Network security time synchronization method and device

Abstract

The present application relates to a network security time synchronization method and device. The method includes: the NTP client receives the NTP request response packet, verifies the server digital signature, and if the verification is successful, calculates a first judgment value based on the timestamp part and the processing delay part in the NTP request response packet, and performs a first time judgment based on the first judgment value and a preset first threshold; the timestamp part in the NTP request response packet includes a client sending timestamp, a server receiving timestamp, a server sending timestamp, and a client receiving timestamp; if the first time judgment is successful, the NTP client calculates a second judgment value based on the server sending timestamps of the previous epoch and the current epoch, and performs a second time judgment based on the second judgment value and a preset second threshold; if the second time judgment is successful, the NTP client performs time synchronization. The use of this method can improve the client time synchronization performance.

Description

Technical Field

[0001] The present application relates to the field of secure timing technology, and in particular to a network security time synchronization method and device. Background Art

[0002] Network time synchronization is widely used in industries such as industry, electricity, and finance. The Network Time Protocol (NTP) is implemented based on UDP (User Datagram Protocol), which traces the time of packet networks to UTC (Coordinated Universal Time) to achieve time synchronization.

[0003] In NTP time synchronization, a spoofing attack refers to an attacker disguising himself as the server's IP address to send a response packet to the client. The client will mistakenly think that the server is requesting a response packet and then use the data for time synchronization. This is very easy to achieve in the connectionless UDP protocol. Attackers usually tamper with the time information in the data packet, shifting the client's time, resulting in time confusion. The NTP protocol is extremely vulnerable to attacks without defense measures, which affects the client's time synchronization performance and poses a potential threat to users with high security timing requirements. Various studies have been conducted on the security threats of NTP. The credibility between the client and the server can be effectively improved through means such as identity authentication, but various algorithms will have different effects on time synchronization performance. Summary of the invention

[0004] Based on this, it is necessary to provide a network security time synchronization method and device that can solve the problem that the client's time synchronization performance is difficult to meet the high-security timing requirements in order to address the above technical problems.

[0005] A network security time synchronization method, the method comprising:

[0006] The NTP client sends an NTP request packet to the NTP server, the NTP server receives the NTP request packet, and sends a corresponding NTP request response packet to the NTP client; the NTP request response packet includes a server digital signature;

[0007] The NTP client receives the NTP request response packet and verifies the server digital signature. If the verification is successful, a first judgment value is calculated according to the timestamp part and the processing delay part in the NTP request response packet, and a first time judgment is performed according to the first judgment value and a preset first threshold; the timestamp part in the NTP request response packet includes the client sending timestamp, the server receiving timestamp, the server sending timestamp and the client receiving timestamp; the processing delay part includes the client processing delay and the server processing delay;

[0008] If the first time judgment is passed, the NTP client calculates a second judgment value according to the server-sent timestamps of the previous epoch and the current epoch, and performs a second time judgment according to the second judgment value and a preset second threshold;

[0009] If the second time judgment is passed, the NTP client performs time synchronization.

[0010] In one of the embodiments, the method further includes: if the first decision value is less than the first threshold, the first time decision is passed; otherwise, the NTP client discards the current NTP request response packet.

[0011] In one of the embodiments, it also includes: the NTP client obtains the server-sent timestamp of the previous epoch, and calculates a second judgment value based on the difference between the server-sent timestamps of the current epoch and the previous epoch; if the second judgment value is greater than the second threshold, the second time judgment is passed, otherwise, the NTP client discards the current NTP request response packet.

[0012] In one of the embodiments, the method further includes: the NTP client and the NTP server respectively generate a client private key and a server public key, and exchange their respective keys with each other.

[0013] In one of the embodiments, it also includes: the NTP client obtains the client NTP packet, uses a hash function to extract a first message digest from the timestamp part of the NTP packet, uses the client private key to encrypt the first message digest to obtain a client digital signature, and adds the client digital signature to the end of the client NTP packet; the timestamp part of the client NTP packet includes a client sending timestamp; the NTP client adds the processing time of hash function extraction and key encryption as the client processing delay to the client NTP packet to obtain an NTP request packet; and the NTP client sends an NTP request packet to the NTP server.

[0014] In one of the embodiments, the method further includes: the NTP server receives the NTP request packet, verifies the client digital signature in the NTP request packet, and if the verification is successful, sends a corresponding NTP request response packet to the NTP client.

[0015] In one of the embodiments, it also includes: after the NTP server receives the NTP request packet, it generates a server receiving timestamp; the NTP server performs data integrity verification according to the second message digest, and if the data is complete, it returns an NTP request response packet including the client sending timestamp, the server receiving timestamp and the server sending timestamp to the NTP client; the server sending timestamp is the time information when the NTP server sends the NTP request response packet to the NTP client.

