Vulnerability analysis method applied to gPTP protocol of edge node

Abstract

The invention discloses a vulnerability analysis method applied to a gPTP protocol of an edge node, which belongs to the technical field of network security, and is characterized in that the node and adjacent nodes thereof are arranged in a network deployed with the gPTP protocol; in the vulnerability analysis method, a current node constructs a PdelayResp message and a PdelayResFollowUp message by utilizing PTP information which is continuously received from an adjacent node, and feeds back the PdelayResFollowUp message to the adjacent node so as to enable the adjacent node to send an Announce message; then Announce messages sent by adjacent nodes are monitored to obtain gPTP domain information, an attack target is determined according to the gPTP domain information and attack is carried out, and finally vulnerability analysis of the gPTP protocol is carried out by using an attack result; the vulnerability of the gPTP protocol can be accurately checked, potential vulnerabilities existing in the gPTP protocol can be searched, and the network security is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and more specifically, relates to a vulnerability analysis method of a gPTP protocol applied to an edge node. Background Art

[0002] With the continuous advancement of the information revolution, the Internet has become an indispensable part of people's lives. The issue of secure transmission of sensitive information on the Internet is related to the development of individuals, enterprises and even countries. Security protocols provide information protection services to users on the Internet based on cryptographic algorithms, and are an important part of the field of information security. Network security protocols are the basis for creating a network security environment and are key technologies for building a secure network. Designing and ensuring the security and correctness of network security protocols can fundamentally ensure network security and avoid information leakage problems such as network data information loss or file damage due to insufficient network security levels. In computer network applications, people have conducted a lot of research on computer communication security protocols to improve the security of network information transmission.

[0003] The gPTP protocol provides high-precision clock synchronization for deterministic transmission in time-sensitive networks (TSN), but its security considerations are insufficient, resulting in possible interference, deception, replay and other attacks on the gPTP protocol. These attacks can affect the time synchronization accuracy of the TSN network, and can even interrupt the clock synchronization service and affect other functions of the TSN network.

[0004] At present, the vulnerability analysis of the gPTP protocol is often carried out through formal modeling methods. This method is a theoretical analysis and the vulnerability analysis results are inaccurate. Summary of the invention

[0005] In view of the above defects or improvement needs of the prior art, the present invention provides a vulnerability analysis method of the gPTP protocol applied to edge nodes, which aims to solve the technical problem that the existing results of the vulnerability analysis of the gPTP protocol through formal modeling are inaccurate.

[0006] To achieve the above object, according to one aspect of the present invention, a vulnerability analysis method of the gPTP protocol applied to an edge node is provided, comprising:

[0007] S1: Continuously receive Pdelay_Req messages in PTP information from neighboring nodes, and obtain a first data set including a gPTPDomain field, a sourcePortId field, and a sequenceId field; the network corresponding to this node and its neighboring nodes is deployed with the gPTP protocol;

[0008] S2: construct a Pdelay_Resp message and a Pdelay_Resp_Follow_Up message using the first data set, and feed them back to the neighboring node so that it sends an Announce message;

[0009] S3: Listen to the Announce message sent by the neighboring node, and obtain a second data set including the gPTP domain master clock information and a third data set including the gPTP domain path information; extract the target to be detected from the gPTP domain path information to construct a first Management message; send the first Management message to the neighboring node to obtain the second Management message replied by the neighboring node; obtain a fourth data set including the current parameter set of the target to be detected from the second Management message; use the second data set, the third data set and the fourth data set as gPTP domain information;

[0010] S4: using the gPTP domain information to attack the target node in the gPTP domain;

[0011] S5: Analyze the attack results to determine whether the vulnerability of the gPTP protocol exists; if the attack is successful, it indicates that the vulnerability exists, otherwise it does not exist.

[0012] In one embodiment, the S4 includes:

[0013] S41: extracting the target MAC address of the target to be attacked from the third data set, then constructing an Ethernet frame header, setting the source MAC address to an arbitrary MAC address, and setting the destination MAC address to the extracted target MAC address;

[0014] S42: construct the remaining fields of the Pdelay_Req message, wherein the value of the ClockId field is set to ClockId1, and generate the first Pdelay_Req message;

[0015] S43: construct the remaining fields of the Pdelay_Req message, but set the value of the ClockId field to any ClockId2 different from ClockId1, and generate a second Pdelay_Req message;

[0016] S44: Send the generated first and second Pdelay_Req messages to the target node to attack.

