A method and system for NTP security proxy based on home gateway device

Abstract

The application relates to the technical field of network communication, and discloses an NTP security proxy method and system based on a home gateway device, which provides safe and reliable time synchronization services for a home network without changing the gateway and increasing user operation. In the application, the normal NTP request of the hanging device is intercepted through the DNAT rule of the gateway, the normal NTP request is converted into a secure request based on the NTS protocol by the NTP security proxy service built in the gateway, the encryption authentication communication with the external trusted NTS server is completed, the authoritative timestamp is extracted, the message which is disguised as the response of the original server is constructed according to the normal NTP protocol format, and the message is fed back to the hanging device, and finally, the safe and reliable time synchronization services are provided for all the network devices without changing the hanging device and increasing user operation.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and specifically to an NTP (Network Time Protocol) security proxy method and system based on a home gateway device. Background Technology

[0002] NTP is a protocol used to synchronize computer clocks in packet-switched, variable-latency data networks. Accurate and reliable time synchronization is crucial in modern networks, affecting numerous key applications such as log analysis, distributed system coordination, cryptographic certificate validity, and the order of financial transactions.

[0003] However, traditional NTP protocols (version 4 and earlier) are limited by their early design concepts and lack effective security mechanisms, making them difficult to cope with the current complex network attack environment. On the one hand, traditional NTP transmits time data in plaintext based on the UDP protocol without encrypting or protecting the integrity of the message content, resulting in the communication process being completely exposed to the network. On the other hand, the protocol itself lacks an authentication mechanism and cannot identify the legitimacy of the message source.

[0004] These two major flaws make it highly vulnerable to three typical types of attacks:

[0005] MITM (Man-in-the-Middle) attack: Attackers can intercept NTP request and response messages, tamper with the timestamp field, and inject incorrect time information into upstream NTP servers or downstream terminal devices.

[0006] Deception and forgery attacks: Attackers forge the IP address of a legitimate NTP server and send malicious response messages to terminal devices, inducing the devices to synchronize to a false time.

[0007] Replay attack: Attackers record NTP packets during normal communication and resend them to the terminal device at a specific time, causing the device clock to jump.

[0008] To address the security vulnerabilities of the NTP protocol, the IETF (Internet Engineering Task Force) introduced the NTS (Secure Network Time) protocol (such as RFC 8915). NTS combines TLS (Transport Layer Security) and authentication encryption technologies to provide encryption, authentication, and integrity protection for the time synchronization process, effectively resisting the aforementioned attacks.

[0009] However, the widespread adoption of the NTS protocol faces two major practical obstacles, making it difficult to implement directly in home network scenarios:

[0010] Firstly, there is the issue of compatibility with existing devices: a large number of IoT devices, older smart home appliances, network cameras, and other "dumb terminals" in home networks have simple firmware functions and limited hardware performance. They usually only support basic NTP clients and cannot be upgraded to versions that support the NTS protocol.

[0011] Secondly, the user configuration threshold is too high: even if some devices support the NTS protocol, ordinary users are required to manually configure parameters such as the NTS server address and key for each device. This is not only cumbersome, but may also lead to time synchronization failure due to configuration errors.

[0012] Therefore, how to provide a secure and reliable time synchronization service for the entire local area network without changing the configuration of the devices connected to the home network or increasing the user's operating costs has become a technical challenge that urgently needs to be solved in the field of home network security. Summary of the Invention

[0013] The technical problem to be solved by the present invention is to provide an NTP security proxy method and system based on a home gateway device, which provides a secure and reliable time synchronization service for the home network without modifying the devices connected to the gateway or increasing user operations.

[0014] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:

[0015] On one hand, the present invention provides an NTP security proxy method based on a home gateway device, comprising the following steps:

[0016] Deploy and run the NTP security proxy service on the home gateway device;

[0017] Intercepting ordinary NTP requests sent by devices connected to the home gateway device to an external NTP server;

[0018] The intercepted ordinary NTP request is forwarded to the NTP security proxy service, which performs protocol conversion on the intercepted ordinary NTP request to generate a secure NTP request;

[0019] The NTP security proxy service sends the generated secure NTP request to an external NTP server that supports the corresponding security protocol, and waits to receive a secure NTP response from the external NTP server containing authenticated and encrypted time information.