[0016] In one of the embodiments, it also includes: the NTP server uses a hash function to calculate the NTP original text to obtain a second message digest; uses the client private key to decrypt the client digital signature at the end of the NTP request packet to obtain the first message digest; and performs data integrity verification based on the first message digest and the second message digest. If the first message digest and the second message digest match, the verification is successful.

[0017] In one of the embodiments, it also includes: the NTP server obtains a server NTP packet based on the client data that has passed the data integrity verification and the server sending timestamp; the NTP server uses a hash function to extract a third message digest from the timestamp part of the server NTP packet, encrypts the third message digest using the server public key to obtain a server digital signature, and adds the server digital signature to the end of the server NTP packet; the timestamp part of the server NTP packet includes the client sending timestamp, the server receiving timestamp and the server sending timestamp; the NTP server adds the processing time of hash function extraction and key encryption as the server processing delay to the server NTP packet to obtain an NTP request response packet; the NTP server sends the NTP request response packet to the NTP client.

[0018] In one of the embodiments, it also includes: the NTP client receives the NTP request response packet; the NTP client uses a hash function to calculate the NTP original text to obtain a fourth message digest; uses the server public key to decrypt the server digital signature at the end of the NTP request response packet to obtain the third message digest; performs data integrity verification based on the third message digest and the fourth message digest, and if the third message digest matches the fourth message digest, the verification is successful.

[0019] In one of the embodiments, the method further includes: if the NTP client does not receive the NTP request response packet within a preset transmission delay waiting threshold, the current time synchronization request fails.

[0020] In one of the embodiments, the method further includes: the NTP client sending an NTP request packet to the NTP server according to a preset time synchronization period.

[0021] A network security time synchronization device, the device comprising:

[0022] A time synchronization request module, used for the NTP client to send an NTP request packet to the NTP server, the NTP server receives the NTP request packet, and sends a corresponding NTP request response packet to the NTP client; the NTP request response packet includes a server digital signature;

[0023] A first time judgment module is used for the NTP client to receive the NTP request response packet and verify the server digital signature. If the verification is successful, a first judgment value is calculated according to the timestamp part and the processing delay part in the NTP request response packet, and a first time judgment is performed according to the first judgment value and a preset first threshold; the timestamp part in the NTP request response packet includes the client sending timestamp, the server receiving timestamp, the server sending timestamp and the client receiving timestamp; the processing delay part includes the client processing delay and the server processing delay;

[0024] A second time judgment module, configured to, if the first time judgment is passed, cause the NTP client to calculate a second judgment value according to the server-sent timestamps of the previous epoch and the current epoch, and perform a second time judgment according to the second judgment value and a preset second threshold;

[0025] The time synchronization module is used for the NTP client to perform time synchronization if the second time judgment is passed.

[0026] The above-mentioned network security time synchronization method and device, through the NTP client to send the NTP request packet to the NTP server, the NTP server receives the NTP request packet, and sends the corresponding NTP request response packet to the NTP client, the NTP client receives the NTP request response packet, and verifies the data integrity by verifying the server digital signature in the NTP request response packet, which can improve the security of time synchronization and ensure that the data is not interfered with. On the other hand, if the verification is passed, the NTP client performs two time judgments accordingly, thereby improving the accuracy of time synchronization. Specifically, the NTP client calculates the first judgment value according to the timestamp part and the processing delay part in the NTP request response packet, and performs the first time judgment according to the first judgment value and the first threshold set in advance. If the first time judgment passes, the NTP client calculates the second judgment value according to the server sending timestamp of the previous epoch and the current epoch, and performs the second time judgment according to the second judgment value and the second threshold set in advance. If the second time judgment passes, the NTP client performs time synchronization. The embodiment of the present invention can improve the security and accuracy of the time synchronization of the NTP client and can meet the high-security timing requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is an application scenario diagram of a network security time synchronization method in an embodiment;

[0028] Figure 2 A schematic diagram of a flow chart of a network security time synchronization method in one embodiment;

[0029] Figure 3 A schematic diagram of a data transmission path in an embodiment;

[0030] Figure 4 A schematic diagram of the NTP client authentication process in one embodiment;

[0031] Figure 5 A schematic diagram of a frame format of an NTP request packet in an embodiment;

[0032] Figure 6 A schematic diagram of the NTP server authentication process in one embodiment;

[0033] Figure 7 A schematic diagram of timestamp information between an NTP server and an NTP client in one embodiment;

