A high-precision trusted time calibration system and method based on a national secret algorithm

Abstract

The application provides a high-precision trusted time calibration system and method based on a national secret algorithm, and belongs to the technical field of time calibration; a portable Beidou time calibration instrument receives a Beidou satellite signal and provides a tamed signal; a portable atomic clock time server is installed in a host in a drawer type pluggable structure, generates a PTOD private protocol data frame and a synchronous second pulse after taming is completed; after being pulled out, the atomic clock time server enters a time keeping mode based on the tamed atomic clock, and is output through an aviation output interface as an independent time source; a one-way isolation module composed of an optical coupling element is arranged on an input end of the atomic clock time server, signals are received in a physical transfer mode, an internal atomic clock is tamed after decryption and verification, and a PTP / NTP time service signal is output; the application solves the problem that an existing time service system is vulnerable to source time fraud, link attacks and single point fault threats based on physical one-way isolation and physical transfer type calibration double protection, a multi-stage cooperative time keeping architecture and a hierarchical security response mechanism.

Description

Technical Field

[0001] This invention relates to the field of time calibration technology, and in particular to a high-precision and reliable time calibration system and method based on Chinese cryptographic algorithms. Background Technology

[0002] In high-security fields such as financial transactions, power dispatching, government private networks, aerospace telemetry and control, and military communications, time synchronization systems are not only fundamental to ensuring business continuity but also a crucial link in maintaining system security. Currently, high-precision time synchronization systems commonly employ the following technical solutions: (1) Satellite time synchronization combined with network distribution scheme: Deploy GPS or Beidou receivers as external time sources and distribute time to devices in the local area network via NTP (Network Time Protocol) or PTP (Precision Time Protocol). The receiver directly outputs standard format time data (such as NMEA 0183 statement, 8-byte TOD binary format) and 1pps pulse signal. These signals are transmitted in plaintext and unencrypted to the back-end time synchronization server or terminal equipment via serial port, network port or BNC interface.

[0003] (2) Longwave or shortwave time service scheme: Utilize longwave or shortwave time service stations such as Roland C and BPC to receive the standard time signal broadcast by the National Time Service Center. The receiving equipment will directly output the demodulated time information (also in the publicly available standard format) to the user system through a wired interface (such as RS-232 or RS-422).

[0004] (3) Network time synchronization scheme: The time is obtained directly from a public time server on the Internet and synchronized via the UDP protocol. In this scheme, the time data is transmitted on the public network in plaintext NTP packets and lacks an end-to-end security protection mechanism.

[0005] (4) Self-built atomic clock timekeeping scheme: Deploy high-precision atomic clocks (rubidium clocks, cesium clocks or hydrogen clocks) at core nodes to generate time and frequency signals independently without relying on external sources. However, such devices are extremely expensive and bulky, and cannot avoid frequency drift in the long term, so they still need to be calibrated periodically with external standard sources.

[0006] In all the above schemes, there is a direct, physical, or network communication connection between the external time source (satellite receiver, time synchronization station receiver, public NTP server) and the internal time synchronization system. The time data output by the external source is in a standardized, public, and unencrypted format, and the transmission link generally lacks authentication and data integrity protection mechanisms. These deficiencies lead to the following serious security and reliability problems in existing time synchronization systems: First, there is a high dependence on a single external signal source. The system's time reference depends entirely on the external source. Once the external source fails, experiences signal interference, or is intentionally shut down, the entire system's time synchronization function will rapidly deteriorate or even become unusable. Existing technologies lack a redundancy mechanism that allows the system to independently maintain high-precision time even after the external source fails.

[0007] Second, the direct communication connection between the external time source and the system introduces a network attack surface. External sources connect directly to the system's internal processor via physical interfaces such as serial ports, Ethernet ports, and BNC connectors. Attackers can use these interfaces to inject malicious pulses, forge time data, launch buffer overflow attacks, and ultimately control the system's time base or even compromise the entire internal network. In distributed deployment scenarios, external source interfaces are often exposed to uncontrolled environments, making physical security difficult to guarantee.

[0008] Third, the external time data is in a standard, unencrypted format, making it easily deceived and tampered with. The NMEA statement, 8-byte TOD, and 1pps pulse output by the satellite receiver are all public protocols without any encryption or integrity verification. Attackers can easily forge fake time data in the same format, causing the system to synchronize to an incorrect time, resulting in serious consequences such as incorrect financial transactions, malfunctioning power protection systems, and communication system synchronization failures. Even if the transmission link is wired, attackers can still tamper with the time data through physical access, and the system cannot verify the authenticity of the data.

[0009] Fourth, there is a risk of source time spoofing and replay attacks. Due to the lack of an authentication mechanism for the time source, a malicious third party can forge a legitimate external time source and output arbitrary times. The system will unconditionally accept and tame these times, causing the time benchmark to be completely out of control. Attackers can also record a segment of normal time data and replay it at a later point in time, causing the system time to reverse or jump, disrupting applications that rely on time order, such as log auditing and transaction ordering.

[0010] Fifth, supply chain security risks are prominent. Currently, most mainstream external time receiving devices use foreign chips, posing supply chain risks such as backdoor implantation, unpublished code, and supply disruptions. If critical timing systems rely on imported core components for a long period, they may face difficulties in maintenance and spare parts availability should geopolitical conflicts or export controls occur.

[0011] Sixth, there is a lack of standardized protocols between devices and a deficiency in end-to-end security design. Devices such as BeiDou time synchronizers, portable time sources, and time servers typically use non-standardized shortcodes or the general NMEA protocol. Each device processes time data independently, failing to form a complete encrypted and authenticated link from satellite reception to network output. Throughout the calibration chain, time data exists in plaintext at multiple nodes; a breach in any link will lead to a loss of overall time reliability.

[0012] Therefore, there is an urgent need to propose a high-precision and reliable time calibration system based on national cryptographic algorithms, with physical one-way isolation and private encryption protocols, to solve the technical problems of existing time synchronization systems that rely too much on external sources, have directly exposed external source interfaces and unencrypted data, making the system vulnerable to source time spoofing, link attacks, tampering and replay, and supply chain security threats. Summary of the Invention

[0013] To address the aforementioned technical issues, this invention provides a high-precision, reliable time calibration system and method based on national cryptographic algorithms. The system aims to construct a three-tiered reliable time transmission architecture consisting of a portable BeiDou time calibrator, a portable atomic clock time transmitter, and an atomic clock time server. It utilizes a proprietary PTOD protocol protected by national cryptographic algorithms SM4 / SM3 to achieve end-to-end encrypted transmission and integrity verification. Dual physical protection is achieved through physical transport-based calibration using optically coupled unidirectional isolation modules and pluggable modules. A three-tiered, progressively disciplined timekeeping mechanism eliminates the risk of single-point failures. This provides a highly secure and available reliable time link from satellite reception to network output, thereby resolving core security issues in existing time synchronization systems, such as over-reliance on external signal sources, susceptibility to deception and tampering during plaintext transmission of time data, the risk of reverse attacks due to direct exposure of external interfaces, and rapid deterioration of system accuracy after satellite signal loss.

[0014] To achieve the above objectives, this application proposes a high-precision, reliable time calibration system based on national cryptographic algorithms, comprising: A portable BeiDou time synchronization device is used to receive BeiDou satellite signals, generate TOD time data and 1pps second pulses, and provide a discipline signal, which includes 1pps pulses and TOD time data. A portable atomic clock time signaler is installed inside the portable Beidou time synchronization device in a pluggable drawer-type structure. When installed, it receives the discipline signal to discipline the atomic clock inside. After the atomic clock is locked, it generates a PTOD private protocol data frame and a synchronization second pulse that are encrypted with SM4 and verified for integrity with SM3-HMAC. After being removed from the portable Beidou time synchronization device, the portable atomic clock time signaler enters a timekeeping mode based on the disciplined atomic clock, and acts as an independent time source, outputting the PTOD private protocol data frame and synchronization second pulse through the aviation output interface on its own panel. The atomic clock timing server has a one-way isolation module at its input. The server receives PTOD private protocol data frames and synchronization second pulses from the portable atomic clock timing instrument via this module using a physical transfer method. The one-way isolation module only allows unidirectional signal transmission from the outside to the inside. The server performs SM4 decryption and SM3-HMAC integrity verification on the received PTOD private protocol data frames, uses the synchronization second pulses to tame the internal atomic clock, and performs time synchronization by combining the parsed time information. Finally, it outputs a timing signal through the network interface.

[0015] As a further solution, the PTOD private protocol data frame is a fixed-length 56-byte frame, including an 8-byte plaintext header, an 8-byte time information, a 32-byte HMAC digest value, and 8 bytes of padding data. The 8-byte time information, the 32-byte HMAC digest value, and the 8-byte padding data are combined to form a 48-byte data block to meet the length requirements of SM4 block encryption. The 48-byte data block is then encrypted with SM4 to obtain a ciphertext data block, which is then concatenated with the 8-byte plaintext header to form the complete PTOD private protocol data frame.

