Traps and pitfalls in secure clock synchronization

Clock synchronization has become one of the enabling techniques to enable real-time on both application-and network level. One of the most promising and currently intensively discussed approaches is IEEE1588, a master slave based synchronization protocol, which is intended to be a protocol not only limited for one application use, but for many domains such as telecom, test and measurement or factory automation. For some of these application domains security is a crucial feature, not only to prevent malicious attacks, but also to avoid accidental disturbances such as wrongly configured devices in the net. For the sake of these security requirements in version 2 of the IEEE1588 standard an informative annex describes an extension of the widely accepted protocol. Nevertheless not only the extension of a protocol with security fields defines a secure system, also a policy has to declare what to do in certain cases. This paper describes this security extension and gives and extensive analysis on the applicable threads as well as an attack of the master and approaches to include version 2 switches in a secure IEEE1588 clock synchronized network.