[0034] Figure 8 A schematic diagram of a flow chart of a network security time synchronization method in a specific embodiment;

[0035] Fig. 9 A schematic diagram of a visualization interface of an NTP client in an embodiment;

[0036] Fig.10 A schematic diagram showing a comparison of the standard deviation of the time difference of algorithms after using different key lengths in one embodiment;

[0037] Fig.11 A schematic diagram showing a comparison of the average delays of algorithms using different key lengths in one embodiment;

[0038] Fig.12 A schematic diagram showing a comparison of network timing accuracy between the method of the present invention using a 1024-bit key signature and the original protocol in one embodiment;

[0039] Fig.13 The figure is a structural block diagram of a network security time synchronization device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] The network security time synchronization method provided by this application can be applied to Figure 1 In the application environment shown. Among them, the NTP client 102 communicates with the NTP server 104 through the network. In the current time synchronization cycle, the NTP client sends an NTP request packet to the NTP server, the NTP server receives the NTP request packet, and sends the corresponding NTP request response packet to the NTP client, and the NTP client receives the NTP request response packet. In the above process, the NTP server and the NTP client respectively verify the data integrity of the received data packets. After the verification is passed, the next step is performed. After the NTP request response packet received by the NTP client is verified, the NTP client extracts the timestamp from the timestamp part of the NTP request response packet, calculates the first judgment value to perform a first time judgment, and after the first time judgment is passed, the NTP client obtains the server-sent timestamp of the previous epoch, and extracts the server-sent timestamp of the current epoch from the timestamp part of the NTP request response packet. The difference between the server-sent timestamps of the current epoch and the previous epoch is used to perform a second time judgment. After the second time judgment is passed, the NTP client performs time synchronization. The NTP client 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices, and the NTP server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0042] In one embodiment, Figure 2 As shown, a network security time synchronization method is provided, which is applied to Figure 1The following steps are used to illustrate the NTP client and NTP server in the example:

[0043] Step 202: The NTP client sends an NTP request packet to the NTP server. The NTP server receives the NTP request packet and sends a corresponding NTP request response packet to the NTP client.

[0044] The NTP request response packet includes a server digital signature, which is obtained by encrypting the message digest corresponding to the timestamp part of the NTP request response packet. The message digest is a fixed-length string generated from data of any length, usually implemented using a hash function, such as SHA-256 or MD5. The message digest is used to verify the integrity of the data. Any change to the original data will result in a change in the digest value. The digital signature is the process of encrypting the message to generate a fixed-length string associated with the message, namely the signature, which is usually encrypted using an asymmetric encryption algorithm. Use digital signature technology to provide more comprehensive data security protection.

[0045] Step 204, the NTP client receives the NTP request response packet and verifies the server digital signature. If the verification is successful, a first decision value is calculated based on the timestamp part and the processing delay part in the NTP request response packet, and a first time decision is performed based on the first decision value and a preset first threshold.

[0046] The timestamp part in the NTP request response packet includes the client sending timestamp, the server receiving timestamp, the server sending timestamp and the client receiving timestamp. The processing delay part in the NTP request response packet includes the client processing delay and the server processing delay. Figure 3 The first judgment value refers to the difference in the time consumption of data transmission on the two transmission paths from the NTP client to the NTP server and from the NTP server to the NTP client. The first judgment value is calculated using four timestamps. Among them, T4 is the client receiving timestamp, T3 is the server sending timestamp, T2 is the server receiving timestamp, T1 is the client sending timestamp, t1 and t2 are the hash processing time and private key encryption time of the NTP client, t'1 and t'2 are the hash processing time and private key encryption time of the NTP server, and the first threshold value is obtained through the historical data of T1 to T4 in the current communication environment. The threshold is set according to the fluctuation of the time difference to prevent the user side from being deceived or the time difference calculated by other attacks exceeding the threshold, and the time is pulled off by using the wrong time difference to calibrate the time, thereby improving the time synchronization performance of the NTP client.

[0047] Step 206: If the first time judgment is passed, the NTP client calculates a second judgment value based on the server-sent timestamps of the previous epoch and the current epoch, and performs a second time judgment based on the second judgment value and a preset second threshold.

[0048] Epoch refers to each sampling moment. In the present embodiment, epoch is defined as each synchronization process performed by the client. The second threshold is obtained through the historical data of T3 in the current communication environment. By parsing the NTP request response packet, the difference between the server-sent timestamps between adjacent epochs can be obtained to perform a second time judgment. Normally, the time interval for time synchronization is uniform, such as 1s, 10s. Therefore, for the timestamp returned by the server, theoretically, the returned time should not fluctuate much between different epochs. By setting the second threshold, the cheating party is prevented from generating or forwarding cheating, so that the T3 in the data packet lags behind or differs greatly from the normal T3, the abnormal T3 is detected, and the abnormal T3 is filtered out, thereby further improving the anti-cheating performance of NTP time synchronization.