[0017] In one embodiment, the S5 includes:

[0018] Parse the received Announce message to obtain a fifth data set recording node information on the attack path;

[0019] Comparing the third data set with the fifth data set, if the contents of the two data sets are the same, it indicates that the DoS attack is unsuccessful; on the contrary, if the fifth data set is missing part of the path information compared with the third data set, it indicates that the DoS attack is successfully executed;

[0020] If the attack is successful, it indicates that the DoS attack vulnerability exists, otherwise it does not exist.

[0021] In one embodiment, the S5 includes:

[0022] Using the target MAC address to construct an Ethernet frame header to generate a third Management message and send it to a neighboring node, so that the neighboring node feeds back a fourth Management message, and obtains the state parameter of the target port from the fourth Management message;

[0023] If the port status is displayed as "Disabled", it means that the DoS attack has been successful; otherwise, the port is in other states and the attack has not been successful;

[0024] If the attack is successful, it indicates that the DoS attack vulnerability exists, otherwise it does not exist.

[0025] In one embodiment, the S4 includes:

[0026] S41: Acquire the priority information MasterPriority of the master clock from the second data set;

[0027] S42: The source address of the Ethernet frame is set to the MAC address of this node, and the destination address is set to the default multicast address of the gPTP protocol; the remaining fields of the Announce message are filled and the priority field AttackPriority is set. The PTP clock priority of this node is higher than the priority of the original master clock of the gPTP domain;

[0028] S43: This node sends the generated Announce message to the neighboring node to attack.

[0029] In one embodiment, the S5 includes:

[0030] Extracting a sixth data set from the Announce message received from the neighboring node, and obtaining the current master clock identity information ClockId corresponding to the gPTP from the sixth data set;

[0031] If the current master clock identity information ClockId is consistent with the ClockId in the Announce message sent by this node, and the master clock priority in the sixth data set is the same as the priority AttackPriority set in the Announce message sent by this node, the deception attack is successfully executed; otherwise, the deception attack fails;

[0032] If the attack is successful, then the sign spoofing attack vulnerability exists, otherwise it does not exist.

[0033] In one embodiment, the S4 includes:

[0034] S41: extracting a target MAC address of a target to be attacked from the third data set;

[0035] S42: Capture the Sync / Follow_Up message from the neighboring node, and select the Sync message and Follow_Up message with the same SequenceId field as a pair of legal Sync / Follow_Up messages;

[0036] S43: modify the MAC destination address of the Ethernet frame header of the legitimate Sync / Follow_Up message to the MAC address of the target to be attacked;

[0037] S44: Send the Sync / Follow_Up message with the modified destination address to the target to be attacked to carry out the attack.

[0038] In one embodiment, the S5 includes:

[0039] Constructing an Ethernet frame header using the target MAC address and generating a fifth Management message;

[0040] Sending the fifth Management message to the neighboring node to obtain a sixth Management message replied by the neighboring node, and obtaining the time attribute of the target port from the sixth Management message;

[0041] If the difference between the target's local clock time and the timestamp contained in the Follow_Up message in the replay attack is lower than the threshold, it indicates that the replay attack is successful; otherwise, the replay attack fails; if the attack is successful, it indicates that the replay attack vulnerability exists, otherwise it does not exist.

[0042] In one embodiment, the S4 includes:

[0043] S41: Obtain the current master clock identity information ClockId corresponding to the gPTP from the second data set, and obtain the neighbor node priority information;

[0044] S42: Forge a master clock Announce message using the current master clock identity information ClockId, and set the priority field to be greater than the neighbor node priority;

[0045] S43: Set the destination address of the Announce message to the gPTP default multicast address;

[0046] S44: Send the constructed Announce message to the neighboring node to attack.

[0047] In one embodiment, the S5 includes:

[0048] Receive an Announce message sent by a neighboring node, parse the Announce message to obtain a seventh data set, and obtain the current master clock identity information ClockId corresponding to the gPTP from the seventh data set;

[0049] Compare the current master clock identity information ClockId with the ClockId in the second data set, if the ClockIds are different, the vulnerability exploitation attack is successful; otherwise, the vulnerability exploitation attack fails;

[0050] If the attack is successful, it indicates that the vulnerability exists, otherwise it does not exist.

[0051] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0052] (1) The present invention provides a vulnerability analysis method for the gPTP protocol applied to edge nodes. The node and its neighboring nodes are arranged in a network deployed with the gPTP protocol. The node constructs a Pdelay_Resp message and a Pdelay_Resp_Follow_Up message using the PTP information continuously received from the neighboring nodes, and feeds back the Pdelay_Resp message to the neighboring nodes so that the neighboring nodes send Sync / Follow_up and Announce messages. Then, the node monitors the Announce message sent by the neighboring nodes to obtain the gPTP domain information, determines the attack target according to the gPTP domain information and carries out the attack, and finally uses the attack result to perform the vulnerability analysis of the gPTP protocol. The method can accurately test the vulnerability of the gPTP protocol, help find the potential loopholes in the gPTP protocol, and improve network security. In addition, launching an attack on other nodes from the network edge node is more in line with the actual network attack scenario, and has more practical reference value for the security assessment of the network.

