Time Synchronization for Encrypted Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing time synchronization protocols in computer networks face inaccuracies due to variable packet latency, especially when encryption is involved, leading to incorrect clock adjustments in network devices.
Innovation Solution
The techniques introduce sideband data to hold unencrypted time information, allowing transmission hardware to schedule packet release accurately, ensuring the embedded timestamp reflects the actual release time, even in encrypted synchronization packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied to synchronization packets to secure time information, then security is improved, but time synchronization accuracy deteriorates due to variable packet latency
Solution Approach 1:
The packet processing is segmented into distinct stages: encryption/decryption stage and timestamping stage. The encryption operation occurs first on the synchronization packet, followed by timestamp insertion after decryption. This segmentation allows each operation to be performed independently with predictable timing, eliminating the variability caused by attempting to timestamp encrypted packets.
Solution Approach 2:
The encryption operation is performed as a preliminary action before timestamping. By encrypting the synchronization packet first and then decrypting it before inserting the timestamp, the system ensures that the timestamp reflects the actual transmission time rather than being obscured by encryption variability. This preliminary encryption followed by decryption and timestamping resolves the accuracy issue.
2Measurement precision
If a fixed delay is introduced to account for encryption and transmission time, then time synchronization is attempted, but accuracy deteriorates because the fixed delay fails to accurately account for variable hardware operations
Solution Approach 1:
The system uses self-service by having the receiving device calculate the actual delay based on its own local clock and the received timestamp, rather than relying on predetermined fixed delay values from the transmitting device. This eliminates the need for complex delay modeling and accounts for actual hardware variability automatically.
Solution Approach 2:
The timestamp mechanism provides feedback about the actual transmission time to the receiving device. By comparing the received timestamp with the local clock at the receiving end, the system can accurately determine the actual delay experienced, creating a feedback loop that compensates for hardware variability without requiring complex predictive models.
3Reliability
If timestamp is embedded in encrypted synchronization packet, then security is maintained, but the timestamp does not reflect actual release time due to encryption processing time variability
Solution Approach 1:
The process is segmented into distinct phases: encryption phase, decryption phase, and timestamping phase. The timestamp is inserted only after decryption is complete, ensuring that the timestamp reflects the actual release time. This segmentation separates the security function (encryption) from the timing function (timestamping), allowing both to perform optimally without interfering with each other.
Solution Approach 2:
Instead of the conventional approach of timestamping then encrypting (which causes accuracy issues), the patent inverts the order by encrypting first, then decrypting and timestamping. This inversion ensures that the timestamp is applied to the plaintext packet at the point of release, accurately reflecting the actual transmission time while maintaining security through the encryption layer.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In general, various aspects of the techniques described in this disclosure provide time synchronization for encrypted traffic in a computer network. In one example, the disclosure describes an apparatus, such as a network device, having a control unit for a network device in a computerized network having a topology of network devices; and a forwarding unit operative to determine a release time for sending a synchronization packet in accordance with a time synchronization protocol; modify the synchronization packet to include a release timestamp specifying the release time; sending a time value via sideband data associated with the synchronization packet, wherein the time value is based on the release time specified by the release timestamp; and schedule transmission of the synchronization packet for a time corresponding to the time value in the sideband data, the synchronization packet to be transmitted to a destination network device.