[0049] Step 208: If the second time judgment is passed, the NTP client performs time synchronization.

[0050] Through digital signature verification, first time judgment and second time judgment, the time synchronization performance of the NTP client can be improved, thereby meeting the high-security timing requirements.

[0051] In the above network security time synchronization method, an NTP request packet is sent to an NTP server through an NTP client, and the NTP server receives the NTP request packet and sends a corresponding NTP request response packet to the NTP client. The NTP client receives the NTP request response packet and verifies the data integrity by verifying the server digital signature in the NTP request response packet, which can improve the security of time synchronization and ensure that the data is not interfered with. On the other hand, if the verification is passed, the NTP client performs two time judgments accordingly, thereby improving the accuracy of time synchronization. Specifically, the NTP client calculates a first judgment value based on the timestamp part and the processing delay part in the NTP request response packet, and performs a first time judgment based on the first judgment value and a pre-set first threshold. If the first time judgment passes, the NTP client calculates a second judgment value based on the server-sent timestamp of the previous epoch and the current epoch, and performs a second time judgment based on the second judgment value and a pre-set second threshold. If the second time judgment passes, the NTP client performs time synchronization. The embodiment of the present invention can improve the security and accuracy of NTP client time synchronization and meet the high-security timing requirements.

[0052] In one embodiment, before the NTP client sends an authentication data packet to the NTP server, the NTP client and the NTP server generate a client private key and a server public key respectively, and exchange their respective keys with each other. In this embodiment, the key length is adaptively adjusted according to the security requirements synthesized according to the scenario requirements.

[0053] In one embodiment, the step of an NTP client sending an NTP request packet to an NTP server includes: the NTP client obtains a client NTP packet, extracts a first message digest from a timestamp portion of the NTP packet using a hash function, encrypts the first message digest using a client private key, obtains a client digital signature, and adds the client digital signature to the end of the client NTP packet; the timestamp portion of the client NTP packet includes a client sending timestamp; the NTP client adds the processing time of hash function extraction and key encryption as a client processing delay to the client NTP packet to obtain an NTP request packet; and the NTP client sends an NTP request packet to the NTP server.

[0054] In this embodiment, the client processing delay is added to the data packet as a correction item to correct the first decision value and improve the accuracy. Figure 4 As shown in the NTP client authentication process diagram, the client first uses the MD5 algorithm to calculate the message digest of the timestamp before sending the data packet, and then uses the private key of the RSA algorithm to encrypt the message digest and extract the digital signature. The client waits for the server's response packet and then verifies the signature, that is, uses the server's RSA public key to decrypt the signature, and then uses the message digest algorithm to calculate the received original text. After comparison, if they are equal, the next step is to make a time judgment. If it is less than the threshold, time synchronization is performed. Figure 5The frame format diagram of the NTP request packet shown in the figure, LI is leap second adjustment, v4 is version 4, Mode is mode (synchronization mode), Stratum is layer, Poll is polling interval, Precision is clock precision, Root Delay is root delay, Root Dispersion is root dispersion, Reference ID is reference clock identifier, Reference Timestamp is reference timestamp, Origin Timestamp is original timestamp, i.e. client sending timestamp T1, Receive Timestamp is receiving timestamp, i.e. server receiving timestamp T2, Transmit Timestamp is transmission timestamp, i.e. server sending timestamp T3, Time Consuming is time consumption, including client processing delay, Digital SIgnature is digital signature, the packet length of the client NTP packet is 48 bytes, and the 16-byte message digest is extracted from the data packet by using the MD5 algorithm and then the message digest is encrypted by using the RSA private key, where the RSA key length is 1024 bits or 2048 bits, and the calculated signature length is 1048 bits or 2048 bits correspondingly, and the signature is added to the end of the packet. At the same time, the time of hash calculation and private key encryption is stored in the data packet as 2 bytes. Finally, the NTP request packet is 178 bytes or 306 bytes.

[0055] In one embodiment, Figure 6 As shown, a schematic diagram of the NTP server authentication process is provided, wherein the NTP server receives the NTP request packet and sends the corresponding NTP request response packet to the NTP client, including: the NTP server receives the NTP request packet, verifies the client digital signature in the NTP request packet, and if the verification is successful, sends the corresponding NTP request response packet to the NTP client. In this embodiment, the server monitors port 123, and if a request packet from the client is received, the integrity of the data packet is first verified, and if there is no abnormality, the timestamp is updated and a response packet containing a digital signature is constructed and returned to the NTP client.