[0016] As a further solution, the portable atomic clock timing device includes an atomic clock, an FPGA, an MCU, a rechargeable lithium battery, and the aviation output interface. When installed inside the portable Beidou time synchronization device, it receives a 1pps pulse and TOD time data from the discipline signal via a 20-pin contact on the back. The atomic clock uses the 1pps pulse for closed-loop discipline and feeds back the locked state signal to the portable Beidou time synchronization device through the 20-pin contact. The FPGA uses the clock reference locked by the atomic clock to encrypt and perform integrity processing on the TOD time data, generating the PTOD private protocol data frame and synchronization second pulse. When unplugged, it is powered by the rechargeable lithium battery, and the atomic clock enters a timekeeping mode based on the disciplined frequency, continuously outputting the PTOD private protocol data frame and synchronization second pulse.

[0017] As a further solution, the 20-pin contact signal between the portable atomic clock timekeeping device and the portable Beidou time synchronization device includes at least: a UART serial port signal for TOD data interaction, a discipline pulse signal for transmitting 1pps discipline pulses, and a lock feedback signal for the atomic clock to report the lock status to the host.

[0018] As a further solution, the unidirectional isolation module of the atomic clock timing server is composed of optical coupling elements. The optical coupling elements are connected in series on the transmission path of the PTOD private protocol data frame and the transmission path of the synchronization second pulse, respectively, forming a unidirectional physical transfer channel for the signal, thereby physically blocking the reverse data leakage from the inside of the server to the external input interface.

[0019] As a further solution, the atomic clock timing server includes a main control processor, an FPGA, an atomic clock, and a timing network interface. The PTOD private protocol data frame is sent to the main control processor via the one-way isolation module for SM4 decryption and SM3-HMAC verification. After successful verification, the main control processor sends the parsed time data to the FPGA via the SPI bus. The synchronization second pulse is input to the server's internal atomic clock via another one-way isolation module to tame it. The server's internal atomic clock feeds back a lock status signal to the FPGA. Based on the tamed atomic clock and the received time data, the FPGA maintains a local time counter and sets a clock trust flag in the output data packet, outputting a PTP or NTP timing signal through the timing network interface.

[0020] As a further solution, the main control processor also executes the following security policy when receiving and decrypting PTOD private protocol data frames: When a single SM3-HMAC verification fails, the PTOD private protocol data frame is discarded and a log is recorded. If the SM3-HMAC verification fails three times in a row, or if the verification failure rate exceeds 20% within 10 seconds, a warning will be triggered, the yellow indicator light will illuminate, and the receiver will continue to attempt to receive. If SM3-HMAC verification fails 10 times consecutively, or if the verification failure rate exceeds 50% within 1 minute, an alarm is triggered, the discipline is stopped and the system is switched to timekeeping mode, and the clock trust flag in the time data packet output by the network interface is set to invalid. When a time jump exceeding 1 second is detected and an HMAC check error is found, it is determined to be a replay attack. Emergency measures are immediately taken to cut off the power supply to the external input interface, and the on-site log is saved.

[0021] As a further solution, the core processor of the portable Beidou time synchronization device and / or the atomic clock time synchronization server is the Loongson LS2K2000 processor, and its programmable logic device is a domestic FPGA.

[0022] On the other hand, the present invention also provides a high-precision reliable time calibration method based on national cryptographic algorithms, which is applied to a high-precision reliable time calibration system based on national cryptographic algorithms as described in any of the above claims, and includes the following steps: Step a: Receive BeiDou satellite signals using a portable BeiDou time synchronization device, and extract the TOD time data and 1pps second pulse; Step b: When the portable atomic clock time transmitter is installed in the portable Beidou time transmitter in a drawer-type structure, the atomic clock inside the portable atomic clock time transmitter is tamed using the 1pps second pulse, and the atomic clock lock status signal is fed back to the portable Beidou time transmitter to confirm that the taming is completed; after the atomic clock is locked, a PTOD private protocol data frame and a synchronization second pulse are generated after being encrypted with SM4 and verified with SM3-HMAC. Step c: Remove the portable atomic clock time signaler from the portable Beidou time synchronization device, physically transport it to the atomic clock time signaling server, and connect the PTOD private protocol data frame and synchronization second pulse output from the aviation output interface on the panel of the portable atomic clock time signaler to the input interface of the atomic clock time signaling server via cable. Step d: The atomic clock timing server receives the PTOD private protocol data frame and synchronization second pulse through the internal one-way isolation module in a physical transfer manner; it performs SM4 decryption and SM3-HMAC integrity verification on the PTOD private protocol data frame, and extracts the time information after the verification is passed; at the same time, it uses the synchronization second pulse to tame the atomic clock inside the atomic clock timing server. Step e: The atomic clock timing server integrates the verified time information and the tamed internal atomic clock to complete the time calibration, and outputs a high-precision timing signal through the network interface.

[0023] As a further solution, the specific process of generating the PTOD private protocol data frame in step b is as follows: Get the 8 bytes of time information to be sent; The 32-byte HMAC digest value was calculated using the SM3-HMAC algorithm; Add 8 bytes of random padding data, and combine it with the 8 bytes of time information and the 32 bytes of HMAC digest value to form a 48-byte data block, in order to meet the length requirements of SM4 block encryption; The 48-byte data block is encrypted using the SM4 algorithm to obtain a ciphertext data block; The 8-byte plaintext frame header is concatenated with the ciphertext data block to form a 56-byte PTOD private protocol data frame.

[0024] Compared with related technologies, the high-precision reliable time calibration system and method based on national cryptographic algorithms provided by this invention have the following advantages: 1. This invention begins with the time data generated by the portable BeiDou time synchronization device, employing SM4 national cryptographic block encryption and SM3-HMAC integrity verification to convert standard TOD time data into 56-byte PTOD private protocol data frames for transmission. Time is only accepted and updated after both decryption and verification are successful, effectively preventing source time spoofing, link tampering, and replay attacks. Simultaneously, the PTOD private protocol, as a unified encrypted communication protocol within the system, eliminates the security vulnerabilities introduced by inconsistent protocols and frequent conversions between multiple devices in existing technologies, constructing a complete encrypted authentication link from satellite reception to network output.

[0025] 2. This invention incorporates a unidirectional isolation module composed of optical coupling elements at the input of the atomic clock time synchronization server. Utilizing the photoelectric conversion principle, it achieves physical unidirectional signal transmission, preventing any reverse signal from bypassing this isolation module and physically blocking attack paths for reverse data leakage and malicious code injection. Furthermore, the portable atomic clock time synchronization device employs a drawer-type pluggable design, allowing it to be removed from the host after taming and physically transported to the server for calibration as an independent time source. During calibration, there is no wired or wireless communication connection between the host and the server, completely eliminating attacks initiated via network or long-distance cables. This dual physical protection mechanism ensures system security is independent of software configuration accuracy; even if the main control processor is compromised, attackers cannot launch attacks through external interfaces.

[0026] 3. This invention constructs a three-level timekeeping redundancy system: the first-level equipment is trained by the BeiDou satellite to provide an initial time reference; the second-level equipment, after training, can independently maintain time and output encrypted time signals; the third-level equipment receives the reliable time from the second-level equipment, retrains the local atomic clock, and provides network time synchronization services. When the BeiDou satellite signal is lost due to obstruction or interference, the second and third-level equipment can still maintain high-precision time output based on the trained atomic clock, fundamentally changing the fragile mode of existing technologies where the system is highly dependent on a single external signal source and the failure of the external source leads to overall functional degradation, significantly improving the robustness and continuous availability of the system.

[0027] 4. This invention designs a four-level security strategy from L0 to L3, automatically triggering progressive responses matched to the threat level based on the severity of anomalies: from silent recording of occasional interference, operational warnings for continuous anomalies, time-keeping switching and clearing of trusted flags for severe anomalies, to physical power-off isolation upon confirmation of an attack, achieving a balance between security and business continuity. Meanwhile, the system's core components, including the Loongson LS2K2000 processor, domestically produced FPGA, Beidou communication module, and atomic clock, all use domestically produced or independently controllable models, eliminating the risk of backdoor implantation and supply disruption from imported components at the chip level, meeting the security and controllability requirements of critical infrastructure. The portable atomic clock timer also supports disciplined historical log recording, providing traceable time-chain evidence for each calibration operation, meeting the compliance auditing needs of industries such as finance and power. Attached Figure Description

[0028] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0029] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This invention provides a basic working logic diagram of a high-precision reliable time calibration system based on national cryptographic algorithms; Figure 2 An overall logic block diagram of a portable Beidou time synchronization device provided by the present invention; Figure 3 An overall logic block diagram of a portable atomic clock timing instrument provided by the present invention; Figure 4 An overall logic block diagram of an atomic clock timing server provided by the present invention; Figure 5 This invention provides a block diagram of a portable Beidou time synchronization instrument atomic clock discipline closed-loop control. Figure 6 A software architecture diagram of a portable Beidou time synchronization device provided by the present invention; The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0032] Please see Figure 1 This embodiment provides a high-precision, reliable time calibration system based on national cryptographic algorithms, comprising: A portable BeiDou time synchronization device is used to receive BeiDou satellite signals, generate TOD time data and 1pps second pulses, and provide a discipline signal, which includes 1pps pulses and TOD time data. A portable atomic clock time signaler is installed inside the portable Beidou time synchronization device in a pluggable drawer-type structure. When installed, it receives the discipline signal to discipline the atomic clock inside. After the atomic clock is locked, it generates a PTOD private protocol data frame and a synchronization second pulse that are encrypted with SM4 and verified for integrity with SM3-HMAC. After being removed from the portable Beidou time synchronization device, the portable atomic clock time signaler enters a timekeeping mode based on the disciplined atomic clock, and acts as an independent time source, outputting the PTOD private protocol data frame and synchronization second pulse through the aviation output interface on its own panel. The atomic clock timing server has a one-way isolation module at its input. The server receives PTOD private protocol data frames and synchronization second pulses from the portable atomic clock timing instrument via this module using a physical transfer method. The one-way isolation module only allows unidirectional signal transmission from the outside to the inside. The server performs SM4 decryption and SM3-HMAC integrity verification on the received PTOD private protocol data frames, uses the synchronization second pulses to tame the internal atomic clock, and performs time synchronization by combining the parsed time information. Finally, it outputs a timing signal through the network interface.