[0020] The NTP security proxy service decrypts and verifies the integrity of received secure NTP responses, and extracts the timestamp information contained therein after the verification is successful.

[0021] The NTP security proxy service constructs a corresponding ordinary NTP response according to the extracted timestamp information and the ordinary NTP protocol format, and sends the response to the downstream device that initially initiated the request.

[0022] Furthermore, intercepting ordinary NTP requests sent by devices connected to the home gateway to the external NTP server is achieved by configuring a Target Network Address Translation (DNAT) rule on the home gateway device. This rule redirects all data packets whose destination port is the NTP service port to the NTP security proxy service.

[0023] Furthermore, both the secure NTP request and secure NTP response use the Network Time Security Protocol (NTSP) for data encryption and authentication.

[0024] Furthermore, when the NTP security proxy service converts a regular NTP request into a secure NTP request, the NTP security proxy service, acting as an NTS client, completes an NTS key exchange (NTS-KE) process with an external NTP server that supports the NTS protocol, and uses the negotiated key to encrypt and protect the information in the regular NTP request to generate a secure NTP request.

[0025] Furthermore, the process of constructing the corresponding ordinary NTP response according to the ordinary NTP protocol format includes:

[0026] The IP header of the NTP response message is constructed using the IP address of the downstream device that initiated the request as the target address and the IP address of the external NTP server initially requested by the downstream device as the source address.

[0027] Using the timestamp information extracted from the secure NTP response, the NTP layer fields of the response message are filled in according to the standard NTP protocol specifications.

[0028] On the other hand, the present invention also provides an NTP security proxy system based on a home gateway device, deployed in the home gateway device, the system comprising:

[0029] The hijacking module is used to monitor the local area network data traffic of the home gateway device in real time, intercept ordinary NTP requests sent by the downstream device to the external NTP server, and redirect the request to the proxy service module.

[0030] The proxy service module establishes communication connections with the hijacking module, request conversion module, secure communication module, and response construction module, respectively. It is used to receive ordinary NTP requests redirected by the hijacking module and to schedule other modules to work together to complete the secure proxy process.

[0031] The request conversion module is used to receive ordinary NTP requests transmitted by the proxy service module, convert ordinary NTP requests into secure NTP requests according to the preset security protocol standard, and feed back the converted secure NTP requests to the proxy service module.

[0032] The secure communication module is used to receive secure NTP requests forwarded by the proxy service module, communicate with the external NTP server that supports the security protocol as a secure protocol client, complete the sending of secure NTP requests and the receiving of secure NTP responses, and transmit the received secure NTP responses to the response construction module.

[0033] The response construction module is used to parse the received secure NTP response, extract the timestamp information, construct a response message according to the ordinary NTP protocol format based on the timestamp information, and send the constructed ordinary NTP response to the downstream device that initiated the request.

[0034] Furthermore, the hijacking module intercepts and redirects ordinary NTP request packets by setting DNAT rules in the firewall or network subsystem of the home gateway device. The DNAT rules match all packets with UDP protocol and NTP service port as the destination port.

[0035] Furthermore, the secure communication module has a built-in client function for the Network Time Security Protocol (NTS), which enables it to exchange NTS keys, send secure NTP requests, and receive and decrypt secure NTP responses with an external NTP server that supports the NTS protocol.

[0036] Furthermore, when constructing a normal NTP response, the response construction module simulates the message format and data specifications of the external NTP server initially requested by the downstream device, generating a response message that is fully compatible with the normal NTP protocol.

[0037] Furthermore, the response construction module simulates the message format and data specifications of the external NTP server initially requested by the downstream device, generating a response message fully compatible with the ordinary NTP protocol, including:

[0038] Set the source IP address in the IP header to the original target NTP server IP address of the ordinary NTP request packet, and the destination IP address to the IP address of the downstream device that initiated the request; set the source port in the UDP header to 123, and the destination port to the source port used by the downstream device that initiated the request.