[0053] (2) In this scheme, a DoS attack is carried out on the target node in the gPTP domain. This method takes into account the unique properties of the gPTP protocol and can verify whether the DoS attack vulnerability of the gPTP protocol exists.

[0054] (3) This solution parses the received Announce message to obtain a fifth data set that records the node information on the attack path; the third data set is compared with the fifth data set to determine whether the DoS attack is successful. The determination method is simple and the computational complexity is low.

[0055] (4) This solution uses the target MAC address to construct an Ethernet frame header to generate a third Management message and sends it to a neighboring node, so that the neighboring node feeds back a fourth Management message and obtains the state parameters of the target port from the fourth Management message to determine whether the DoS attack is successful. The determination method is simple and the computational complexity is low.

[0056] (5) This scheme conducts a spoofing attack on the target node in the gPTP domain. This method takes into account the possible deficiencies of the gPTP protocol in identity authentication and can verify whether the spoofing attack vulnerability of the gPTP protocol exists.

[0057] (6) This scheme extracts the sixth data set from the Announce message received from the neighboring node, and obtains the current master clock identity information ClockId corresponding to the gPTP from the sixth data set; compares whether the current master clock identity information ClockId is consistent with the ClockId in the Announce message sent by this node to determine whether the spoofing attack is successful; and can improve the execution efficiency of the algorithm while ensuring accurate judgment.

[0058] (7) This scheme performs a replay attack on the target node in the gPTP domain. This method can verify whether the replay attack vulnerability exists.

[0059] (8) This scheme uses the target MAC address to construct an Ethernet frame header and generate a fifth Management message; the fifth Management message is sent to the neighboring node to obtain the sixth Management message replied by the neighboring node, and the time attribute of the target port is obtained from the sixth Management message to determine whether the replay attack is successful; this method can improve the execution efficiency of the algorithm while ensuring accurate judgment.

[0060] (9) This scheme exploits protocol vulnerabilities to attack the target node. This approach takes into account the possible introduction of exploitable vulnerabilities during the protocol implementation process and can verify whether the protocol vulnerability attack vulnerability exists.

[0061] (10) This scheme receives an Announce message sent by a neighboring node, parses the Announce message to obtain the seventh data set, and obtains the current master clock identity information ClockId corresponding to the gPTP therefrom; compares the current master clock identity information ClockId with the ClockId in the second data set to determine whether the vulnerability exploitation attack is successful; this judgment method is simple and has low computational complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a flow chart of a vulnerability analysis method of the gPTP protocol applied to an edge node provided in Example 1 of the present invention;

[0063] Figure 2 is a schematic diagram of the information reconnaissance process provided by Example 1 of the present invention;

[0064] Figure 3 is a schematic diagram of an attack scenario provided by Example 5 of the present invention;

[0065] Figure 4 It is a structural diagram of a vulnerability analysis device of the gPTP protocol applied to an edge node provided in Example 6 of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0067] Example 1

[0068] like Figure 1As shown, this embodiment provides a vulnerability analysis method for the gPTP protocol applied to edge nodes, including steps S1-S5. S1: Continuously receive Pdelay_Req messages in PTP information from neighboring nodes, and obtain gPTP The first data set includes the Domain field, sourcePortId field and sequenceId field; the gPTP protocol is deployed in the corresponding network of this node and its neighboring nodes; S2: construct Pdelay_Resp message and Pdelay_Resp_Follow_Up message using the first data set, and feed it back to the neighboring node so that it sends Sync / Follow_up and Announce messages; S3: listen to the Announce message sent by the neighboring node, and obtain the second data set including the gPTP domain master clock information and the third data set including the gPTP domain path information; extract the reconnaissance target from the gPTP domain path information to construct the first Management message; send the first Management message to the neighboring node to obtain the second Management message replied by it; obtain the fourth data set including the current parameter set of the reconnaissance target from the second Management message; use the second data set, the third data set and the fourth data set as the gPTP domain information; S4: use the gPTP domain information to attack the target node in the gPTP domain; S5: analyze the attack results to determine whether the vulnerability of the gPTP protocol exists; if the attack is successful, it indicates that the vulnerability exists, otherwise it does not exist.

