Time synchronization information security examination system and method based on multi-link comparison

Abstract

The invention relates to the technical field of time synchronization, and discloses a time synchronization information security review system and method based on multilink comparison, the system comprises a clock synchronization server and a clock synchronization client, the clock synchronization server comprises n L ends with common clock reference sources, the L ends are respectively marked as L1, L2,..., Ln-1 and Ln, the clock synchronization client comprises an R end, and the R end is marked as L1, L2,..., Ln-1 and Ln. L1, L2,..., Ln-1 and Ln are respectively in communication connection with the R end; wherein n is greater than or equal to 2 and is an integer, the L end represents a reference source end, and the R end represents a local clock end. The method solves the problem that illegal information enters the system while the system is still due to the fact that interactive data changes caused by illegal link attacks and local clock self-correction cannot be effectively judged in the prior art.

Description

Technical Field

[0001] The present invention relates to the technical field of time synchronization, and in particular to a time synchronization information security review system and method based on multi-link comparison. Background Art

[0002] Time is a quantity that records the duration of each event and the intervals between them. Time synchronization is to use some technical means to make each device in the same system have the same time reference. Common technical means can be divided into two types according to the transmission method: wireless transmission and wired transmission. The former often uses short / long wave satellite timing, while wired time synchronization based on optical fiber transmission is more widely used because of its mature long-distance and large-capacity optical communication technology and the characteristics of flexible optical network networking.

[0003] In actual fiber-optic time synchronization systems, there must be physical signal pulse transmission and information data interaction between two or more nodes. In order to prevent attackers from tampering with data during information interaction and causing time synchronization security issues, the traditional solution is to use cryptographic technologies such as encryption authentication and key management to protect the interactive data. However, by seizing the permissions of the time synchronization server, attackers can bypass the traditional cryptographic protection mechanism and directly change the size of the timestamp in the interactive data. At the same time, the self-correction of the local clock in the link will also cause the timestamp data to change, resulting in the inability to directly determine from the received link interaction information whether the data change is caused by an illegal link attack or the self-correction of the local clock, which is not conducive to the system's targeted and effective prevention of illegal attacks, and makes the system have great security risks.

[0004] like Figure 1 As shown in FIG. 1 , the two-way time synchronization system can be divided into two parts: the L end (reference source end) and the R end (local clock end). The L end includes a clock, a sending unit, and a receiving unit, and the R end includes a clock, a sending unit, a receiving unit, and a clock update unit.

[0005] The purpose of the time synchronization system is to make the time difference between the R-end clock and the L-end clock zero. On the one hand, the time when the L-end sends the synchronization signal is recorded as T L At the same time, the time interval counter at the L end starts counting and stops counting when the synchronization signal sent by the R end is received. The count value is T LR On the other hand, the time when the R end sends the synchronization signal is recorded as T R At the same time, the time interval counter at the R end starts counting and stops counting when the synchronization signal sent by the L end is received. The count value is T RL Assume that the pulse transmission delay from L to R is τ LR , the time delay of the pulse from the R end to the L end is τ RL , then:

[0006] T LR =(T R +τ RL )-T L (0-5)

[0007] T RL =(T L +τ LR )-T R (0-6)

[0008] The time difference between the R terminal and the L terminal is:

[0009]

[0010] Among them, the delay difference (τ) caused by the asymmetry of the transmission channel LR -τ RL ) can be obtained in advance through equipment calibration and channel estimation. RL It can be measured directly at the R end, while T LR It needs to be measured at the L end and transmitted to the R end through the information exchange channel for correcting the local clock.

[0011] In the above data interaction process, on the one hand, the attacker can tamper with T LR To affect the clock correction at the R end, thereby achieving the purpose of link delay attack; on the other hand, it can be seen from formula (1-1) that after the R end corrects the local clock, T R The jump will also cause the next transmission time T LR Both of these situations will cause the time difference between the R end and the L end to change significantly compared to the previous round. The problem is that when the time synchronization system is reviewing and preventing illegal information, it cannot effectively and accurately distinguish the above two situations. Summary of the invention

[0012] In order to overcome the shortcomings of the prior art, the present invention provides a time synchronization information security review system and method based on multi-link comparison, which solves the problems existing in the prior art that it is impossible to effectively identify illegal link attacks and interactive data changes caused by local clock self-correction, which allows illegal information to sneak into the system.

