text: This paper establishes a fundamental theory of secure clock synchronization. Accurate clock synchronization is the backbone of systems managing power distribution, financial transactions, telecommunication operations, database services, etc. Some clock synchronization (time transfer) systems, such as the global navigation satellite systems, are based on one-way communication from a master to a slave clock. Others, such as the network transport protocol, and the IEEE 1588 precision time protocol (PTP), involve two-way communication between the master and slave. This paper shows that all one-way time transfer protocols are vulnerable to replay attacks that can potentially compromise timing information. A set of conditions for secure two-way clock synchronization is proposed and proved to be necessary and sufficient. It is shown that IEEE 1588 PTP, although a two-way synchronization protocol, is not compliant with these conditions, and is therefore insecure. Requirements for secure IEEE 1588 PTP are proposed, and a second example protocol is offered to illustrate the range of compliant systems.
  @cite_1: Smart grid applications demand the availability of a reliable and accurate time signal. Measurements and events need to be correctly aligned to enable proper actions and decisions. Precision time protocol (PTP) is the favored protocol for time distribution across smart grid domains. The correct functionality of PTP is of paramount importance and its security is of high priority. To harden its security, detection, and prevention mechanisms against attacks targeting PTP are needed. In this paper, we propose detection and mitigation mechanisms against the known PTP delay attack. We apply model checking to quantify the effect of the delay attack. Moreover, the validity of the proposed mechanism is formally proven. The suggested approach is tested on a physical system. The collected results support the usefulness of the mechanism in detecting the delay attacks targeting PTP, and preserving the system functionality.
summary: In @cite_1 , it is remarked that the clock offset computed between multiple master clocks over a symmetric channel must be zero, and thus, if multiple master clocks are available, they can detect any malicious delay introduced by an adversary. However, this defense does not consider the possibility that the adversary may only delay the packets sent to the slave nodes.