[0056] In one embodiment, the steps of receiving an NTP request packet and verifying a client digital signature in the NTP request packet by an NTP server include: after receiving the NTP request packet, the NTP server generates a server receiving timestamp; the NTP server performs data integrity verification according to a second message digest, and if the data is complete, returns an NTP request response packet including a client sending timestamp, a server receiving timestamp, and a server sending timestamp to the NTP client; the server sending timestamp is the time information of the NTP server sending the NTP request response packet to the NTP client.

[0057] In one embodiment, the NTP server performs a data integrity verification step according to the second message digest, including: the NTP server uses a hash function to calculate the NTP original text to obtain the second message digest; uses the client private key to decrypt the client digital signature at the end of the NTP request packet to obtain the first message digest; performs data integrity verification according to the first message digest and the second message digest, and if the first message digest and the second message digest match, the verification is successful. In this embodiment, the integrity of the data can be proved by the data integrity verification, proving that the data is sent by a legitimate party. If the verification fails, the current data packet is discarded.

[0058] In one embodiment, the step of returning an NTP request response packet including a client sending timestamp, a server receiving timestamp and a server sending timestamp to an NTP client includes: the NTP server obtains a server NTP packet based on the client data and the server sending timestamp that have passed the data integrity verification; the NTP server extracts a third message digest from the timestamp part of the server NTP packet using a hash function, encrypts the third message digest using a server public key, obtains a server digital signature, and adds the server digital signature to the end of the server NTP packet; the timestamp part of the server NTP packet includes a client sending timestamp, a server receiving timestamp and a server sending timestamp; the NTP server adds the processing time of the hash function extraction and key encryption as a server processing delay to the server NTP packet to obtain an NTP request response packet; and the NTP server sends an NTP request response packet to the NTP client. In this embodiment, the server processing delay is added to the data packet as a correction item to correct the first judgment value and improve the accuracy.

[0059] In one embodiment, the steps of receiving an NTP request response packet by an NTP client and verifying a server digital signature include: the NTP client receiving the NTP request response packet; the NTP client using a hash function to calculate the NTP original text to obtain a fourth message digest; using the server public key to decrypt the server digital signature at the end of the NTP request response packet to obtain a third message digest; performing data integrity verification based on the third message digest and the fourth message digest, and if the third message digest and the fourth message digest match, the verification is successful.

[0060] During the above data transmission process, in the same network segment, the client applies to the server for time synchronization every 1 second. At the same time, another attacker is set up in the network segment, which applies for high-frequency time synchronization requests per second. The frequency can be set between 0 and 25,000 times / s.

[0061] In one embodiment, the step of performing the first time judgment according to the first judgment value and the preset first threshold includes: if the first judgment value is less than the first threshold, the first time judgment is passed, otherwise, the NTP client discards the current NTP request response packet. In this embodiment, the first threshold δ1 is first set, and after receiving the time response data information of the server, the client calculates the first judgment value (T4-T3)-(T2-T1) of the current synchronization. If it is greater than or equal to the first threshold δ1, the client discards the packet and abandons the time synchronization; if it is less than the first threshold δ1, the second step of time judgment is entered.

[0062] In this embodiment, if Figure 7 As shown, a schematic diagram of timestamp information between an NTP server and an NTP client is provided. The actual timestamp after considering the processing delay is:

[0063] T1'=T1+t1+t2

[0064] T3'=T3+t1'+t2'

[0065] T2=T1+t1+t2+delay1+offset

[0066] T4=T3+t1'+t2'+delay2-offset

[0067] Figure 7 In the example, the public key between T2 and T3 decrypts the signature t3, hashes the received plaintext and verifies t4. After the client receives the package, the public key decryption and hash verification are t'3 and t'4 respectively, so we can get:

[0068] T3=T2+t3+t4

[0069] The operation between T2 and T3 does not affect the final calculated delay and time difference, because they are obtained through symmetry. Assuming delay1 = delay2 = delay, the above two equations can be combined to obtain:

[0070]

[0071]

[0072] In theory, since the client and server use the same hash function and public key algorithm, the size of the constructed packet is

[0073] The same and the process is the same, so t1 = t1' and t2 = t2', so the time difference can be obtained:

[0074]

[0075] But in reality there will be differences, so time consuming is added to the data frame to correct this part.