[0013] The technical solution adopted by the present invention to solve the above problems is:

[0014] A time synchronization information security review system based on multi-link comparison includes a clock synchronization server and a clock synchronization client. The clock synchronization server includes n L terminals with a common clock reference source, which are respectively denoted as L 1 , L 2 ,...,L n-1 , Ln , the clock synchronization client includes an R end, L 1 、L 2 、...、L n-1 、L n are respectively communicatively connected to the R end; where n≥2 and n is an integer, the L end represents the reference source end, and the R end represents the local clock end.

[0015] As a preferred technical solution, L 1 、L 2 、...、L n-1 、L n is used to send link data, and the R end is used to receive link data and calculate for each link to determine whether there is an illegal attack.

[0016] As a preferred technical solution, the R end includes a data storage unit, an arithmetic unit, a comparison unit, and a clock update unit that are communicatively connected in sequence, and the clock update unit is communicatively connected to the data storage unit.

[0017] As a preferred technical solution, the data storage unit is used to: save the time differences ΔT 1 、ΔT 2 、...、ΔT u 、...、ΔT n-1 and ΔT n of n bidirectional time synchronization links, and the expression of the time difference is:

[0018]

[0019] where, ΔT u represents the time difference of the u-th link; u represents the number of the bidirectional time synchronization link, u = 1,..., n; T Ru represents the moment when the R end sends a synchronization signal in the u-th link; T Lu represents the moment when the L end sends a synchronization signal in the u-th link; T LRu represents the count value when the L end receives the synchronization signal sent by the R end in the u-th link; T RLu represents the count value when the R end receives the synchronization signal sent by the L end in the u-th link; τ LRu represents the time delay of the pulse of the u-th link from the L end to the R end; τ RLu represents the time delay of the pulse of the u-th link from the R end to the L end.

[0020] As a preferred technical solution, the arithmetic unit is used to: select a certain link L i as the reference link, calculate the absolute value of the difference between the time differences of the reference link and the remaining n - 1 links respectively, and the formula is:

[0021]

[0022] in, represents the absolute value of the time difference between the two links; i represents the link L selected as the reference i The number is 1≤i≤n, ΔT i is the reference link L i j represents the time difference between the reference link L i The numbers of the remaining bidirectional time synchronization links among the n links, j∈{1,...,n}\{i}, \ indicates inequality, ΔT j Indicates link L j The computing unit obtains a total of 1 reference link time difference ΔT i And the absolute value data of n-1 differences.

[0023] As a preferred technical solution, the comparison unit is used to: determine the value used to judge based on the 3σ principle of Gaussian distribution The initial threshold of the range is 3σ, and the calculation formula of σ is:

[0024]

[0025] in, Indicates the time difference ΔT of n links u The average value of is as follows:

[0026]

[0027] If the difference of a link is greater than the initial threshold 3σ, the link is marked as 1; if the difference of a link is less than or equal to the initial threshold 3σ, the link is marked as 0.

[0028] As a preferred technical solution, the clock updating unit is used to: update the clock according to the 1 or 0 situation of the link determined by the comparison unit, including the following situations:

[0029] (1) If less than half of the comparison results among the n-1 comparison results are 1, it is considered that the corresponding link may be illegally attacked, and the clock update unit reads the data information of all normal links that have not been illegally attacked in the data storage unit to update the local clock of the R end;

[0030] (2) If more than or equal to half of the comparison results among the n-1 comparison results are 1 or all are 1, then switch the selected reference link and perform the calculation and comparison again;

[0031] (3) If all n-1 comparison results are 0, it is considered that all n links are safe, and the clock update unit reads the data information of all links from the data storage unit to update the local clock of the R end.

[0032] As a preferred technical solution, the common clock reference source is Beidou, GPS signal or the same level clock source in a multi-level time and frequency distribution link.

[0033] A time synchronization information security review method based on multi-link comparison uses the time synchronization information security review system based on multi-link comparison to perform time synchronization information security review on a clock synchronization server and a clock synchronization client.