[0033] It should be noted that in existing time synchronization systems, there is a direct physical or network communication connection between the external time source (such as a satellite receiver) and the time synchronization server. Time data is transmitted in plaintext, unencrypted standard formats (such as NMEA statements and 8-byte TODs), and there is a lack of authentication and data integrity protection mechanisms. This exposes the system to serious security threats such as source time spoofing, link tampering, and replay attacks. Furthermore, the system is highly dependent on a single external signal source; once the external source fails, the time synchronization function of the entire system will rapidly deteriorate.

[0034] To address the aforementioned issues, this invention provides a high-precision, reliable time calibration system based on national cryptographic algorithms. This system employs a three-tiered device architecture, comprising: a portable BeiDou time calibrator (tier 1), a portable atomic clock time transmitter (tier 2), and an atomic clock time transmitter server (tier 3). The three tiers of devices achieve end-to-end secure time transmission using the PTOD proprietary protocol data frames and synchronized second pulses.

[0035] This three-tier architecture fundamentally changes the vulnerable model of "external source directly connected to the time server" in existing technologies. The portable atomic clock timer acts as an intermediate isolation layer, physically isolating the external time source from the final time server: the time server does not directly connect to any satellite antenna or external network interface, but only obtains time through the tamed portable atomic clock timer, thereby completely eliminating the network attack surface launched through the satellite signal interface.

[0036] Figure 1 This is the basic working logic diagram of the system of the present invention. The signal flow and processing procedure of the system are as follows: Input Layer: The external signal source is the BeiDou satellite time signal. After receiving the BeiDou satellite signal, the portable BeiDou time synchronization instrument generates TOD time data and a 1pps second pulse, and provides a discipline signal, which includes the 1pps pulse and the TOD time data. The 1pps pulse and TOD time data are directly input into the internal portable atomic clock time synchronization instrument.

[0037] Transmission and Isolation Layer: After receiving TOD time data and 1pps second pulses, the portable atomic clock timer generates PTOD private protocol data frames and synchronization second pulses through internal processing, which are encrypted with SM4 and verified for integrity using SM3-HMAC. In existing technologies, time data is transmitted in plaintext NMEA or standard TOD format, which can be easily forged or tampered with by attackers. This invention uses the SM4 national cryptographic algorithm to encrypt the time data and adds an integrity verification code using SM3-HMAC, ensuring that even if the time data is intercepted during transmission, it cannot be decrypted, and even if it is tampered with, it can be immediately detected at the receiving end. When the portable atomic clock timer is removed from the portable Beidou time synchronization device, it outputs PTOD private protocol data frames and synchronization second pulses as an independent time source. This "physical transport" calibration method ensures that there is no wired or wireless communication connection between the portable atomic clock timer and the atomic clock time synchronization server at the calibration time, completely eliminating attacks launched through networks or long-distance cables through physical isolation.

[0038] Reception and Transmission Layer: PTOD private protocol data frames and synchronization second pulses are respectively transmitted to the internal atomic clock timing server via a one-way isolation module, using a physical transmission method. In existing technologies, external signals directly enter the system's internal processor through serial or network ports, posing a risk of reverse data leakage and malicious code injection. This invention, through a one-way isolation module, ensures that signals can only flow from the outside to the inside, preventing any reverse signals from bypassing the isolation module and leaving the server, thus physically blocking the path for reverse data leakage. PTOD private protocol data frames are sent to the main control processor for SM4 decryption and SM3-HMAC verification after passing through the one-way isolation module; synchronization second pulses are input to the server's internal atomic clock for taming after passing through another one-way isolation module. The main control processor sends the parsed time information to the FPGA, which processes it and outputs a high-precision timing signal through the timing network interface.

[0039] The aforementioned three-tier architecture not only achieves secure isolation but also constructs a multi-level collaborative timekeeping mechanism: the first-level device (portable BeiDou time synchronizer) is trained by the BeiDou satellites, providing an initial time reference; the second-level device (portable atomic clock time synchronizer), after training, can still maintain time independently using its internal atomic clock even when disconnected from the first-level device; the third-level device (atomic clock time synchronization server) receives the reliable time from the second-level device and trains its local atomic clock again. When the BeiDou satellite signal is lost due to obstruction or interference, the second-level device can maintain high-precision time output independently of the first-level device, while the third-level device continues to provide time synchronization services based on the time of the second-level device, forming a "satellite-instrument-clock" three-level timekeeping redundancy system, avoiding the single-point failure risk of system failure due to satellite signal loss in existing technologies.

[0040] In a preferred embodiment, Figure 2 This is a block diagram of the overall logic of a portable BeiDou time synchronization device. In existing technologies, core components of time synchronization systems heavily rely on imported chips (such as GPS modules from U-blox and Broadcom), posing risks of backdoor implantation and supply chain security. In this invention, the core processor of the portable BeiDou time synchronization device uses the Loongson LS2K2000 processor, and its programmable logic device uses a domestically produced FPGA, ensuring supply chain autonomy and controllability at the chip level. The portable BeiDou time synchronization device consists of a power supply, a main control processing module, peripheral interfaces, and a pluggable portable atomic clock time signaling device.

[0041] For power input, external AC220V power is filtered and converted to DC12V to power the entire device. For external signal input, the BeiDou satellite antenna is connected to the BeiDou communication module, the standard network time source is connected to the UTC port, and the management computer is connected via the RJ45 management port. The main control module connects the BeiDou communication module, the UTC port, the RJ45 management port, and the RJ45 debugging serial port, and also connects to the physical operating interface, including control buttons, an LCD display, and status indicator lights.

[0042] The main control processing module of the portable Beidou time synchronization instrument is the LS2K2000 processor, and its hardware interface is allocated as follows: 2 UART interfaces, one of which is used to receive 8 bytes of TOD time data (RS-232 level, 9600bps) from the Beidou module, and the other is used to communicate with the FPGA (status acquisition, time synchronization, 115200bps); 1 SPI interface, used to quickly read the FPGA's internal time counter, as a backup communication channel; 1 I2C interface, used to read sensor data such as device temperature and battery level; 8 GPIO interfaces, used to control front panel indicator lights, read button inputs, reset the FPGA, etc.; 2 Ethernet interfaces, used as debugging network ports and future expansion management network ports respectively; 1 PCIe interface reserved and unused; 1 SDIO interface, used to connect to the MicroSD card slot to store log data.

[0043] Figure 6 This is a software architecture diagram of a portable Beidou time synchronization device. The software architecture is divided into an application layer, a protocol layer, and a driver layer from top to bottom, with the underlying layer running a Linux real-time kernel. The operating system type is Linux real-time kernel, version 5.10.1-rt18, with the PREEMPT_RT patch applied. The purpose of using a real-time kernel is to meet the stringent time response requirements of atomic clock discipline: existing general-purpose operating systems have interrupt response latency in the millisecond range, which cannot meet the real-time requirements of high-precision time synchronization. This invention reduces the interrupt response latency to below 50 microseconds through the PREEMPT_RT patch, ensuring that the 1-second cycle of discipline task scheduling can be executed strictly on time. The system boots using U-Boot, with the kernel loaded from eMMC. The file system uses an ext4 read-only root file system plus a writable / var partition, where the / var partition is used to store log data.

[0044] The application layer includes functional modules such as the main control program, status display and key handling, and log recording; the protocol layer is responsible for PTOD protocol management, time synchronization protocol, FPGA communication protocol, etc.; the driver layer integrates UART driver, SPI driver, GPIO driver, and FPGA character device driver. The application layer and protocol layer exchange data through message queues or shared memory, and the protocol layer and driver layer interact through the standard character device driver interface.

[0045] The key processes of the main control processing module include: the main control thread (priority 99), which reads the current time and lock status of the FPGA via UART every second and updates the local software RTC; the display refresh thread (priority 50), which reads the status every 200ms and sends it to the LCD screen via serial port; the key scanning thread (priority 60), which polls GPIO to detect key events and responds; and the log thread (priority 30), which asynchronously writes to the SD card to record taming events, exceptions, and phase difference history.

