Precision time protocol attack strategies and their resistance to existing security extensions

Abstract

The IEEE 1588 precision time protocol (PTP) is very important for many industrial sectors and applications that require time synchronization accuracy between computers down to microsecond and even nanosecond levels. Nevertheless, PTP and its underlying network infrastructure are vulnerable to cyber-attacks, which can stealthily reduce the time synchronization accuracy to unacceptable and even damage-causing levels for individual clocks or an entire network, leading to financial loss or even physical destruction. Existing security protocol extensions only partially address this problem. This paper provides a comprehensive analysis of strategies for advanced persistent threats to PTP infrastructure, possible attacker locations, and the impact on clock and network synchronization in the presence of security protocol extensions, infrastructure redundancy, and protocol redundancy. It distinguishes between attack strategies and attacker types as described in RFC7384, but further distinguishes between the spoofing and time source attack, the simple internal attack, and the advanced internal attack. Some experiments were conducted to demonstrate the impact of PTP attacks. Our analysis shows that a sophisticated attacker has a range of methodologies to compromise a PTP network. Moreover, all PTP infrastructure components can host an attacker, making the comprehensive protection of a PTP network against a malware infiltration, as for example exercised by Stuxnet, a very tedious task.

A Security Enhancement of the Precision Time Protocol Using a Trusted Supervisor Node

“…RFC7384 [ 8 ] discusses the security threats to PTP and distinguishes between two types, namely the internal and the external attack, which can be conducted either by a man-in-the-middle (MitM) or an injector attacker. Furthermore, Alghamdi [ 7 ] further distinguished between the simple and the advanced internal attack by determining the attack range, the attack impact on time synchronization, and the attack implementation. These attack/attacker types have different characteristics as follows.…”

“…Here, the attacker has only access to a trusted component of the network, but no access to cryptographic keys. The attacker can launch several PTP attacks, such as the packet removal attack, packet delay manipulation attack, replay attack, or the DoS attacks [ 7 ].…”

“…The attacker has full access to a device, including the security keys used. This kind of attack can launch all PTP attacks as listed in [ 7 ].…”

“…However, research has shown that prong A and B cannot provide protection against some PTP attacks such as the delay attack [ 6 , 7 , 8 ]. Moreover, prong C does not provide comprehensive protection if an attacker simultaneously compromises all redundant systems [ 9 ], redundant paths [ 10 , 11 ], or redundant grandmasters [ 12 ].…”

“…Alghamdi et al [ 13 ] investigated the impact of all PTP attack strategies as outlined in [ 7 ], considering the two most popular PTP daemons, PTP4l and PTPd, thereby highlighting the need for advanced attack detection methods.…”