[0034] As a preferred technical solution, by calculating, analyzing and comparing the data relationship between different links, it is determined whether the link data change is related to an illegal attack, and finally the local clock in the link is adjusted according to the comparison result.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] The present invention calculates the deviation of the time difference of n bidirectional time synchronization links based on a reference link, and analyzes the relationship between the n links according to the deviation result and the set initial threshold value, so as to effectively discover the illegal attacks that may exist in the links and distinguish them from the data changes caused by the self-correction of the local clock, thereby realizing the security review of the interactive information of the time synchronization system, thereby greatly reducing the possibility of successful illegal attacks using time synchronization information, and significantly improving the security of the time synchronization system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a schematic diagram of a two-way time synchronization system;

[0038] Figure 2 It is a schematic diagram of a multi-link time synchronization system;

[0039] Figure 3 Schematic diagram of multi-link data processing at the R end. DETAILED DESCRIPTION

[0040] The present invention will be further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0041] Example 1

[0042] like Figures 1 to 3 As shown, the present invention is applicable to a two-way time synchronization system.

[0043] Aiming at the problem that the optical fiber time synchronization system cannot effectively distinguish the interactive data changes caused by illegal link attacks and local clock self-correction, which leads to illegal information taking the opportunity to sneak into the system, the present invention proposes a time synchronization information review method based on a multi-link comparison method. By calculating, analyzing and comparing the data relationship between different links, it is judged whether the link data change is related to the illegal attack, thereby completing the security review of the interactive information of the time synchronization system, and finally adjusting the local clock in the link according to the review result.

[0044] This patent can effectively detect possible illegal attacks in the link and distinguish them from data changes caused by local clock self-correction, thereby greatly reducing the possibility of successful illegal attacks using time synchronization information and significantly improving the security of the time synchronization system.

[0045] like Figure 2 As shown, there are n L terminals (L 1 , L 2 ,...,L n-1 and L n ), the public clock reference source here includes but is not limited to Beidou, GPS signals or the same-level clock source in the multi-level time and frequency distribution link. There is an R end on the time synchronization client, and each L end and R end are based on two-way time synchronization. The R end will receive a total of n link data from the L end, and calculate each link on the R end to determine whether there is an illegal attack. The data processing module of the R end is as follows Figure 3 As shown, it mainly includes a data storage unit, an operation unit, a comparison unit and a clock update unit, wherein the data storage unit is used to store the time difference ΔT of n bidirectional time synchronization links. 1 , ΔT 2 , ..., ΔT u , ..., ΔT n-1 and ΔT n .

[0046]

[0047] Where, ΔT u represents the time difference of the u-th link; u represents the number of the bidirectional time synchronization link, u=1,...,n; T Ru represents the time when the R end sends the synchronization signal in the u-th link; T Lu represents the time when the L end of the u-th link sends the synchronization signal; T LRu It represents the count value when the L end of the u-th link receives the synchronization signal sent by the R end; T RLu Indicates the count value when the R end in the u-th link receives the synchronization signal sent by the L end; τ LRurepresents the time delay of the u-th link pulse from the L end to the R end; τ RLu It represents the time delay of the u-th link pulse from the R end to the L end.

[0048] The computing unit can select one of the links L i As the reference link, calculate the time difference between the reference link and the remaining n-1 links and take the absolute value, as shown in formula (1-5):

[0049]

[0050] in, represents the absolute value of the time difference between the two links; i represents the link L selected as the reference i The number is 1≤i≤n, ΔT i is the reference link L i j represents the time difference between the reference link L i The numbers of the remaining bidirectional time synchronization links among the n links, j∈{1,...,n}\{i}, \ indicates inequality, ΔT j Indicates link L j Plus the reference link L i The time difference ΔT i , the calculation unit will get a total of n values ​​(1 reference link time difference and n-1 absolute value data of the difference). Assume that the time difference ΔT of the first link is selected 1 For reference, the arithmetic unit will get and