[0069] First, the node receives a PTP (Precision Time Synchronization Protocol) message from a neighboring node. Specifically, the node listens to the message sent by the neighboring node port, obtains the PTP Pdelay_Req message, and parses the Pdelay_Req message to obtain the first data set (PReqDS, Pdelay_Req Data set), which contains<gPTP Domain,sourcePortId,sequenceId> field.

[0070] Specifically, the node constructs a Pdelay_Resp message and a Pdelay_Resp_Follow_Up message according to the extracted first data set, and sends the generated Pdelay_Resp message and Pdelay_Resp_Follow_Up message to the neighboring node port. If the neighboring node starts to send Sync / Follow_up messages, the connection is successfully established. Among them, this step is a continuous process, and the neighboring node continuously sends Pdelay_Req messages. The node needs to reply with a Pdelay_Resp message and a Pdelay_Resp_Follow_Up message after receiving the message each time, otherwise the connection between the node and the neighboring node will be interrupted.

[0071] Then, this node obtains gPTP domain information through information reconnaissance, such as Figure 2 The steps of information reconnaissance are given.

[0072] Specifically, the neighboring nodes of this node will send additional PTP messages to this node, including Announce messages, Sync messages, and Follow_Up messages. Among them, the Announce message contains gPTP domain information. This node parses the received Announce message to obtain the second data set (GMDS, Grand Master Data set) and the third data set (PTDS, PathTree Data set). Among them, the second data set contains the gPTP domain master clock<ClockId,Priority> Information, ClockId is the master clock identity information, Priority is the master clock priority information; the third data set contains gPTP domain path information, which contains the ClockId information of the PTP clock on the synchronization spanning tree path with the master clock as the root node and the neighboring node of this node as the termination node. The general form of ClockId is ("MAC sub-segment 1" + "FFFE" + "MAC sub-segment 2"). Furthermore, this node obtains gPTP domain information through management messages.

[0073] Among them, the PTP protocol provides Management messages to implement parameter management of PTP instances, supports remote connectors to implement GET, SET and COMMAND functions of PTP instances, and this node uses the GET function of the Management message to perform information reconnaissance on the PTP instances contained in the third data set. The gPTP protocol is a simplification and improvement of the PTP protocol. When the target domain still uses Management messages to implement the management of PTP instance parameters, this node extracts the ClockId of the target to be detected from the third data set to construct the targetPortId of the Management message, so that the Management message can be received by the target to be detected and generate a reply message; this node sets the actionField field of the Management message to 0, indicating that the function implemented by the Management is GET. This node constructs the TLV field of the Management message to limit the scope of information acquisition. In this embodiment, the fourth data set (MADS, Management Attack Dataset) of the target to be detected is obtained, which includes the current parameter set of the target to be detected.

[0074] Finally, this node implements a typical attack on the target node to explore potential vulnerabilities in the gPTP protocol. The attack results are analyzed to determine whether the vulnerability of the gPTP protocol exists; if the attack is successful, it indicates that the vulnerability exists, otherwise it does not exist.

[0075] Example 2

[0076] Based on Example 1, S4 includes: S41: extracting the target MAC address of the target to be attacked from the third data set, and then constructing an Ethernet frame header, setting the source MAC address to an arbitrary MAC address, and setting the destination MAC address to the extracted target MAC address; S42: constructing the remaining fields of the Pdelay_Req message, wherein the value of the ClockId field is set to ClockId1, and generating a first Pdelay_Req message; S43: constructing the remaining fields of the Pdelay_Req message, but setting the value of the ClockId field to any ClockId2 different from ClockId1, and generating a second Pdelay_Req message; S44: sending the generated first and second Pdelay_Req messages to the target node for attack.

[0077] Specifically, there is an attribute named asCapable in the gPTP protocol, which is used to mark whether the port supports the gPTP protocol. The asCapable attribute value can be configured as auto. When configured as auto, it means that the value changes dynamically when the program is running. When a port receives Pdelay_Req, Pdelay_Resp, and Pdelay_Resp_Follow_Up messages sent from different PTP instances, the value is set to False. The asCapable attribute affects the port status. When the asCapable attribute is False, the port status changes to Disabled, indicating that the port is unavailable. The specific process of S4:

[0078] (1) This node extracts the target MAC address of the target to be attacked from the third data set, and then constructs an Ethernet frame header, sets the source MAC address to an arbitrary MAC address, and sets the destination MAC address to the extracted target MAC address;

[0079] (2) This node constructs the remaining fields of the Pdelay_Req message, where the value of the ClockId field is set to ClockId1, thereby generating the first Pdelay_Req message;

[0080] (3) Repeat step (2), but set the value of the ClockId field to any ClockId2 different from ClockId1, and generate a second Pdelay_Req message;

[0081] (4) This node sends the first and second Pdelay_Req messages generated to the target node to carry out the attack.