[0046] The main control processor and the FPGA communicate using a custom frame format. The main control processor sends a request frame in the format 0x55 0x01 0x00, used to read the time and status. The FPGA responds with a response frame in the format 0xAA 0x10, followed by a 64-bit timestamp, a 4-byte phase difference, a 1-byte lock flag, and a 1-byte CRC checksum. This custom frame protocol is concise and efficient, meeting the requirements for low-latency, high-frequency status interaction between the main control processor and the FPGA.

[0047] In a preferred embodiment, Figure 3 This is the overall logic block diagram of a portable atomic clock timing instrument.

[0048] In existing technologies, time synchronization servers typically require independent configuration of satellite antennas and receivers, resulting in complex deployments and antennas susceptible to obstruction or interference. Once the satellite signal is interrupted, the server directly loses its high-precision time reference. This invention designs a pluggable portable atomic clock time synchronization device, enabling it to maintain high-precision time output even when disconnected from the host computer, fundamentally changing the server's dependence on satellite signals.

[0049] In this embodiment, the portable atomic clock time transmitter is installed inside the portable BeiDou time transmitter using a pluggable drawer-type structure. This drawer-type design allows the portable atomic clock time transmitter to be easily pulled out and plugged back in from the main unit, providing plug-and-play functionality without requiring on-site satellite re-training, significantly reducing on-site calibration time. Furthermore, one portable BeiDou time transmitter can be equipped with multiple portable atomic clock time transmitters, enabling rotational use: while one module is calibrating the server, another module can continue training in the main unit, improving system availability.

[0050] This portable atomic clock timing device includes an atomic clock, FPGA, MCU, rechargeable lithium battery, and aviation output interface.

[0051] Connection in embedded mode: When the portable atomic clock time transmitter is installed inside the portable BeiDou time transmitter, it receives discipline signals via a 20-pin contact located on the back. These 20-pin contact signals include at least: a UART serial port signal for TOD data interaction, a discipline pulse signal for transmitting 1pps discipline pulses, and a lock feedback signal for the atomic clock to report its lock status to the host. Using 20-pin contacts instead of cables ensures the reliability and signal integrity of the portable atomic clock time transmitter during frequent plugging and unplugging.

[0052] In terms of data communication, the portable BeiDou time synchronizer connects to the FPGA and atomic clock of the portable atomic clock time synchronizer via two UART serial cables for parameter configuration and data exchange. For discipline pulse input, the portable BeiDou time synchronizer converts the received BeiDou satellite reference time signal into a 1pps pulse, which is then input to the atomic clock of the portable atomic clock time synchronizer for discipline and synchronization. Regarding lock feedback, the atomic clock outputs its lock status signal, one path being split and sent back to the portable BeiDou time synchronizer to inform the host that discipline is complete, and the other path being sent to the FPGA of this module for synchronization logic control. The feedback of the lock status signal is a crucial step in the entire discipline process: only when the atomic clock is confirmed to have completed precise locking does the time output by the portable atomic clock time synchronizer possess a "reliable" attribute, allowing the atomic clock time synchronization server to establish a reliable time reference.

[0053] Regarding the interconnection of internal core units: the MCU and FPGA use UART serial port and GPIO for bidirectional data and instruction interaction, and jointly handle time protocol calculation, encryption and peripheral control logic; the atomic clock feeds back the lock status signal to the FPGA, and the FPGA coordinates the final PTOD private protocol data frame output according to this status.

[0054] In terms of human-computer interaction and peripheral control: the buttons on the user operation panel send control commands to the MCU through the GPIO interface; the MCU drives the external LCD display to display data through the UART interface, and controls the status indicator lights through the GPIO interface to provide feedback on the current working status of the device.

[0055] Operating mode in the unplugged state: When the portable atomic clock timer is unplugged from the portable Beidou time calibrator, it is powered by a rechargeable lithium battery. The built-in rechargeable lithium battery design gives the module completely independent power supply capabilities, allowing it to be carried to any location with a time synchronization server and calibrated without relying on on-site power. The portable atomic clock timer enters a timekeeping mode based on the tamed atomic clock, acting as an independent time source. It outputs PTOD proprietary protocol data frames and synchronization second pulses through the aviation output interface on its own panel. Compared to ordinary RJ45 or USB interfaces, the aviation output interface has better vibration resistance and anti-loosening performance, suitable for frequent plugging and unplugging in industrial sites and computer room environments, ensuring reliable signal transmission. The FPGA sends the processed encrypted time data to the atomic clock time synchronization server through the PTOD protocol interface. The atomic clock outputs high-precision synchronization second pulses to tame the server's internal atomic clock.

[0056] The portable atomic clock time signaler's "taming-unplugging-keeping-output" working mode eliminates the need for a satellite antenna and receiver on the atomic clock time signaling server. It obtains reliable time entirely through input from the portable atomic clock time signaler, avoiding time signal interruptions caused by satellite signal blockage or interference on the server side. Simultaneously, each portable atomic clock time signaler can record logs such as the time and duration of its last taming by the host, facilitating auditing and traceability, and meeting the compliance requirements for time traceability in industries such as finance and power.

[0057] Atomic Clock Time Synchronization Server: In existing technologies, the external input interfaces (such as serial ports, network ports, BNC) of time synchronization servers are directly connected to external time sources. Attackers can inject malicious pulses or forge time data through these interfaces, or even launch buffer overflow attacks to infiltrate internal networks. This invention sets up a one-way isolation module at the input end of the atomic clock time synchronization server, fundamentally cutting off this attack path.

[0058] Figure 4 This is the overall logical block diagram of the atomic clock timing server. The atomic clock timing server uses the Loongson LS2K2000 processor as its core, receives external time signals through a unidirectional isolation module, and provides high-precision timing network services. Its programmable logic device uses a domestically produced FPGA, continuing the overall domestic security strategy of the system.

[0059] Regarding external signal reception and isolation: PTOD proprietary protocol data frames, after passing through a unidirectional isolation module, are sent to the LS2K2000 main control processor via a UART serial port; the synchronization second pulse, after passing through another unidirectional isolation module, is input to the server's internal atomic clock. The unidirectional isolation modules are composed of optocouplers, which are connected in series on the transmission paths of the PTOD proprietary protocol data frames and the synchronization second pulse, forming a unidirectional physical transfer channel for the signal. Utilizing the photoelectric conversion principle, the optocouplers ensure that the signal can only be transmitted from the input end to the photosensitive receiver at the output end via a light-emitting diode. Physically, there is no electrical path for reverse transmission. Therefore, any reverse signal—whether attempting to leak data from inside the server or attempting to inject malicious signals from outside the server—cannot bypass the optocouplers. This design physically, rather than through software, blocks the possibility of reverse data leakage. Security does not depend on the correctness of the software configuration; even if the main control processor is compromised, attackers cannot transmit data externally through the input interface.

[0060] In terms of core control: the LS2K2000 processor communicates with the FPGA via a UART serial port and connects to an external RJ45 test serial port via an RS232 serial port; it also connects to multiple gigabit network ports, which serve as PTP / NTP timing ports and RJ45 management ports, respectively.

[0061] Regarding the interaction between the atomic clock and the FPGA: The FPGA and the atomic clock are interconnected. The FPGA outputs a 1pps pulse to drive the atomic clock, and the atomic clock feeds back a lock-up status signal to the FPGA. At the same time, the FPGA communicates with the LS2K2000 main control processor through UART.

[0062] In terms of local human-computer interaction: the LS2K2000 main control processor connects to the LCD display via UART serial port and connects to the status indicator lights and selection control button panel via GPIO interface.

[0063] The master processor and FPGA communicate via an SPI bus, configured in master-slave mode, with the LS2K2000 as the master and the FPGA as the slave. The clock frequency is 10MHz, the data bit order is MSB First, and the SPI mode is Mode 0. The SPI data frame length is fixed at 64 bytes, with a CRC32 checksum added to the end of the frame, using the IEEE 802.3 standard polynomial. The SPI data frame format is defined as follows: Byte 0 is the command word, 0x01 indicates the absolute write time, 0x02 indicates the read status, and 0x03 indicates reset; bytes 1 to 4 are 32-bit Unix seconds, valid during write; bytes 5 to 8 are 32-bit nanoseconds, valid during write; byte 9 is the lock flag, from the master, 0x80 indicates the master considers it locked, and 0x00 indicates it is unlocked; bytes 10 to 58 are 49 bytes of reserved or extended fields, filled with all zeros; bytes 59 to 63 are the CRC32 checksum (taking the lower 5 bytes), calculated from bytes 0 to 58. The FPGA response frame format is as follows: Byte 0 is the response code, 0xAA indicates success, and 0xEE indicates a check error; Bytes 1 to 4 are the current Unix seconds of the FPGA, for comparison by the master controller; Bytes 5 to 8 are the current nanoseconds of the FPGA; Byte 9 is the FPGA discipline status, bit 0 is the fine lock flag, bit 1 is the reference loss flag, and bit 2 is the alarm flag; Bytes 10 to 58 are 49 bytes of diagnostic information, including phase difference, temperature, etc.; Bytes 59 to 63 are the CRC32 check value (taking the lower 5 bytes), calculated from bytes 0 to 58.