[0051] The comparison unit determines the difference between the multi-link time differences based on the 3σ principle of Gaussian distribution. The initial threshold of the range is 3σ, where σ is the time difference ΔT of n links. u The standard deviation of is expressed as:

[0052]

[0053] in Indicates the time difference ΔT of n links u The average value of is as follows:

[0054]

[0055] If the difference of a link is greater than the initial threshold value 3σ, the link is marked as 1; if the difference of a link is less than or equal to the initial threshold value 3σ, the link is marked as 0; the clock update unit will perform corresponding clock updates based on the 1 and 0 determined by the comparison unit, and there are the following situations:

[0056] 1. If less than half of the n-1 comparison results have a value of 1, it is considered that the corresponding bidirectional time synchronization links may be illegally attacked, that is, the interactive data may be tampered with by the attacker. The clock update unit reads the data information of all normal links that have not been illegally attacked in the data storage unit to update the local clock of the R end.

[0057] 2. If more than half of the n-1 comparison results are 1 or all are 1, the result cannot be directly judged because it may be the time difference ΔT of the reference link. i It may be tampered by an attack, or n-1 links other than the reference link may be attacked, so it is necessary to switch the selected reference link and perform the calculation and comparison again.

[0058] 3. If all n-1 comparison results are 0, it is considered that all n links are safe, the interactive data is normal and has not been tampered with, and the clock update unit reads the data information of all links in the data storage unit to update the local clock of the R end.

[0059] In the above three situations, the clock update unit will read the data information of all normal links that have not been illegally attacked in the data storage unit to update the local clock of the R end.

[0060] Through the above data processing, the impact of local clock self-correction on link interaction data can be offset, and the links where illegal attacks may occur can be effectively analyzed, realizing the security review of time synchronization information, which is conducive to the system's targeted processing and prevention of illegal attacks.

[0061] Example 2

[0062] like Figures 1 to 3 As shown, as a further optimization of Example 1, based on Example 1, this example provides a more detailed implementation method.

[0063] There are currently five links in the bidirectional time synchronization system. In the operation unit, the first link L is selected. 1 The time difference ΔT 1 As a reference, we can get The comparison unit makes a comparison based on the initial threshold value 3σ on the above four sets of data:

[0064] 1. Among the 4 comparison results, less than half of the values ​​are 1. If If the corresponding comparison result is 1, it is considered that the fourth bidirectional time synchronization link L 4 There may be illegal attacks, that is, the interaction data may be tampered by the attacker. The clock update unit reads the link L from the data storage unit. 1 , L 2 , L 3 and L 5The data information is used to update the local clock at the R end.

[0065] 2. Among the 4 comparison results, some values ​​greater than or equal to half are 1 or all are 1. If The corresponding comparison result is 1, The corresponding comparison result is 1 and If the comparison result is 1, the result cannot be directly determined, and the second link L is switched. 2 The time difference ΔT 2 As a reference link, re-perform the calculation and comparison.

[0066] 3. If all 4 comparison results are 0, that is, all 5 links are secure, the interactive data is considered normal and has not been tampered with. The clock update unit will read the link L from the data storage unit. 1 , L 2 , L 3 , L 4 and L 5 The data information is used to update the local clock at the R end.

[0067] The present invention calculates the deviation of the time difference of n bidirectional time synchronization links based on a reference link, and analyzes the relationship between the n links according to the deviation result and the set initial threshold value, so as to effectively discover possible illegal attacks in the links and distinguish them from data changes caused by local clock self-correction, thereby realizing a security review of the interactive information of the time synchronization system, thereby greatly reducing the possibility of successful illegal attacks using time synchronization information, and significantly improving the security of the time synchronization system.

[0068] As described above, the present invention can be preferably implemented.

[0069] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0070] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. According to the technical essence of the present invention, within the spirit and principles of the present invention, any simple modification, equivalent replacement and improvement made to the above embodiment still falls within the protection scope of the technical solution of the present invention.

Claims

1. A time synchronization information security review system based on multi-link comparison, characterized in that: It includes a clock synchronization server and a clock synchronization client. The clock synchronization server includes n L terminals with a common clock reference source, which are respectively denoted as L1, L2, ..., L n-1 , L n The clock synchronization client includes an R terminal, L1, L2, ..., L n-1 , L n They are respectively connected to the R end for communication; wherein, n≥2 and n is an integer, the L end represents the reference source end, and the R end represents the local clock end.