[0082] Furthermore, there are two ways to perform vulnerability analysis based on the results of detecting DoS attacks.

[0083] The first type: S5 includes: parsing the received Announce message to obtain a fifth data set that records the node information on the attack path; comparing the third data set with the fifth data set. If the contents of the two data sets are the same, it indicates that the DoS attack is not successful; on the contrary, if the fifth data set is missing some path information compared with the third data set, it indicates that the DoS attack is successfully executed; if the attack is successful, it indicates that the DoS attack vulnerability exists, otherwise it does not exist.

[0084] Specifically, reconnaissance based on Announce messages. This node parses the received Announce message and obtains the fifth data set (DAPTDS, DoS Attack Path Tree Data set), which records the node information on the attack path. The third data set is compared with the fifth data set. If the contents of the two data sets are the same, it indicates that the DoS attack is unsuccessful; on the contrary, if the fifth data set is missing part of the path information compared with the third data set, it indicates that the DoS attack is successfully executed.

[0085] The second type: S5 includes: using the target MAC address to construct an Ethernet frame header to generate a third Management message and send it to the neighboring node, so that the neighboring node feeds back a fourth Management message, and obtains the status parameters of the target port from the fourth Management message; if the port status is displayed as "Disabled", it means that the DoS attack has been successful; otherwise, the port is in other states and the attack has not been successful; if the attack is successful, it indicates that the DoS attack vulnerability exists, otherwise it does not exist.

[0086] Specifically, reconnaissance based on Management messages. In the second method, this node actively conducts reconnaissance on the status parameters of the target port by constructing a Management message. This node constructs an Ethernet frame header using the target MAC address and generates a Management message, and uses the Management GET function to request the status parameters of the target port. This node sets the operation object to the port data set (PORT_DATA_SET) of the target port and obtains the status parameters of the port from the data set. If the port status is displayed as "Disabled", it means that the DoS attack has been successful; otherwise, the port is in other states and the attack has not been successful.

[0087] Example 3

[0088] Based on Example 1, S4 includes: S41: obtaining the priority information MasterPriority of the master clock from the second data set; S42: the source address of the Ethernet frame is set to the MAC address of this node, and the destination address is set to the default multicast address of the gPTP protocol; fill in the remaining fields of the Announce message and set the priority field AttackPriority. The PTP clock priority of this node is better than the priority of the original master clock in the gPTP domain, that is, AttackPriority is less than MasterPriority; S43: This node sends the generated Announce message to the neighboring node to attack.

[0089] Specifically, this node sends a high-priority Announce message to make this node dominant in the master clock selection algorithm (BMCA) of the gPTP protocol, deceiving other nodes in the domain to obtain the master clock identity of the gPTP domain. The specific process of S4 is as follows:

[0090] (1) Obtaining the priority information MasterPriority of the master clock from the second data set;

[0091] (2) Construct an Announce message, in which the source address of the Ethernet frame is set to the MAC address of the local node, and the destination address is set to the default multicast address of the gPTP protocol;

[0092] (3) Construct an Announce message, fill in the remaining fields of the Announce message, and set the priority field AttackPriority to satisfy the requirement that AttackPriority is less than MasterPriority, indicating that the PTP clock priority of this node is higher than the priority of the original master clock in the gPTP domain;

[0093] (4) This node sends the generated Announce message to the neighboring node to launch the attack.

[0094] Furthermore, S5 includes: extracting a sixth data set from the Announce message received from the neighboring node, and obtaining the current master clock identity information ClockId corresponding to the gPTP from the sixth data set; if the current master clock identity information ClockId is consistent with the ClockId in the Announce message sent by this node, and the master clock priority in the sixth data set is the same as the priority AttackPriority set in the Announce message sent by this node, then the deception attack is successfully executed; otherwise, the deception attack fails; if the attack is successful, it indicates that the deception attack vulnerability exists, otherwise it does not exist.

[0095] Specifically, this node receives the Announce message from the neighboring node, extracts the sixth data set (SAGMDS, Spoofing Attack Grand Master Data set) from it, and obtains the ClockId information of the current master clock of gPTP. If it is consistent with the ClockId in the Announce message sent by this node, and the master clock priority in the sixth data set is the same as the AttackPriority set in the Announce message sent by this node, then the spoofing attack is executed successfully; otherwise, the spoofing attack fails.