[0076] In a specific embodiment, Figure 8 As shown, a flow chart of a network security time synchronization method is provided, wherein the NTP client calculates a second judgment value based on the server-sent timestamps of the previous epoch and the current epoch, and performs a second time judgment based on the second judgment value and a preset second threshold, including: the NTP client obtains the server-sent timestamp of the previous epoch, and calculates a second judgment value based on the difference between the server-sent timestamps of the current epoch and the previous epoch; if the second judgment value is greater than the second threshold, the second time judgment passes, otherwise, the NTP client discards the current NTP request response packet. In this embodiment, an epoch is defined as a synchronization process performed by the client each time. Let the current synchronization epoch be n, its previous state be n-1, and the client determines Is it less than the second threshold δ2? If it is greater than or equal to the second threshold δ2, the client discards the packet and gives up the time synchronization. If it is less than the second threshold δ2, the client considers that the current time information is accurate and calculates the time difference θ and performs time synchronization with the server.

[0077] In one embodiment, if the NTP client does not receive the NTP request response packet within the preset transmission delay waiting threshold, the current time synchronization request fails. Specifically, the NTP client applies to the server for a time synchronization request every 1 second.

[0078] In one embodiment, the NTP client sends an NTP request packet to the NTP server according to a preset time synchronization cycle. Specifically, the statistical data cycle is 1000 samples, and the waiting time for the server response is set to 1000ms. If the waiting time is less than 1000ms, the next time synchronization will be continued. If the waiting time is greater than 1000ms, "timeout processing" will be output, and the current time synchronization will be considered to have failed. The current time synchronization ends and the next time synchronization will be reapplied.

[0079] In one embodiment, Fig. 9 As shown in the figure, a schematic diagram of the NTP client visual interface is provided. The user selects two servers according to the needs and sets the synchronization interval t int and waiting response time threshold t wai According to actual measurements, users can observe synchronization time difference and path delay at any time. Fig.10 As shown in the figure, a schematic diagram of the comparison of the standard deviation of the time difference using algorithms with different key lengths is provided, namely original NTP (Original), NTP with MD5 added (MD5), and certified NTP with a key length of 1024 (MD5+RSA 1024) and NTP (MD5+RSA with a key length of 2048 bits 2048 ), the 1024-bit algorithm can achieve a synchronization accuracy better than 5ms. Fig.11 As shown in the figure, a schematic diagram of the average latency comparison of algorithms using different key lengths is provided, including original NTP (Original), NTP with MD5 added (MD5), and certified NTP with a key length of 1024 (MD5+RSA 1024 ) and NTP (MD5+RSA with a key length of 2048 bits 2048 ), the delay of the 1024-bit algorithm in the local area network is smaller than that of the 2048-bit algorithm, which is in the order of hundreds of milliseconds. Fig.12 As shown, a schematic diagram of network timing accuracy comparison between the method of the present invention (judgment method) using a 1024-bit key signature and the original protocol is provided. The test is carried out in a local area network. The method of the present invention has little effect on the timing accuracy and can achieve a synchronization accuracy better than 8ms.

[0080] It should be understood that although Figure 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0081] In one embodiment, Fig.13 As shown, a network security time synchronization device is provided, including: a time synchronization request module 1302, a first time determination module 1304, a second time determination module 1306 and a time synchronization module 1308, wherein:

[0082] The time synchronization request module 1302 is used for the NTP client to send an NTP request packet to the NTP server, and the NTP server receives the NTP request packet and sends a corresponding NTP request response packet to the NTP client; the NTP request response packet includes a server digital signature;

[0083] The first time judgment module 1304 is used for the NTP client to receive the NTP request response packet and verify the server digital signature. If the verification is successful, a first judgment value is calculated according to the timestamp part and the processing delay part in the NTP request response packet, and a first time judgment is performed according to the first judgment value and a preset first threshold; the timestamp part in the NTP request response packet includes the client sending timestamp, the server receiving timestamp, the server sending timestamp and the client receiving timestamp;

[0084] A second time judgment module 1306, configured to, if the first time judgment is passed, cause the NTP client to calculate a second judgment value according to the server-sent timestamps of the previous epoch and the current epoch, and perform a second time judgment according to the second judgment value and a preset second threshold;

[0085] The time synchronization module 1308 is configured to enable the NTP client to perform time synchronization if the second time judgment is passed.

[0086] In one of the embodiments, if the first decision value is less than the first threshold, the first time decision is passed, otherwise, the NTP client discards the current NTP request response packet.

[0087] In one of the embodiments, the NTP client is also used to obtain the server-sent timestamp of the previous epoch, and calculate the second judgment value based on the difference between the server-sent timestamps of the current epoch and the previous epoch; if the second judgment value is greater than the second threshold, the second time judgment is passed, otherwise, the NTP client discards the current NTP request response packet.