2. According to claim 1, a time synchronization information security review system based on multi-link comparison is characterized in that: L1, L2, ..., L n-1 , L n Used to send link data, the R end is used to receive link data and calculate each link to determine whether there is an illegal attack.

3. According to claim 2, a time synchronization information security review system based on multi-link comparison is characterized in that: The R end includes a data storage unit, an operation unit, a comparison unit, and a clock update unit which are communicatively connected in sequence, and the clock update unit is communicatively connected to the data storage unit.

4. A time synchronization information security review system based on multi-link comparison according to claim 3, characterized in that: The data storage unit is used to store the time differences ΔT1, ΔT2, ..., ΔT of n bidirectional time synchronization links. u , ..., ΔT n-1 and ΔT n , the expression of time difference is: Where, ΔT u represents the time difference of the u-th link; u represents the number of the bidirectional time synchronization link, u = 1,...,n; T Ru represents the time when the R end sends the synchronization signal in the u-th link; T Lu represents the time when the L end of the u-th link sends the synchronization signal; T LRu It represents the count value when the L end of the u-th link receives the synchronization signal sent by the R end; T RLu Indicates the count value when the R end in the u-th link receives the synchronization signal sent by the L end; τ LRu represents the time delay of the u-th link pulse from the L end to the R end; τ RLu It represents the time delay of the u-th link pulse from the R end to the L end.

5. A time synchronization information security review system based on multi-link comparison according to claim 4, characterized in that: The operation unit is used to select a link L i As the reference link, calculate the time difference between the reference link and the remaining n-1 links and take the absolute value. The formula is: in, represents the absolute value of the difference between the time differences of the two links; i represents the link L selected as the reference i The number is 1≤i≤n, ΔT i is the reference link L i j represents the time difference between the reference link L i The numbers of the remaining bidirectional time synchronization links among the n links, j∈{1,...,n}\{i}, \ indicates inequality, ΔT j Indicates link L j The computing unit obtains a total of 1 reference link time difference ΔT i And the absolute value data of n-1 differences.

6. A time synchronization information security review system based on multi-link comparison according to claim 5, characterized in that: Comparison unit is used for: Determining the 3σ principle based on Gaussian distribution for judgment The initial threshold of the range is 3σ, and the calculation formula of σ is: in, Indicates the time difference ΔT of n links u The average value of is as follows: If the difference of a link is greater than the initial threshold 3σ, the link is marked as 1; if the difference of a link is less than or equal to the initial threshold 3σ, the link is marked as 0.

7. A time synchronization information security review system based on multi-link comparison according to claim 6, characterized in that: The clock updating unit is used to update the clock according to the 1 or 0 situation of the link determined by the comparison unit, including the following situations: (1) If less than half of the comparison results among the n-1 comparison results are 1, it is considered that the corresponding link may be illegally attacked, and the clock update unit reads the data information of all normal links that have not been illegally attacked in the data storage unit to update the local clock of the R end; (2) If more than or equal to half of the comparison results among the n-1 comparison results are 1 or all are 1, then switch the selected reference link and perform the calculation and comparison again; (3) If all n-1 comparison results are 0, it is considered that all n links are safe, and the clock update unit reads the data information of all links from the data storage unit to update the local clock of the R end.

8. A time synchronization information security review system based on multi-link comparison according to any one of claims 1 to 7, characterized in that: The public clock reference source is Beidou, GPS signal or the same-level clock source in a multi-level time and frequency distribution link.

9. A time synchronization information security review method based on multi-link comparison, characterized in that: A time synchronization information security review system based on multi-link comparison as described in any one of claims 1 to 8 is used to perform time synchronization information security review between a clock synchronization server and a clock synchronization client.

10. A time synchronization information security review method based on multi-link comparison according to claim 9, characterized in that: By calculating, analyzing and comparing the data relationships between different links, it is possible to determine whether the link data change is related to an illegal attack, and finally adjust the local clock in the link based on the comparison results.

Images