[0096] Example 4

[0097] Based on Example 1, S4 includes: S41: extracting the target MAC address of the target to be attacked from the third data set; S42: capturing Sync / Follow_Up messages from neighboring nodes, and filtering out Sync messages and Follow_Up messages with consistent SequenceId fields as a pair of legal Sync / Follow_Up messages; S43: modifying the MAC destination address of the Ethernet frame header of the legal Sync / Follow_Up message to the MAC address of the target to be attacked; S44: sending the Sync / Follow_Up message with the modified destination address to the target to be attacked for attack.

[0098] Specifically, when a device using the gPTP protocol works in an unsafe scenario, the device's PTP clock may be subject to a replay attack. The gPTP protocol uses the Sync / Follow_Up messages to transmit the master clock's local clock timestamp through the synchronization spanning tree. The slave clock that receives the Sync / Follow_Up message will adjust the slave clock's local clock according to the timestamp contained in the message. This node can capture the Sync / Follow_Up message sent by the neighboring node and replay it to other nodes, causing the clocks of other nodes to synchronize to the wrong time. The specific process of S4:

[0099] (1) This node extracts the target MAC address of the target to be attacked from the third data set;

[0100] (2) Capture Sync / Follow_Up messages from neighboring nodes. If there are multiple Sync / Follow_Up messages sent by neighboring nodes, select the Sync message and Follow_Up message with the same SequenceId field as a pair of legal Sync / Follow_Up messages;

[0101] (3) Set the MAC destination address of the Ethernet frame header of the Sync / Follow_Up message to the MAC address of the target to be attacked;

[0102] (4) This node sends the captured and modified Sync / Follow_Up message to the target to be attacked to carry out the attack.

[0103] Further, S5 includes: constructing an Ethernet frame header using the target MAC address and generating a fifth Management message; sending the fifth Management message to the neighboring node to obtain the sixth Management message replied by the neighboring node, and obtaining the time attribute of the target port from the sixth Management message; if the difference between the local clock time of the target and the timestamp contained in the Follow_Up message in the replay attack is lower than a threshold, it indicates that the replay attack is successful; otherwise, the replay attack fails; if the attack is successful, it indicates that the replay attack vulnerability exists, otherwise it does not exist.

[0104] Specifically, this node uses a replay attack to interfere with the clock synchronization of the target, causing the target's local clock to synchronize to the wrong time. This node actively scouts the status of the target port by constructing a Management message. This node constructs an Ethernet frame header using the target MAC address and generates a Management message, using the Management GET function to request the status information of the target port. This node sets the operation object to the target's local clock time and obtains the target's time attribute from the data set. If there is only a small difference between the target's local clock time and the timestamp contained in the Follow_Up message in the replay attack, the replay attack is successful; otherwise, the replay attack fails.

[0105] Example 5

[0106] Based on Example 1, S4 includes: S41: obtaining the current master clock identity information ClockId corresponding to gPTP from the second data set, and obtaining the neighbor node priority information; S42: using the current master clock identity information ClockId to forge the master clock Announce message, and setting the priority field to be greater than the neighbor node priority; S43: setting the Announce message destination address to the gPTP default multicast address; S44: sending the constructed Announce message to the neighbor node to attack.

[0107] Specifically, there may be vulnerabilities in the specific implementation of the gPTP protocol, and the protocol vulnerabilities can be exploited to attack devices running the gPTP protocol. The Announce message is the information carrier of the master clock selection algorithm in the gPTP protocol. The PTP instance compares the clock priority vector contained in the received Announce message with the local clock priority vector to make a state decision for the PTP port. In the gPTP protocol, the state decision is executed at least once in each Announce message cycle, but in the actual program implementation, in order to save resource consumption, the state decision may only be executed under specific circumstances. For example, in linuxPTP, a Linux implementation of the gPTP protocol, when the Announce message received by the PTP instance has not changed, the port will not execute the state decision. Attack scenarios such as Figure 3 As shown in the figure, the master clock keeps sending the same Announce message to the neighboring node, causing the first port of the neighboring node to not execute the state decision and the state of the first port to not change. At this time, if this node forges the master clock to send a low-priority Announce message to the second port of the neighboring node, causing the neighboring node to become the master clock, and because the first port will not trigger the state decision caused by the original master clock Announce message, there will be two master clocks in the gPTP domain. The specific process of S4:

[0108] (1) The node obtains the ClockId information of the current gPTP master clock from the second data set and uses the second method of information reconnaissance to obtain the priority information of the neighboring node;

[0109] (2) Use the current master clock ClockId information to forge the master clock Announce message and set the priority field to be greater than the neighbor node priority;

[0110] (3) Set the destination address of the Announce message to the gPTP default multicast address;

[0111] (4) This node sends the constructed Announce message to the neighboring node to carry out the attack.