[0088] In one of the embodiments, the NTP client and the NTP server are also used to generate a client private key and a server public key respectively, and exchange their respective keys with each other.

[0089] In one of the embodiments, the NTP client is also used to obtain a client NTP packet, extract a first message digest from the timestamp part of the NTP packet using a hash function, encrypt the first message digest using a client private key, obtain a client digital signature, and add the client digital signature to the end of the client NTP packet; the timestamp part of the client NTP packet includes a client sending timestamp; the NTP client adds the processing time of hash function extraction and key encryption as the client processing delay to the client NTP packet to obtain an NTP request packet; the NTP client sends an NTP request packet to the NTP server.

[0090] In one of the embodiments, the NTP server receives an NTP request packet, verifies the client digital signature in the NTP request packet, and sends a corresponding NTP request response packet to the NTP client if the verification is successful.

[0091] In one of the embodiments, it is also used for the NTP server to generate a server receiving timestamp after receiving the NTP request packet; the NTP server performs data integrity verification based on the second message digest, and if the data is complete, returns an NTP request response packet containing the client sending timestamp, the server receiving timestamp and the server sending timestamp to the NTP client; the server sending timestamp is the time information when the NTP server sends the NTP request response packet to the NTP client.

[0092] In one of the embodiments, the NTP server uses a hash function to calculate the NTP original text to obtain a second message digest; uses the client private key to decrypt the client digital signature at the end of the NTP request packet to obtain a first message digest; and performs data integrity verification based on the first message digest and the second message digest. If the first message digest and the second message digest match, the verification is successful.

[0093] In one of the embodiments, the NTP server is also used to obtain a server NTP packet based on the client data that has passed the data integrity verification and the server sending timestamp; the NTP server uses a hash function to extract a third message digest from the timestamp part of the server NTP packet, encrypts the third message digest using the server public key, obtains a server digital signature, and adds the server digital signature to the end of the server NTP packet; the timestamp part of the server NTP packet includes the client sending timestamp, the server receiving timestamp and the server sending timestamp; the NTP server adds the processing time of the hash function extraction and key encryption as the server processing delay to the server NTP packet to obtain an NTP request response packet; the NTP server sends the NTP request response packet to the NTP client.

[0094] In one of the embodiments, the NTP client receives an NTP request response packet; the NTP client calculates the NTP original text using a hash function to obtain a fourth message digest; the server digital signature at the end of the NTP request response packet is decrypted using the server public key to obtain a third message digest; data integrity verification is performed based on the third message digest and the fourth message digest, and if the third message digest and the fourth message digest match, the verification is successful.

[0095] In one of the embodiments, if the NTP client does not receive the NTP request response packet within a preset transmission delay waiting threshold, the current time synchronization request fails.

[0096] In one of the embodiments, the NTP client is also used to send an NTP request packet to the NTP server according to a preset time synchronization period.

[0097] For the specific definition of the network security time synchronization device, please refer to the definition of the network security time synchronization method above, which will not be repeated here. Each module in the above network security time synchronization device can be implemented in whole or in part by software, hardware and their combination. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0098] The timestamp part and the processing delay part are calculated. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A network security time synchronization method implemented between an NTP client and an NTP server, characterized in that: The method comprises: The NTP client sends an NTP request packet to the NTP server, the NTP server receives the NTP request packet, and sends a corresponding NTP request response packet to the NTP client; the NTP request response packet includes a server digital signature; The NTP client receives the NTP request response packet and verifies the server digital signature. If the verification is successful, a first judgment value is calculated according to the timestamp part and the processing delay part in the NTP request response packet, and a first time judgment is performed according to the first judgment value and a preset first threshold; the timestamp part in the NTP request response packet includes the client sending timestamp, the server receiving timestamp, the server sending timestamp and the client receiving timestamp; the processing delay part includes the client processing delay and the server processing delay; If the first time judgment is passed, the NTP client calculates a second judgment value according to the server-sent timestamps of the previous epoch and the current epoch, and performs a second time judgment according to the second judgment value and a preset second threshold; the epoch refers to the synchronization process performed by the NTP client each time; If the second time judgment is passed, the NTP client performs time synchronization.

2. The method according to claim 1, characterized in that The step of performing a first time decision according to the first decision value and a preset first threshold includes: If the first decision value is less than the first threshold, the first time decision is passed, otherwise, the NTP client discards the current NTP request response packet.