[0039] The NTP layer fills the fields according to the ordinary NTP protocol format. The original timestamp is filled with the sending timestamp in the ordinary NTP request data packet. The receiving timestamp and sending timestamp are calculated and filled according to the timestamp information extracted by the secure communication module and the time processing logic of the proxy service module. The reference timestamp is filled with the clock source information of the external NTP server.

[0040] The beneficial effects of this invention are:

[0041] (1) High transparency and full compatibility, zero-cost adaptation to existing equipment:

[0042] The security proxy process of this invention is completely transparent to devices connected to the home gateway. These devices do not need to modify any NTP client configurations, upgrade hardware, or update firmware; they only need to initiate ordinary NTP requests in the original manner to obtain reliable time synchronization services through the gateway's security proxy. This solves the pain point of many IoT devices and older smart appliances in home networks being "dumb terminals" that cannot support the NTS protocol. Security upgrades can be achieved without replacing equipment, greatly reducing the implementation cost of home network time security protection.

[0043] (2) Centralized security management simplifies operation and configuration requirements:

[0044] Security policies are implemented centrally through home gateway devices. Administrators only need to deploy the NTP security proxy service and configure DNAT rules on the gateway to provide unified time-based security protection for all connected devices on the network, without needing to configure parameters or provide operation instructions for each device individually. This avoids the technical hurdle of manually configuring the NTS protocol for ordinary users and reduces the difficulty of security operation and maintenance for home networks or small office networks.

[0045] (3) Defend against NTP security risks at the source and ensure the reliability of time data:

[0046] This invention transforms ordinary NTP requests from downstream devices into secure requests based on the NTS protocol. Through TLS key negotiation, encrypted transmission, and authentication, it fundamentally eliminates man-in-the-middle attacks, spoofing attacks, and replay attacks that are common to traditional NTP protocols. Simultaneously, the security proxy service decrypts and verifies the integrity of responses returned by external NTP servers, ensuring that the extracted timestamp information is authoritative and tamper-proof, providing a reliable time foundation for critical applications such as log tracing, certificate verification, and business logic sequencing for downstream devices.

[0047] (4) Low-cost deployment, compatible with existing home gateway hardware:

[0048] This invention can be integrated as a pure software solution into existing smart home gateways or routers with basic computing power, without the need for additional hardware modules or devices. It relies on the gateway's own kernel network subsystem (such as Linux Netfilter) to achieve request interception and redirection, making full use of the gateway's existing hardware resources, avoiding additional equipment procurement costs, and facilitating large-scale deployment and application in home network scenarios. Attached Figure Description

[0049] Figure 1 This is a schematic diagram illustrating the application of the NTP security proxy system in an embodiment of the present invention.

[0050] Figure 2 This is a flowchart of the NTP security proxy method in an embodiment of the present invention. Detailed Implementation

[0051] This invention aims to provide an NTP security proxy method and system based on a home gateway device, providing secure and reliable time synchronization services for a home network without modifying the devices connected to the gateway or increasing user operations. The core idea is as follows: First, the gateway's DNAT rules intercept ordinary NTP requests from connected devices. The gateway's built-in NTP security proxy service then converts these requests into secure requests based on the NTS protocol. Encrypted authentication communication is then completed with an external trusted NTS server to extract the authoritative timestamp. Finally, a message disguised as the original server's response is constructed according to the ordinary NTP protocol format and sent back to the connected device. Ultimately, without modifying the connected devices or increasing user operations, a secure and reliable time synchronization service is provided to all devices on the network.

[0052] For ease of understanding, some of the technical terms involved in this invention are explained below:

[0053] A regular NTP request is a time synchronization request that follows the traditional NTP protocol (version 4 and earlier) and does not have a security protection mechanism.

[0054] Secure NTP request: refers to a time synchronization request that has been converted by an NTP security proxy service and follows a security protocol (such as the NTS protocol, RFC8915), which is a security enhancement of ordinary NTP request.