[0112] Further, S5 includes: receiving an Announce message sent by a neighboring node, parsing the Announce message to obtain the seventh data set and obtaining the current master clock identity information ClockId corresponding to the gPTP therefrom; comparing the current master clock identity information ClockId with the ClockId in the second data set, if the ClockId is different, the vulnerability exploitation attack is successful; otherwise, the vulnerability exploitation attack fails; if the attack is successful, it indicates that the vulnerability exploitation attack vulnerability exists, otherwise it does not exist.

[0113] Specifically, this node receives the Announce message sent by the neighboring node, parses the Announce message to obtain the seventh data set (VAGMDS, Vulnerability Attack Grand Master Data set), obtains the current master clock ClockId information from it, and compares it with the ClockId information of the second data set. If the ClockId information is different, the vulnerability exploitation attack is successful; otherwise, the vulnerability exploitation attack fails.

[0114] Example 6

[0115] like Figure 4 As shown, this embodiment provides a vulnerability analysis device of the gPTP protocol applied to an edge node, including a receiving and parsing module, a constructing and sending module, a monitoring module, an attack module and an analysis module.

[0116] A receiving and parsing module is used to continuously receive Pdelay_Req messages in PTP information from neighboring nodes, and obtain a first data set including a gPTP Domain field, a sourcePortId field, and a sequenceId field; the gPTP protocol is deployed in the corresponding network of this node and its neighboring nodes.

[0117] Construct a sending module, which is used to construct a Pdelay_Resp message and a Pdelay_Resp_Follow_Up message using the first data set, and feed it back to the neighboring node so that it sends Sync / Follow_up and Announce messages. A monitoring module is used to monitor the Announce message sent by the neighboring node, and obtain the second data set including the gPTP domain master clock information and the third data set including the gPTP domain path information; extract the reconnaissance target from the gPTP domain path information to construct the first Management message; send the first Management message to the neighboring node to obtain the second Management message replied by it; obtain the fourth data set including the current parameter set of the reconnaissance target from the second Management message; use the second data set, the third data set and the fourth data set as the gPTP domain information.

[0118] The attack module is used to use the gPTP domain information to attack the target node in the gPTP domain. The attack module can perform four types of attacks, namely DoS attack, spoofing attack, replay attack and vulnerability exploitation attack. The attack module can obtain the target to be attacked from the reconnaissance module. Under different attack methods, the attack module will guide the transmitter to construct different PTP messages and send them to the target to be attacked.

[0119] The analysis module is used to analyze the attack results to determine whether the vulnerability of the gPTP protocol exists; if the attack is successful, it indicates that the vulnerability exists, otherwise it does not exist. After the attack is completed, the analysis module detects the attack results. The detection mainly relies on two methods of the reconnaissance module to detect whether the attack has achieved the expected effect.

[0120] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A vulnerability analysis method for the gPTP protocol applied to edge nodes, characterized in that: include: S1: Continuously receive Pdelay_Req messages in PTP information from neighboring nodes, and obtain a first data set including a gPTPDomain field, a sourcePortId field, and a sequenceId field; the network corresponding to this node and its neighboring nodes is deployed with the gPTP protocol; S2: construct a Pdelay_Resp message and a Pdelay_Resp_Follow_Up message using the first data set, and feed them back to the neighboring node so that it sends an Announce message; S3: monitor the Announce message sent by the neighboring node, and obtain a second data set including the gPTP domain master clock information and a third data set including the gPTP domain path information; extract the reconnaissance target from the gPTP domain path information to construct a first Management message; send the first Management message to the neighboring node to obtain a second Management message replied by the neighboring node; Acquire a fourth data set including a current parameter set of the target to be reconnaissance from the second Management message; use the second data set, the third data set, and the fourth data set as gPTP domain information; S4: using the gPTP domain information to attack the target node in the gPTP domain; S5: Analyze the attack results to determine whether the vulnerability of the gPTP protocol exists; if the attack is successful, it indicates that the vulnerability exists, otherwise it does not exist.

2. The vulnerability analysis method of the gPTP protocol applied to edge nodes according to claim 1, characterized in that: The S4 includes: S41: extracting the target MAC address of the target to be attacked from the third data set, then constructing an Ethernet frame header, setting the source MAC address to an arbitrary MAC address, and setting the destination MAC address to the extracted target MAC address; S42: construct the remaining fields of the Pdelay_Req message, wherein the value of the ClockId field is set to ClockId1, and generate the first Pdelay_Req message; S43: construct the remaining fields of the Pdelay_Req message, but set the value of the ClockId field to any ClockId2 different from ClockId1, and generate a second Pdelay_Req message; S44: Send the generated first and second Pdelay_Req messages to the target node to attack.