3. The method according to claim 1, characterized in that: The NTP client calculates a second decision value according to the server-sent timestamps of the previous epoch and the current epoch, and performs a second time decision according to the second decision value and a preset second threshold, including: The NTP client obtains the server-sent timestamp of the previous epoch, and calculates the second decision value according to the difference between the server-sent timestamps of the current epoch and the previous epoch; If the second decision value is greater than the second threshold, the second time decision is passed; otherwise, the NTP client discards the current NTP request response packet.

4. The method according to claim 1, characterized in that: Before the NTP client sends an authentication data packet to the NTP server, the method includes: The NTP client and the NTP server generate a client private key and a server public key respectively, and exchange their respective keys with each other.

5. The method according to claim 4, characterized in that The step of the NTP client sending an NTP request packet to the NTP server includes: The NTP client obtains a client NTP packet, extracts a first message digest from a timestamp portion of the NTP packet using a hash function, encrypts the first message digest using a client private key, obtains a client digital signature, and adds the client digital signature to the end of the client NTP packet; the timestamp portion of the client NTP packet includes a client sending timestamp; The NTP client adds the processing time of hash function extraction and key encryption as the client processing delay to the client NTP packet to obtain an NTP request packet; The NTP client sends an NTP request packet to the NTP server.

6. The method according to claim 5, characterized in that The NTP server receives the NTP request packet, and sends a corresponding NTP request response packet to the NTP client, including: The NTP server receives the NTP request packet, verifies the client digital signature in the NTP request packet, and sends a corresponding NTP request response packet to the NTP client if the verification is successful; The step of the NTP server receiving the NTP request packet and verifying the client digital signature in the NTP request packet includes: After receiving the NTP request packet, the NTP server generates a server receiving timestamp; The NTP server performs data integrity verification according to the second message digest. If the data is complete, the NTP server returns an NTP request response packet including the client sending timestamp, the server receiving timestamp and the server sending timestamp to the NTP client; the server sending timestamp is the time information when the NTP server sends the NTP request response packet to the NTP client.

7. The method according to claim 6, characterized in that The NTP server performs a data integrity verification step according to the second message digest, including: The NTP server calculates the NTP original text using a hash function to obtain a second message digest; Decrypting the client digital signature at the end of the NTP request packet using the client private key to obtain the first message digest; Data integrity verification is performed based on the first message digest and the second message digest. If the first message digest and the second message digest match, the verification succeeds.

8. The method according to claim 6, characterized in that The step of returning an NTP request response packet including a timestamp sent by the client, a timestamp received by the server, and a timestamp sent by the server to the NTP client comprises: The NTP server obtains a server NTP packet according to the client data and the server sending timestamp that pass the data integrity verification; The NTP server uses a hash function to extract a third message digest from the timestamp part of the server NTP packet, encrypts the third message digest using the server public key to obtain a server digital signature, and adds the server digital signature to the end of the server NTP packet; the timestamp part of the server NTP packet includes a client sending timestamp, a server receiving timestamp, and a server sending timestamp; The NTP server adds the processing time of hash function extraction and key encryption as server processing delay to the server NTP packet to obtain an NTP request response packet; The NTP server sends the NTP request response packet to the NTP client.

9. The method according to any one of claims 4 to 8, characterized in that: The step of the NTP client receiving the NTP request response packet and verifying the digital signature of the server includes: The NTP client receives the NTP request response packet; The NTP client calculates the NTP original text using a hash function to obtain a fourth message digest; Decrypting the server digital signature at the end of the NTP request response packet using the server public key to obtain the third message digest; Data integrity verification is performed based on the third message digest and the fourth message digest. If the third message digest matches the fourth message digest, the verification succeeds.

10. A network security time synchronization device, characterized in that: The device comprises: A time synchronization request module, used for the NTP client to send an NTP request packet to the NTP server, the NTP server receives the NTP request packet, and sends a corresponding NTP request response packet to the NTP client; the NTP request response packet includes a server digital signature; A first time judgment module is used for the NTP client to receive the NTP request response packet and verify the server digital signature. If the verification is successful, a first judgment value is calculated according to the timestamp part and the processing delay part in the NTP request response packet, and a first time judgment is performed according to the first judgment value and a preset first threshold; the timestamp part in the NTP request response packet includes the client sending timestamp, the server receiving timestamp, the server sending timestamp and the client receiving timestamp; the processing delay part includes the client processing delay and the server processing delay; A second time judgment module, for, if the first time judgment is passed, the NTP client calculates a second judgment value according to the server-sent timestamps of the previous epoch and the current epoch, and performs a second time judgment according to the second judgment value and a preset second threshold; the epoch refers to a synchronization process performed once by the NTP client; The time synchronization module is used for the NTP client to perform time synchronization if the second time judgment is passed.

Images