[0055] A standard NTP response is a time-synchronization response returned by an NTP server to the requesting device, following the traditional NTP protocol (version 4 and earlier).

[0056] Secure NTP Response: This refers to a time-synchronized response with security protection returned by a trusted external NTP server that supports the NTS protocol in response to a secure NTP request.

[0057] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0058] See Figure 1 The NTP security proxy system provided in this embodiment uses a home gateway device 100 as the core carrier. The home gateway device 100 may be a smart router of a certain brand, equipped with a Linux kernel, and support the Netfilter / iptables network subsystem.

[0059] Home gateway device 100 can connect to multiple devices, such as smartphone 110, personal computer 120 and IoT device 130.

[0060] The NTP security proxy system mainly includes: hijacking module 101, proxy service module 102, request conversion module 103, secure communication module 104, and response construction module 105.

[0061] Based on the above system, the flowchart of the NTP security proxy method provided in this embodiment is as follows: Figure 2 It includes the following steps:

[0062] S201. System Initialization and Deployment:

[0063] On home gateway device 100, deploy and start the NTP security proxy service. Simultaneously, configure network rules through the hijacking module 101. Specifically, using the Linux kernel's Netfilter / iptables tool, add a DNAT rule, for example: `iptables -t nat -A PREROUTING -i br-lan -p udp --dport 123 -j DNAT --to-destination<gateway IP address>`. This rule means that all packets entering from the LAN interface (br-lan) with the UDP protocol and a destination port of 123 (the standard NTP port) will have their destination address changed to the gateway's own IP address. In this way, all NTP requests from downstream devices will be forcibly redirected to the gateway device itself.

[0064] S202. The downstream device initiates a normal NTP request:

[0065] This step follows standard operating procedures for existing home networks. For example, if IoT device 130 (IP: 192.168.1.50) needs to synchronize its time, it sends a standard, unencrypted NTP request message to a public NTP server (such as time.windows.com, assuming its IP is 20.189.79.72). The source IP of this message is 192.168.1.50, the destination IP is 20.189.79.72, and the destination port is UDP 123.

[0066] S203. The hijacking module intercepts and redirects the request:

[0067] When the NTP request packet passes through the home gateway device 100, it is captured by the DNAT rule set in step S201. The hijacking module 101 modifies the destination IP of the packet from 20.189.79.72 (the IP of the public NTP server) to the gateway's own IP (such as 192.168.1.1), while keeping the destination port 123 unchanged. Then, it forwards the packet to the proxy service module 102, which is listening on the corresponding port on the local machine. Netfilter records this connection conversion, that is, it records the mapping relationship between the original address and the rewritten address, which is used for the reverse address recovery of subsequent response packets to ensure that the response can be accurately sent back to the downstream device.

[0068] S204. The proxy service module receives and converts the request:

[0069] After the proxy service module 102 receives the redirected NTP request message, the scheduling request conversion module 103 completes the protocol conversion. The specific process is as follows:

[0070] The proxy service module 102 parses the redirected NTP request message and determines that it is a normal NTP request. If so, it triggers the conversion logic of the request conversion module 103, which converts the normal NTP request into a secure NTS request according to the NTS protocol specification.

[0071] The timestamp of the original request is encapsulated into the "client sending time" field of the NTS request to ensure the accuracy of the time offset calculation; a random NTS request ID (used to match the response) is generated and a cookie field is reserved (to be filled by the secure communication module later) to ensure the uniqueness and security of the request; finally, the request format is converted from a normal NTPv4 message to the format required by the NTS protocol.

[0072] S205. Secure communication module performs secure time synchronization:

[0073] The secure communication module 104 acts as an NTS client. It initiates communication with a pre-configured, NTS-enabled external trusted NTP server (e.g., time.cloudflare.com). There are two scenarios: initial communication and subsequent communication (not the initial communication), detailed below:

[0074] (1) Initial communication:

[0075] For the first communication after the proxy service starts, the secure communication module 104 will first perform a complete NTS key exchange (NTS-KE) process with the NTS server. This process is based on TLS 1.3 and is used to securely negotiate the keys, cookies, and confirm that the application layer protocol is NTPv4 for subsequent communication.