[0064] The main control processor initiates an SPI write every second, sending the latest decrypted absolute time to the FPGA. When the main control processor successfully receives and decrypts a PTOD private protocol data frame via UART, it immediately triggers an SPI write without waiting for the next cycle. This design, which prioritizes frame arrival synchronization and uses periodic synchronization as a secondary measure, ensures that time updates from an external trusted time source are delivered to the FPGA with minimal latency (less than 1ms), minimizing time errors in the transmission process.

[0065] Furthermore, in existing technologies, satellite receivers and timing devices commonly use publicly available standard formats such as NMEA 0183 statements and 8-byte TODs to transmit time data. These protocols lack any encryption or integrity verification mechanisms. Attackers only need to understand the publicly available protocol formats to forge identical time data frames, making it impossible for the system to identify the authenticity of the data. In addition, attackers can record a normal time data segment and replay it at a later time point, causing the system time to rewind or jump, thus disrupting log auditing and transaction order.

[0066] In a preferred embodiment, to address the aforementioned source time spoofing and replay attack problems, this invention defines a PTOD private protocol, wherein the PTOD private protocol data frame is a fixed-length 56-byte frame. This frame format includes: an 8-byte plaintext header, 8 bytes of time information, a 32-byte HMAC digest value, and 8 bytes of padding data. The 8-byte time information, 32-byte HMAC digest value, and 8-byte padding data are combined to form a 48-byte data block, satisfying the length requirement of SM4 block encryption: the SM4 algorithm's block length is 128 bits (16 bytes), and 48 bytes is exactly a multiple of 16 bytes. After SM4 encryption of the entire data block to obtain a ciphertext data block, it is then concatenated with the 8-byte plaintext header to form a complete PTOD private protocol data frame. Keeping the frame header in plaintext facilitates the receiving end's rapid identification of the frame start boundary and protocol version, while the time information, HMAC digest value, and padding data are all transmitted in ciphertext form, ensuring that core time data is not stolen or analyzed.

[0067] The generation process of PTOD private protocol data frames is completed in the FPGA of the portable atomic clock timekeeping instrument. The specific process is as follows: The first step is to obtain the 8 bytes of time information to be sent; The second step involves calculating a 32-byte HMAC digest value using the SM3-HMAC algorithm. SM3 is a commercially available cryptographic hash algorithm in my country. The HMAC mechanism introduces a key on top of the hash algorithm, ensuring that only legitimate devices with the correct key can generate the correct HMAC digest value. This means that even if an attacker knows the complete frame format of the PTOD protocol, they cannot forge a time data frame that passes verification without the key, thus effectively preventing source time spoofing attacks. The third step involves adding 8 bytes of random padding data, which, together with 8 bytes of time information and a 32-byte HMAC digest value, forms a 48-byte data block to meet the length requirements of SM4 block encryption. The introduction of random padding data has two important functions: First, even with the same time information, the generated ciphertext data blocks are completely different each time, making it impossible for attackers to deduce the pattern of time data changes by comparing ciphertexts. Second, it provides a cryptographic basis for preventing replay attacks: because the random padding data is different each time, attackers cannot deceive the receiver by replaying previously recorded ciphertext data. Even with the same time information, the ciphertext generated at different times is completely different, making it impossible for attackers to distinguish which ciphertexts correspond to the "current time" and which correspond to the "historical time." Simultaneously, the receiver verifies the continuity and monotonically increasing nature of the time information after decryption. If the decrypted time information is earlier than or equal to the previously received time, it can be identified as a replay attack and immediately discarded. This dual mechanism of "random padding + time continuity verification" effectively prevents replay attacks at both the cryptographic and logical levels. The fourth step is to encrypt the 48-byte data block using the SM4 algorithm to obtain the ciphertext data block. SM4 is a commercially available block cipher algorithm in my country, and its security has been fully verified. After encryption with SM4, the time data exists in ciphertext form on the transmission link, and cannot be deciphered even if physically intercepted. The fifth step is to concatenate the 8-byte plaintext frame header with the ciphertext data block to form a 56-byte PTOD private protocol data frame.

[0068] The PTOD private protocol data frame reception process is completed in the atomic clock time synchronization server. Specifically, the process is as follows: first, SM4 decryption is performed to obtain the plaintext data; then, the frame header information is stripped, the HMAC digest value of the time information is recalculated, and compared with the transmitted HMAC digest value. If they match, the time is updated; otherwise, the frame is discarded. This "decryption-verification-comparison" process achieves the dual security goals of protecting the confidentiality and integrity of time data. Only time data that passes both SM4 decryption and SM3-HMAC verification is accepted and used to update the system time. Any tampered or forged data is immediately discarded, thus ensuring the reliability of the system time base.

[0069] The internal module division and input / output relationships of the portable Beidou time synchronization instrument's FPGA are as follows: Time counter: 64-bit continuous counter, clocked at 10MHz atomic clock, with a resolution of 100ns; input is a 10MHz clock and a preset pulse per second, output is the current time (Unix seconds plus nanoseconds).

[0070] TDC Phase Comparator: Measures the phase difference between a BeiDou 1pps signal and a local 1pps signal, with a resolution of 25ps; the input is two 1pps signals (an external BeiDou 1pps signal plus a local atomic clock 1pps signal), and the output is a digital value of the phase difference (32-bit signed integer). When the TDC resources inside the FPGA are limited, a counter method can be used as a backup: the interval between two 1pps signals is counted using a 10MHz atomic clock, with a resolution of 100ns, for coarse measurement.

[0071] Digital PID controller: It adopts a second-order loop filter and outputs a 16-bit tuning value; the input is the phase difference output by the TDC phase comparator, and the output is a 16-bit digital tuning word.

[0072] DAC controller: Converts 16-bit digital tuning words into SPI or DAC interface timings; input is a 16-bit digital tuning word, output is an analog voltage (driving an external DAC chip).

[0073] Lockout detector: Determines the locked or unlocked state based on historical phase difference data; inputs are phase difference and time counter value, outputs are lockout flag and unlocked alarm signal.

[0074] SM3-HMAC core: Calculates a 32-byte HMAC digest value based on the SM3 algorithm; the input is plaintext time data, and the output is a 32-byte HMAC digest value.

[0075] SM4-CBC core: Uses the SM4 algorithm in CBC mode for encryption or decryption; input is plaintext, key and initialization vector (IV), output is ciphertext.

[0076] Protocol Packer: Assembles data in 56-byte PTOD frame format; inputs are time, status, and checksum, output is 56-byte parallel data.

[0077] UART transmitter: Converts 56-byte parallel frame data into serial RS-422 output with a baud rate of 921600; input is parallel frame data, output is serial PTOD signal.

[0078] 1pps Regenerator: Generates a low-jitter 1pps pulse based on a 10MHz atomic clock, strictly aligned with the start time of the PTOD frame; the input is a 10MHz clock and a second-aligned pulse, and the output is a 1pps pulse (TTL level).

[0079] Master control communication interface: Uses UART or SPI slave mode to exchange status and time information with the LS2K2000 master control processor; input is master control command, output is status, lock flag and time data.

[0080] Encryption and protocol packaging are performed inside the FPGA, rather than by a general-purpose processor. This leverages the parallel processing capabilities of the FPGA to reduce encryption latency and embeds security-critical logic in the hardware, avoiding vulnerabilities that may be introduced by software implementation.

[0081] The FPGA's internal clock domains are divided as follows: The clk_sys clock domain, with a frequency of 100MHz, is generated by multiplying a 10MHz atomic clock using a PLL, providing clock for the TDC phase comparator, digital PID controller, latch detector, protocol packetizer, and UART transmitter; the clk_tdc clock domain, with a frequency of 400MHz, is generated by clk_sys through a carry chain to create a delay chain, dedicated to the high-precision measurement section of the TDC; the clk_uart clock domain, with a frequency of 921600Hz, is generated by dividing clk_sys, dedicated to the UART transmitter; and the clk_dac clock domain, with a frequency of 10MHz, is directly connected to the atomic clock, providing clock for the DAC controller and 1pps regenerator. This multi-clock domain design ensures that high-speed digital logic, high-precision time measurement, and serial communication operate independently at their optimal frequencies, avoiding mutual interference.

[0082] In existing technologies, the workflow of a time synchronization system is typically a simple direct connection mode of "satellite receiver → serial port / NTP → time synchronization server". Time data exists in plaintext form at multiple stages, and a breach in any stage will lead to the loss of overall time reliability. The workflow of this invention introduces a portable atomic clock time synchronization device as an intermediate isolation layer and implements end-to-end national cryptographic encryption to construct a complete encrypted authentication link from satellite reception to network output. The following is a detailed description of each stage: Phase 1: The host computer tames the portable atomic clock timing device The portable atomic clock time synchronization device is installed inside the portable BeiDou time synchronization device in a drawer-type structure. The portable BeiDou time synchronization device receives BeiDou satellite signals and generates TOD time data and a 1pps second pulse. The 1pps pulse is directly input to the atomic clock of the portable atomic clock time synchronization device. The atomic clock uses this 1pps pulse as a reference. The internal phase-locked loop or microcontroller dynamically adjusts the control voltage of the atomic clock by comparing the phase difference between the frequency division signal output by the atomic clock and the external 1pps pulse, so that its output frequency is disciplined and locked to the time-frequency reference of the input time. When the atomic clock is locked to the reference source, it outputs a lock status signal and generates a calibrated synchronization second pulse for the FPGA.

