions that when executed by a processing circuitry, cause the processing circuitry to receive the time message from a clock leader in the TSN, wherein the time information represents a reference time from the clock leader, the reference time to comprise an origin time for the time message.

18. The computer-readable storage medium of claim 15 , comprising instructions that when executed by a processing circuitry, cause the processing circuitry to:
receive a security message associated with the time message; and
decode a security key for the MAC of the time message from the security message.

19. The computer-readable storage medium of claim 15 , comprising instructions that when executed by a processing circuitry, cause the processing circuitry to:
receive the MAC, a security key for the MAC, and the time information as input to a hash-based MAC (HMAC) cryptographic algorithm used to generate the MAC;
calculate a second MAC using the HMAC cryptogra

Assignees

• Intel Corp

Inventors

• Juliato Marcio
• Sastry Manoj
• Gutierrez Christopher
• Lesi Vuk
• Ahmed Shabbir

Classifications

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title