[0076] (2) Subsequent communication:

[0077] Once the key exchange is complete, the secure communication module 104 uses the acquired cookie and key to construct an NTS-protected NTP request. This request contains authentication and encryption information and is then sent to the NTS server via UDP.

[0078] Secure communication module 104 sends a secure NTP request according to the following procedure:

[0079] Encryption Request: Encrypt the core time field of the NTS request using a session key and add a Message Authentication Code (MAC) to ensure data integrity and prevent tampering.

[0080] Cookie population: The cookies obtained during the NTS-KE phase are populated into the NTS extension field of the request so that the server can verify the legitimacy of the request.

[0081] Request Sending: Send a secure NTS request to the NTP port of the NTS server via the UDP protocol.

[0082] S206. Receive and parse secure NTP responses:

[0083] Upon receiving the request, the NTS server verifies the validity of the Cookie and MAC address, and then returns a secure NTP response also protected by NTS. The secure communication module 104 receives this response and uses the previously negotiated key to decrypt and verify its integrity. If the verification passes, it extracts authoritative, tamper-proof timestamp information, such as the timestamp of the NTS server receiving the request, the timestamp of the NTS server sending the response, and the reference timestamp (the clock source of the NTS server).

[0084] S207. The response builder module generates a standard NTP response:

[0085] Based on the precise time information extracted in the previous step, response construction module 105 begins constructing a standard NTP response message. This message needs to completely disguise itself to the IoT device 130 as being sent back from a public NTP server (IP address 20.189.79.72). The specific construction content is as follows:

[0086] IP layer: Construct the IP header, fill in the source IP address as 20.189.79.72 (the target IP of the original request) to disguise the source of the response, and fill in the target IP address as the IP of the downstream device 130 (the device that initiated the request) 192.168.1.50 to ensure that the response is sent in a targeted manner.

[0087] UDP layer: The source port is 123, and the destination port is the source port used by the IoT device 130 when initiating the request.

[0088] NTP Layer: Fill in each field according to the standard NTP protocol format. Among them, the original timestamp (t1) is filled with the sending timestamp in the original request message to ensure that the time offset calculation base is consistent; the receiving timestamp (t2) and sending timestamp (t3) are accurately calculated and filled according to the time parsed from the security response and the time processing logic of the proxy service itself; the reference timestamp is filled with the server's clock source information.

[0089] Finally, the response construction module 105 sends the constructed packet to the kernel network subsystem via the Linux raw socket. Netfilter automatically confirms that the packet is a proxy response based on the previously recorded mapping relationship, and forwards it directly to the downstream device 130 without additional address rewriting.

[0090] S208. The downstream device receives the response and completes synchronization:

[0091] IoT device 130 receives a seemingly legitimate NTP response from time.windows.com. Following the standard NTP client procedure, it calculates the time offset and delay and adjusts its own clock. This completes a secure time synchronization process that is entirely transparent to the connected devices.

[0092] In this way, without changing any NTP client in the network, the present invention forces all time synchronization requests of the entire local area network to pass through the secure channel located at the gateway, thus achieving global time security protection.

[0093] Although embodiments of the present invention have been described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the present invention, and all such changes and alterations shall not depart from the protection scope of the present invention.