[0083] TOD time data is input to the FPGA of the portable atomic clock timekeeping instrument via a UART serial port. The FPGA converts the 8-byte TOD time data into a 56-byte PTOD proprietary protocol data frame using SM3-HMAC digest calculation and SM4 block encryption. Simultaneously, based on the precise clock of the atomic clock, the FPGA regenerates a low-jitter synchronization second pulse that is strictly aligned with the start time of the PTOD proprietary protocol data frame. The purpose of strictly aligning the synchronization second pulse with the PTOD proprietary protocol data frame is to ensure that the receiving end can accurately determine the second boundary time corresponding to each frame of time data, avoiding time interpretation errors caused by timing deviations between the data and the pulse.

[0084] Figure 5 This is a block diagram of the closed-loop control for disciplining the atomic clock of a portable BeiDou time synchronization instrument. The disciplining process uses a second-order digital phase-locked loop (PLL). Compared to the traditional first-order PLL, the second-order loop can simultaneously track phase and frequency steps, achieving zero steady-state error tracking of the satellite's 1pps signal.

[0085] The transfer function model used in this embodiment is: Among them, the damping coefficient A value of 0.707 represents the critical damping state, balancing capture speed and steady-state fluctuations; natural angular frequency... Take 0.1 rad / s as the corresponding loop noise bandwidth Approximately 0.125 Hz, effectively filtering out high-frequency jitter on the order of ±50 ns in the BeiDou 1pps signal. Equivalent time constant. It takes about 14 seconds, and the entire taming process (from start to lock) takes about 300 to 600 seconds, depending on the initial frequency difference.

[0086] Regarding the implementation of digital PID, this embodiment implements a digital PID controller inside the FPGA, and its parameters are configured as follows: proportional coefficient. Integral coefficient Differential coefficients (The second-order loop requires no differentiating term). The DAC resolution is 16 bits, the output voltage range is 0 to 5V, and the corresponding atomic clock frequency tuning range is ±1×10⁻⁶. -8 .

[0087] The specific control process is as follows: After training begins, the system continuously reads the BeiDou 1pps and local 1pps pulses, calculating the time difference Δφ. It then enters the coarse lock detection phase, with the condition that the absolute value of the phase difference is less than 100ns and lasts for 10 seconds. The 10-second duration is set to eliminate transient noise interference and ensure the reliability of the lock detection. If the condition is met, the coarse lock flag is set to 1. The time difference error is fed into a digital loop filter for PID control, calculating the required voltage adjustment. After DAC conversion, a tuning voltage is generated and applied to the atomic clock voltage-controlled oscillator, changing its output frequency. The oscillator output is then divided to generate a local 1pps second pulse. This newly generated local 1pps pulse is compared again with the BeiDou 1pps pulse, forming a closed-loop feedback. This closed-loop control design allows the training process to continuously and automatically correct the atomic clock's frequency deviation without manual intervention.

[0088] During closed-loop operation, continuous fine-lock detection is performed. The criteria are: within 300 consecutive seconds, the root mean square (RMS) phase difference is less than 5 ns, and the rate of change of phase difference is less than 0.1 ns / s. The formula for calculating RMS is: In the formula, N is the length of the sliding window, and 300 phase difference samples are taken (one per second). This is the phase difference measurement value at the i-th second; This is the arithmetic mean of N samples. Compared to a simple absolute value average, this indicator better reflects the dispersion and stability of the phase difference. The rate of change is obtained by calculating the absolute value of the first-order difference of the phase difference between adjacent seconds; a value less than 0.1 ns / s ensures that the atomic clock frequency has been stably tracked, rather than being accidentally aligned. If the condition is met, the fine-lock flag is set to 1, and the training is complete. If the fine-lock condition is not met, the lock-out detection begins. The judgment condition is: the absolute value of the phase difference is greater than 500 ns and lasts for 5 seconds. If the lock-out condition is met, the lock-out flag is set to 1 and an alarm output is triggered; otherwise, the training loop continues.

[0089] The system employs a two-stage determination mechanism of coarse locking and fine locking, balancing discipline speed and accuracy. Coarse locking provides an initial stability indication within 10 seconds, allowing users to quickly confirm that the device connection is correct; fine locking, after 300 seconds of full convergence, ensures that the atomic clock frequency is precisely locked, resulting in highly reliable output time data.

[0090] Phase Two: Independent Detachment of Portable Atomic Clock Timing Device The user pulls the portable atomic clock timer out of its drawer-type mounting position. At this point, the portable atomic clock timer automatically switches to independent operating mode, powered by its built-in rechargeable lithium battery. The atomic clock inside the portable atomic clock timer, having been tamed within the main unit, enters timekeeping mode, independently outputting a stable time frequency based on the tamed frequency. The MCU continues to generate PTOD private protocol data frames based on the timekeeping atomic clock and the last locked time information, and outputs the PTOD private protocol data frames and synchronization second pulses externally through the aviation output interface on its panel.

[0091] This stage is one of the core features that distinguishes this invention from existing technologies. In existing technologies, there is a continuous physical or network connection between the time source and the timing device, and the attack surface is always exposed. However, this invention designs the portable atomic clock timing instrument as a pluggable, independent module. During calibration, there is absolutely no wired or wireless communication connection between the portable Beidou timing instrument and the atomic clock timing server, achieving physical isolation in both time and space. Attackers cannot launch attacks using networks or cables because there is simply no communication channel available for attack in the calibration link.

[0092] Phase 3: Calibrating the Atomic Clock Timing Server The user physically moves the portable atomic clock timing device to the side of the atomic clock timing server, and uses a dedicated cable to connect the aviation output interface of the portable atomic clock timing device to the input interface of the atomic clock timing server, and connects the PTOD private protocol data frame and the synchronization second pulse respectively.

[0093] The atomic clock timing server receives the aforementioned signals via a physical transfer method through an internal one-way isolation module. PTOD proprietary protocol data frames are sent to the LS2K2000 main control processor via the one-way isolation module for SM4 decryption and SM3-HMAC integrity verification. After successful verification, the main control processor sends the parsed time data to the FPGA via the SPI bus. The synchronization second pulse is input to the server's internal atomic clock via another one-way isolation module to tame it. The server's internal atomic clock then feeds back a lock status signal to the FPGA.

[0094] Based on the disciplined atomic clock and the received time data, the FPGA maintains a local time counter and sets a clock reliability flag in the output data packet, outputting PTP or NTP time synchronization signals through the time synchronization network interface. The design of the clock reliability flag allows downstream time-synchronized devices to clearly know the reliability status of the current time synchronization signal: the flag is only set to valid if the portable atomic clock time synchronization instrument passes the time verification and the server atomic clock completes the fine locking.

[0095] The FPGA internally maintains a 64-bit time counter driven by a 10MHz atomic clock, incrementing by 100ns per clock cycle. Upon receiving the absolute time written by the main controller, it employs a gradual calibration method rather than a direct jump load. This is to avoid time discontinuities in the time output and ensure the time stability of downstream devices. When the time deviation is less than 1ms, the FPGA adjusts the counter's increment step, completing the correction linearly within 1 second, resulting in a smooth change in output time that is imperceptible to downstream devices. When the time deviation is greater than or equal to 1ms, the FPGA immediately loads the new value, but uses 1pps pulse edge alignment to reduce phase abrupt changes, while simultaneously marking the timestamp jump event for the main controller to record for later auditing and traceability.

[0096] The FPGA integrates a high-precision TDC (Time-to-Digital Converter). Its phase difference measurement method is as follows: the measurement object is the 1pps after discipline output by the atomic clock (as the start signal) and the local 1pps generated by the internal time counter of the FPGA (as the stop signal). The TDC is implemented based on the tap delay line of the internal carry chain of the FPGA. Each delay unit is about 25ps. The time interval between two 1pps rising edges is obtained through the encoder. The resolution is less than or equal to 25ps, and the measurement range is 0 to 1 second. Background calibration is automatically performed every hour, and the measurement error caused by temperature drift is eliminated by using the known 10MHz period of the atomic clock.

[0097] The FPGA internally maintains a lock / unlock state machine to determine the lock status based on the phase difference statistics of N consecutive cycles. The state machine has four states: Unlocked state, which is the initial state after system power-on or after unlocking, in which only the phase difference is monitored and no reliable time flag is output; Coarse lock state, entered when the absolute value of the phase difference is less than 100ns within 10 consecutive seconds, at which time a yellow indicator light is lit, allowing the "preliminary stabilization" report to the master controller; Fine lock state, entered when the RMS phase difference is less than 5ns and the rate of change is less than 0.1ns / s within 300 consecutive seconds, at which time a green indicator light is lit, a reliable flag is set, and time synchronization output is allowed; Unlocked state, entered when the absolute value of the phase difference is greater than 500ns at any time and lasts for 5 seconds, or when the external reference 1pps is lost for more than 2 seconds, at which time the lock flag is cleared, an alarm is triggered, and time synchronization output is immediately stopped or a time packet with an alarm flag is output.