3. The vulnerability analysis method of the gPTP protocol applied to edge nodes as claimed in claim 2, characterized in that: The S5 includes: Parse the received Announce message to obtain a fifth data set recording node information on the attack path; Comparing the third data set with the fifth data set, if the contents of the two data sets are the same, it indicates that the DoS attack is unsuccessful; on the contrary, if the fifth data set is missing part of the path information compared with the third data set, it indicates that the DoS attack is successfully executed; If the attack is successful, it indicates that the DoS attack vulnerability exists, otherwise it does not exist.

4. The vulnerability analysis method of the gPTP protocol applied to edge nodes as claimed in claim 2, characterized in that The S5 includes: Using the target MAC address to construct an Ethernet frame header to generate a third Management message and send it to a neighboring node, so that the neighboring node feeds back a fourth Management message, and obtains the state parameter of the target port from the fourth Management message; If the port status is displayed as "Disabled", it means that the DoS attack has been successful; otherwise, the port is in other states and the attack has not been successful; If the attack is successful, it indicates that the DoS attack vulnerability exists, otherwise it does not exist.

5. The vulnerability analysis method of the gPTP protocol applied to edge nodes according to claim 1, characterized in that: The S4 includes: S41: Acquire the priority information MasterPriority of the master clock from the second data set; S42: The source address of the Ethernet frame is set to the MAC address of this node, and the destination address is set to the default multicast address of the gPTP protocol; the remaining fields of the Announce message are filled and the priority field AttackPriority is set. The PTP clock priority of this node is higher than the priority of the original master clock of the gPTP domain; S43: This node sends the generated Announce message to the neighboring node to attack.

6. The vulnerability analysis method of the gPTP protocol applied to edge nodes according to claim 5, characterized in that: The S5 includes: Extracting a sixth data set from the Announce message received from the neighboring node, and obtaining the current master clock identity information ClockId corresponding to the gPTP from the sixth data set; If the current master clock identity information ClockId is consistent with the ClockId in the Announce message sent by this node, and the master clock priority in the sixth data set is the same as the priority AttackPriority set in the Announce message sent by this node, the deception attack is successfully executed; otherwise, the deception attack fails; If the attack is successful, then the sign spoofing attack vulnerability exists, otherwise it does not exist.

7. The vulnerability analysis method of the gPTP protocol applied to edge nodes according to claim 1, characterized in that: The S4 includes: S41: extracting a target MAC address of a target to be attacked from the third data set; S42: Capture the Sync / Follow_Up message from the neighboring node, and select the Sync message and Follow_Up message with the same SequenceId field as a pair of legal Sync / Follow_Up messages; S43: modify the MAC destination address of the Ethernet frame header of the legitimate Sync / Follow_Up message to the MAC address of the target to be attacked; S44: Send the Sync / Follow_Up message with the modified destination address to the target to be attacked to carry out the attack.

8. The vulnerability analysis method of the gPTP protocol applied to edge nodes according to claim 7, characterized in that: The S5 includes: Constructing an Ethernet frame header using the target MAC address and generating a fifth Management message; Sending the fifth Management message to the neighboring node to obtain a sixth Management message replied by the neighboring node, and obtaining the time attribute of the target port from the sixth Management message; If the difference between the target's local clock time and the timestamp contained in the Follow_Up message in the replay attack is lower than the threshold, it indicates that the replay attack is successful; otherwise, the replay attack fails; if the attack is successful, it indicates that the replay attack vulnerability exists, otherwise it does not exist.

9. The vulnerability analysis method of the gPTP protocol applied to edge nodes according to claim 1, characterized in that: The S4 includes: S41: Obtain the current master clock identity information ClockId corresponding to the gPTP from the second data set, and obtain the neighbor node priority information; S42: Forge a master clock Announce message using the current master clock identity information ClockId, and set the priority field to be greater than the neighbor node priority; S43: Set the destination address of the Announce message to the gPTP default multicast address; S44: Send the constructed Announce message to the neighboring node to attack.

10. The vulnerability analysis method of the gPTP protocol applied to edge nodes according to claim 9, characterized in that: The S5 includes: Receive an Announce message sent by a neighboring node, parse the Announce message to obtain a seventh data set, and obtain the current master clock identity information ClockId corresponding to the gPTP from the seventh data set; Compare the current master clock identity information ClockId with the ClockId in the second data set, if the ClockIds are different, the vulnerability exploitation attack is successful; otherwise, the vulnerability exploitation attack fails; If the attack is successful, it indicates that the vulnerability exists, otherwise it does not exist.

Images