Claims

1. An NTP security proxy method based on a home gateway device, characterized in that, Includes the following steps: Deploy and run the NTP security proxy service on the home gateway device; Intercepting ordinary NTP requests sent by devices connected to the home gateway device to an external NTP server; The intercepted ordinary NTP request is forwarded to the NTP security proxy service, which performs protocol conversion on the intercepted ordinary NTP request and generates a secure NTP request. When converting a regular NTP request into a secure NTP request, the NTP security proxy service, acting as an NTS client, completes an NTS key exchange process with an external NTP server that supports the NTS protocol, and uses the negotiated key to encrypt and protect the information in the regular NTP request to generate a secure NTP request. The NTP security proxy service sends the generated secure NTP request to an external NTP server that supports the corresponding security protocol, and waits to receive a secure NTP response from the external NTP server containing authenticated and encrypted time information. The NTP security proxy service decrypts and verifies the integrity of received secure NTP responses, and extracts the timestamp information contained therein after the verification is successful. The NTP security proxy service constructs a corresponding ordinary NTP response according to the ordinary NTP protocol format based on the extracted timestamp information, and sends the response to the downstream device that initially initiated the request. The process of constructing the corresponding ordinary NTP response according to the ordinary NTP protocol format includes: The IP header of the NTP response message is constructed using the IP address of the downstream device that initiated the request as the target address and the IP address of the external NTP server initially requested by the downstream device as the source address. Using the timestamp information extracted from the secure NTP response, the NTP layer fields of the response message are filled in according to the standard NTP protocol specifications.

2. The NTP security proxy method based on a home gateway device as described in claim 1, characterized in that, Intercepting ordinary NTP requests sent by devices connected to the home gateway to an external NTP server is achieved by configuring a target network address translation rule on the home gateway device. This rule redirects all data packets whose target port is an NTP service port to the NTP security proxy service.

3. The NTP security proxy method based on a home gateway device as described in claim 1, characterized in that, Both the secure NTP request and secure NTP response use the Network Time Security Protocol (NTSP) for data encryption and authentication.

4. An NTP security proxy system based on a home gateway device, deployed in the home gateway device, characterized in that, The system includes: The hijacking module is used to monitor the local area network data traffic of the home gateway device in real time, intercept ordinary NTP requests sent by the downstream device to the external NTP server, and redirect the request to the proxy service module. The proxy service module establishes communication connections with the hijacking module, request conversion module, secure communication module, and response construction module, respectively. It is used to receive ordinary NTP requests redirected by the hijacking module and to schedule other modules to work together to complete the secure proxy process. The request conversion module is used to receive ordinary NTP requests transmitted by the proxy service module, convert ordinary NTP requests into secure NTP requests according to the preset security protocol standard, and feed back the converted secure NTP requests to the proxy service module. The secure communication module receives secure NTP requests forwarded by the proxy service module, communicates with an external NTP server that supports the secure protocol as a secure protocol client, completes the sending of secure NTP requests and the receiving of secure NTP responses, and transmits the received secure NTP responses to the response construction module; the secure communication module has a built-in client function for the Network Time Security Protocol, which can complete NTS key exchange, secure NTP request sending, and secure NTP response reception and decryption verification with an external NTP server that supports the NTS protocol; The response construction module is used to parse the received secure NTP response, extract the timestamp information, construct a response message according to the ordinary NTP protocol format based on the timestamp information, and send the constructed ordinary NTP response to the downstream device that initiated the request. When constructing the ordinary NTP response, the response construction module simulates the message format and data specifications of the external NTP server initially requested by the downstream device, and generates a response message that is fully compatible with the ordinary NTP protocol.

5. An NTP security proxy system based on a home gateway device as described in claim 4, characterized in that, The hijacking module intercepts and redirects ordinary NTP request packets by setting DNAT rules in the firewall or network subsystem of the home gateway device. The DNAT rules match all packets with UDP protocol and NTP service port as the destination port.

6. The NTP security proxy system based on a home gateway device as described in claim 4, characterized in that, The response construction module simulates the message format and data specifications of the external NTP server initially requested by the downstream device, generating a response message fully compatible with the ordinary NTP protocol, including: Set the source IP address in the IP header to the original target NTP server IP address of the ordinary NTP request packet, and the destination IP address to the IP address of the downstream device that initiated the request; set the source port in the UDP header to 123, and the destination port to the source port used by the downstream device that initiated the request. The NTP layer fills the fields according to the ordinary NTP protocol format. The original timestamp is filled with the sending timestamp in the ordinary NTP request data packet. The receiving timestamp and sending timestamp are calculated and filled according to the timestamp information extracted by the secure communication module and the time processing logic of the proxy service module. The reference timestamp is filled with the clock source information of the external NTP server.

Images