[0098] After a lockout event is triggered, the system executes a tiered response according to priority: The first level is a hardware-level response, completed by the FPGA within 1ms, including clearing the internal "time reliability" register, immediately stopping the hardware timestamp output of the PTP or NTP network port (setting the timestamp valid position to invalid), and sending an interrupt signal to the master controller via GPIO. The second level is the master controller response, including recording the lockout time, the phase difference before lockout, and the duration to the log; illuminating the red alarm indicator on the panel, and displaying "Lockout" on the LCD; if the lockout duration exceeds 10 seconds, it automatically switches to timekeeping mode, the FPGA continues to operate freely at the last locked frequency, but the clock reliability flag in the time data packet output by the network port is set to 0; the master controller simultaneously attempts to reacquire the external reference, waiting for the PTOD frame to recover; if the lockout duration exceeds 1 hour, all time synchronization network port outputs are stopped, entering a silent fault state, with only the debug interface remaining. The recovery mechanism is as follows: when the external reference becomes valid again at 1pps and the phase difference stabilizes within ±50ns for 60 consecutive seconds, the lockout flag is automatically cleared, and the coarse-to-fine locking discipline process is re-executed.

[0099] Phase 4: Portable atomic clock timing device returned to its original position After calibration, the portable atomic clock timer can be inserted back into the drawer-type mounting position of the portable Beidou time synchronization unit, and the connection can be re-established through the 20-pin contact. The unit automatically charges the rechargeable lithium battery of the portable atomic clock timer and re-tames its internal atomic clock for the next use.

[0100] This closed-loop design of recharging and retaming makes the portable atomic clock timer a reusable, independent time source. Multiple portable atomic clock timers can take turns operating, providing continuous, uninterrupted calibration services. Simultaneously, the main unit records historical data from each taming operation, providing traceable timeline evidence for each calibration.

[0101] Security policies and exception handling In existing technologies, time synchronization systems lack effective detection and response mechanisms for abnormal time data. Even when receiving clearly abnormal time data, the system often accepts it unconditionally, leading to easy tampering of the time base. This invention designs a tiered four-level security strategy, automatically triggering different levels of response based on the severity of the anomaly, ensuring security while avoiding unnecessary system interruptions due to occasional interference. Unlike the binary approach of existing time synchronization systems that either unconditionally accept abnormal data or completely interrupt service, this invention's four-level security strategy implements a progressive response matching the threat level: for occasional interference (L0), only recording without alarming avoids false alarms affecting operational efficiency; for persistent anomalies (L1), issuing warnings to prompt operational personnel to pay attention, while maintaining service continuity; for severe anomalies (L2), proactively cutting off dependence on untrusted sources and switching to timekeeping mode, informing downstream devices through clock trust flags instead of directly interrupting the time synchronization service, ensuring business continuity; and for confirmed attacks (L3), taking extreme measures such as physical isolation to completely block the threat. This tiered response mechanism strikes a balance between security and availability, avoiding business disruptions caused by overreaction and security risks caused by underreaction.

[0102] When receiving and decrypting PTOD private protocol data frames, the main control processor of the atomic clock timing server executes the following four-level security policy: L0 alert level: When a single SM3-HMAC check fails, the frame is discarded and logged, the counter is incremented by 1, and no alarm is triggered. This level is designed to account for occasional bit errors or electromagnetic interference in the communication link that may cause a single check to fail. If an alarm were triggered immediately, it would cause a large number of false alarms. Therefore, it only logs the error and does not affect normal operation.

[0103] L1 Warning Level: A warning is triggered when three consecutive SM3-HMAC verification failures occur, or when the verification failure rate exceeds 20% within 10 seconds. The yellow indicator light flashes, and the system continues to attempt to receive data. Multiple consecutive failures indicate possible persistent interference or attack attempts, but the system still attempts to receive data, providing an opportunity for recovery.

[0104] L2 Alarm Level: An alarm is triggered when 10 consecutive SM3-HMAC verification failures occur, or when the verification failure rate exceeds 50% within one minute. The system then stops training and switches to timekeeping mode, invalidating the clock trust flag in the network port output time data packets. At this point, the system determines that the external trusted time source is unreliable, proactively cutting off dependence on the untrusted source and relying on its own atomic clock to maintain time output. The clock trust flag informs downstream devices that the current time trustworthiness has decreased. This "cut-off rather than blind following" design allows the system to self-isolate and protect itself from continuous attacks, rather than passively accepting incorrect time.

[0105] Level L3 Emergency: When a time jump exceeding 1 second and an HMAC checksum error are detected, it is determined to be a replay attack. Immediate emergency measures are taken, including cutting off power to the external input interface and saving the site log. This level requires manual reset to recover. A time jump exceeding 1 second accompanied by an HMAC checksum error is a typical characteristic of a replay attack: the attacker replays historical time data. While the HMAC value of this data may be correct (because it is legally generated historical data), its time information deviates significantly from the current actual time. By jointly detecting the magnitude of the time jump and the HMAC checksum error, this type of attack can be effectively identified. The physical isolation of cutting off power ensures that the system can completely block the attack path in the event of a serious security incident, while the requirement for manual reset ensures that the security incident can be fully investigated before operation can be restored.

[0106] The SM4 decryption failure handling process is as follows: Upon receiving a PTOD private protocol data frame, an SM4 decryption attempt is made. If successful, SM3-HMAC verification is initiated; if it fails (due to key error or data corruption), the frame is discarded and logged. SM4 decryption failure usually indicates that the sender and receiver keys are inconsistent, or that the data has been severely corrupted during transmission. This discarding process ensures that data from unknown sources does not enter the system.

[0107] SM3-HMAC Verification Failure Handling: SM3-HMAC verification checks the integrity of the decrypted plaintext. Failure indicates data tampering or a mismatch between the source and target keys. The handling strategy is to discard the frame, not update the FPGA time, and log the integrity verification error. This mechanism ensures that only time data that passes both decryption and integrity verification can update the system time.

[0108] Regarding 1pps anomaly handling: If no 1pps rising edge is detected for 2 consecutive seconds, it is determined as 1pps loss, immediately entering timekeeping mode, setting a reference loss flag, and making the network port output unreliable; when the 1pps frequency is abnormal (less than 0.5Hz or greater than 1.5Hz), it is considered an invalid reference, switching to timekeeping mode and triggering an L2 alarm; when the 1pps jitter is too large (the difference between adjacent cycles is greater than 1 microsecond), the discipline loop bandwidth is reduced, lowering the natural angular frequency ωn to 0.05 rad / s, and an alarm is triggered if it does not recover after 30 seconds. This multi-dimensional anomaly detection of the 1pps signal covers typical fault modes such as signal loss, frequency abnormality, and excessive jitter, ensuring that the system will not perform incorrect discipline operations based on abnormal pulse signals.

[0109] Behavior in timekeeping mode: The FPGA continues to drive the counter with a 10MHz atomic clock, calculating the current time every 10 minutes based on the last valid time plus the accumulated counter value; the clock reliability flag in the PTP or NTP time synchronization signal output from the network port is cleared to zero, but the time continues to be output; once the external 1pps recovers and remains stable for 60 consecutive seconds, it automatically exits timekeeping mode and is re-tamed. This strategy of continuing to output the time but clearing the reliability flag in timekeeping mode balances the continuous operation requirements of downstream devices with the reliability of the time: downstream devices can decide whether to accept the current time based on the reliability flag, rather than being forcibly interrupted.

[0110] Time output configuration The atomic clock time server acts as the master clock, providing time signals to downstream devices. The clock type is a standard clock. The PTP configuration file conforms to the IEEE 1588-2008 (PTPv2) standard, uses an end-to-end latency measurement mechanism, has a clock level of 6 (disciplined to a high-precision reference), and uses an atomic clock as the time source. Explicitly setting the time source to an atomic clock allows downstream PTP-enabled devices to recognize the server's clock quality level, thus prioritizing this server as the master clock when multiple clock sources are available.

[0111] The synchronization message interval is 1 second, the delay request message interval is 2 seconds, the announcement message interval is 2 seconds, and the priority is 128. The 1-second synchronization message interval strikes a balance between synchronization accuracy and network load, meeting the time accuracy requirements of applications such as financial transactions and power dispatching, while not significantly increasing the network burden.

[0112] The hardware timestamp is captured at the MII / GMII interface between the PHY and MAC layers. This location was chosen instead of capturing timestamps at the application layer or in the protocol stack because capturing them at the PHY-MAC interface minimizes latency jitter introduced by operating system protocol stack processing and software interrupts. The timestamp accuracy can reach ±8ns, and after calibration, it can be stabilized within ±20ns, which is far superior to the millisecond-level accuracy of timestamps taken at the application layer.

[0113] The PTP delay measurement process follows the end-to-end delay measurement mechanism of the IEEE 1588-2008 standard. The specific process is as follows: First, the atomic clock timing server, acting as the master clock, sends a Sync message. The FPGA captures the transmission time t1 when the message passes through the MII / GMII interface and sends t1 to the downstream device via a Follow_Up message. Second, the downstream device records the reception time t2 after receiving the Sync message. Third, the downstream device replies to the server with a Delay_Req message, recording the transmission time t3. Fourth, after receiving the Delay_Req message, the server's FPGA captures the reception time t4 and returns t4 to the downstream device via a Delay_Resp message. Fifth, the downstream device calculates the path delay based on the four timestamps: Path Delay = [(t2 - t1) + (t4 - t3)] / 2. The server can also calculate and compensate for the path delay based on the above timestamps.

[0114] As a backup solution, the NTP protocol is used, with the server acting as an NTP Stratum 1 clock source, running NTPv4. Hardware timestamps are also captured at the PHY layer with an accuracy better than 100ns and support NTP authentication. The NTP authentication function provides additional security for downstream devices using the NTP protocol.

[0115] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A high-precision, reliable time calibration system based on national cryptographic algorithms, characterized in that, include: A portable BeiDou time synchronization device is used to receive BeiDou satellite signals, generate TOD time data and 1pps second pulses, and provide a discipline signal, which includes 1pps pulses and TOD time data. A portable atomic clock time signaler is installed inside the portable Beidou time synchronization device in a pluggable drawer-type structure. When installed, it receives the discipline signal to discipline the atomic clock inside. After the atomic clock is locked, it generates a PTOD private protocol data frame and a synchronization second pulse that are encrypted with SM4 and verified for integrity with SM3-HMAC. After being removed from the portable Beidou time synchronization device, the portable atomic clock time signaler enters a timekeeping mode based on the disciplined atomic clock, and acts as an independent time source, outputting the PTOD private protocol data frame and synchronization second pulse through the aviation output interface on its own panel. The atomic clock timing server has a one-way isolation module at its input. The server receives PTOD private protocol data frames and synchronization second pulses from the portable atomic clock timing instrument via this module using a physical transfer method. The one-way isolation module only allows unidirectional signal transmission from the outside to the inside. The server performs SM4 decryption and SM3-HMAC integrity verification on the received PTOD private protocol data frames, uses the synchronization second pulses to tame the internal atomic clock, and performs time synchronization by combining the parsed time information. Finally, it outputs a timing signal through the network interface.

2. The high-precision reliable time calibration system based on the national cryptographic algorithm according to claim 1, characterized in that, The PTOD private protocol data frame is a fixed-length 56-byte frame, including an 8-byte plaintext header, an 8-byte time information, a 32-byte HMAC digest value, and 8 bytes of padding data. The 8-byte time information, the 32-byte HMAC digest value, and the 8-byte padding data are combined to form a 48-byte data block to meet the length requirements of SM4 block encryption. The 48-byte data block is then encrypted with SM4 to obtain a ciphertext data block, which is then concatenated with the 8-byte plaintext header to form the complete PTOD private protocol data frame.

3. The high-precision reliable time calibration system based on the national cryptographic algorithm according to claim 1, characterized in that, The portable atomic clock timing device includes an atomic clock, an FPGA, an MCU, a rechargeable lithium battery, and the aviation output interface. When installed inside the portable Beidou time synchronization device, it receives a 1pps pulse and TOD time data from the discipline signal through a 20-pin contact on the back. The atomic clock uses the 1pps pulse for closed-loop discipline and feeds back the locked state signal to the portable Beidou time synchronization device through the 20-pin contact. The FPGA uses the clock reference locked by the atomic clock to encrypt and perform integrity processing on the TOD time data, generating the PTOD private protocol data frame and synchronization second pulse. After being unplugged, the atomic clock is powered by the rechargeable lithium battery and enters a timekeeping mode based on the tamed frequency, continuously outputting the PTOD private protocol data frames and synchronization second pulses.

4. A high-precision, reliable time calibration system based on national cryptographic algorithms according to claim 3, characterized in that, The 20-pin contact signal between the portable atomic clock timekeeping device and the portable Beidou time synchronization device includes at least: a UART serial port signal for TOD data interaction, a discipline pulse signal for transmitting 1pps discipline pulses, and a lock feedback signal for the atomic clock to report the lock status to the host.

5. A high-precision, reliable time calibration system based on national cryptographic algorithms according to claim 1, characterized in that, The unidirectional isolation module of the atomic clock timing server is composed of optical coupling elements. The optical coupling elements are connected in series on the transmission path of the PTOD private protocol data frame and the transmission path of the synchronization second pulse, forming a unidirectional physical transfer channel for the signal, which physically blocks the reverse data leakage from the inside of the server to the external input interface.

6. A high-precision, reliable time calibration system based on national cryptographic algorithms according to claim 1, characterized in that, The atomic clock timing server includes a main control processor, an FPGA, an atomic clock, and a timing network interface. The PTOD private protocol data frame is sent to the main control processor via the one-way isolation module for SM4 decryption and SM3-HMAC verification. After successful verification, the main control processor sends the parsed time data to the FPGA via the SPI bus. The synchronization second pulse is input to the server's internal atomic clock via another one-way isolation module to tame it. The server's internal atomic clock feeds back a lock status signal to the FPGA. Based on the tamed atomic clock and the received time data, the FPGA maintains a local time counter and sets a clock trust flag in the output data packet. It then outputs a PTP or NTP timing signal through the timing network interface.

7. A high-precision, reliable time calibration system based on national cryptographic algorithms according to claim 6, characterized in that, When receiving and decrypting PTOD private protocol data frames, the main control processor also executes the following security policy: When a single SM3-HMAC verification fails, the PTOD private protocol data frame is discarded and a log is recorded. If the SM3-HMAC verification fails three times in a row, or if the verification failure rate exceeds 20% within 10 seconds, a warning will be triggered, the yellow indicator light will illuminate, and the receiver will continue to attempt to receive. If SM3-HMAC verification fails 10 times consecutively, or if the verification failure rate exceeds 50% within 1 minute, an alarm is triggered, the discipline is stopped and the system is switched to timekeeping mode, and the clock trust flag in the time data packet output by the network interface is set to invalid. When a time jump exceeding 1 second is detected and an HMAC check error is found, it is determined to be a replay attack. Emergency measures are immediately taken to cut off the power supply to the external input interface, and the on-site log is saved.

8. A high-precision, reliable time calibration system based on national cryptographic algorithms according to claim 1, characterized in that, The core processor of the portable Beidou time synchronization instrument and / or the atomic clock time synchronization server is the Loongson LS2K2000 processor, and its programmable logic device is a domestic FPGA.

9. A high-precision reliable time calibration method based on national cryptographic algorithms, applied to a high-precision reliable time calibration system based on national cryptographic algorithms as described in any one of claims 1 to 8, characterized in that, Includes the following steps: Step a: Receive BeiDou satellite signals using a portable BeiDou time synchronization device, and extract the TOD time data and 1pps second pulse; Step b: When the portable atomic clock time transmitter is installed in the portable Beidou time transmitter in a drawer-type structure, the atomic clock inside the portable atomic clock time transmitter is tamed by the 1pps second pulse, and the atomic clock lock status signal is fed back to the portable Beidou time transmitter to confirm that the taming is completed. After the atomic clock is locked, a PTOD private protocol data frame and a synchronization second pulse are generated, which are encrypted with SM4 and verified with SM3-HMAC. Step c: Remove the portable atomic clock time signaler from the portable Beidou time synchronization device, physically transport it to the atomic clock time signaling server, and connect the PTOD private protocol data frame and synchronization second pulse output from the aviation output interface on the panel of the portable atomic clock time signaler to the input interface of the atomic clock time signaling server via cable. Step d: The atomic clock timing server receives the PTOD private protocol data frame and synchronization second pulse through the internal one-way isolation module in a physical transfer manner; it performs SM4 decryption and SM3-HMAC integrity verification on the PTOD private protocol data frame, and extracts the time information after the verification is passed; at the same time, it uses the synchronization second pulse to tame the atomic clock inside the atomic clock timing server. Step e: The atomic clock timing server integrates the verified time information and the tamed internal atomic clock to complete the time calibration, and outputs a high-precision timing signal through the network interface.

10. A high-precision, reliable time calibration method based on national cryptographic algorithms according to claim 9, characterized in that, The specific process of generating the PTOD private protocol data frame in step b is as follows: Get the 8 bytes of time information to be sent; The 32-byte HMAC digest value was calculated using the SM3-HMAC algorithm; Add 8 bytes of random padding data, and combine it with the 8 bytes of time information and the 32 bytes of HMAC digest value to form a 48-byte data block, in order to meet the length requirements of SM4 block encryption; The 48-byte data block is encrypted using the SM4 algorithm to obtain a ciphertext data block; The 8-byte plaintext frame header is concatenated with the ciphertext data block to form a 56-byte PTOD private protocol data frame.

Images