Network Time Protocol Servers Research Articles

Network Time Protocol based Black Box Timing Accuracy Analysis for Internet of Things Devices

With large-scale Cyber-Physical Systems (Internet of Things) deployments, the low-cost networked devices are becoming ubiquitous. Time stamping of events is a basic requirement and it is crucial for distributed/isolated systems/devices to work in unison. The system clocks of these devices are not very stable and their behaviour is affected by ageing and environmental conditions. A clock’s timing behaviour is generally analysed independently by comparison to a highly stable standard reference clock using specialized instruments. Network Time Protocol (NTP) is widely used for time synchronization over computer networks. As the NTP server clock is more stable in comparison to a client’s system clock, the variation in the end device’s clock offset values with respect to the NTP server clock over a long time can be considered for analysing the behaviour of the end device’s clock. This paper presents a method for analysing clock behaviour based on NTP messages. A computer programme is developed, which utilizes an open-source NTP client library to exchange NTP messages and records end device’s system clock’s offset variations over time for a given periodicity to analyse the behaviour. This black box analysis approach does not require any direct access to the end device’s clock circuit. The solution may be useful for analysing clock behaviour for long-term stability under actual environmental conditions, for deciding time synchronization periodicity to optimize the number of synchronization packet exchanges, and for pre-deployment timing stability assessment of devices for deployment scenarios having intermittent/non-availability of periodic time synchronization.

An empirical study of reflection attacks using NetFlow data

Reflection attacks are one of the most intimidating threats organizations face. A reflection attack is a special type of distributed denial-of-service attack that amplifies the amount of malicious traffic by using reflectors and hides the identity of the attacker. Reflection attacks are known to be one of the most common causes of service disruption in large networks. Large networks perform extensive logging of NetFlow data, and parsing this data is an advocated basis for identifying network attacks. We conduct a comprehensive analysis of NetFlow data containing 1.7 billion NetFlow records and identified reflection attacks on the network time protocol (NTP) and NetBIOS servers. We set up three regression models including the Ridge, Elastic Net and LASSO. To the best of our knowledge, there is no work that studied different regression models to understand patterns of reflection attacks in a large network. In this paper, we (a) propose an approach for identifying correlations of reflection attacks, and (b) evaluate the three regression models on real NetFlow data. Our results show that (a) reflection attacks on the NTP servers are not correlated, (b) reflection attacks on the NetBIOS servers are not correlated, (c) the traffic generated by those reflection attacks did not overwhelm the NTP and NetBIOS servers, and (d) the dwell times of reflection attacks on the NTP and NetBIOS servers are too small for predicting reflection attacks on these servers. Our work on reflection attacks identification highlights recommendations that could facilitate better handling of reflection attacks in large networks.

Deep Dive into NTP Pool's Popularity and Mapping

Time synchronization is of paramount importance on the Internet, with the Network Time Protocol (NTP) serving as the primary synchronization protocol. The NTP Pool, a volunteer-driven initiative launched two decades ago, facilitates connections between clients and NTP servers. Our analysis of root DNS queries reveals that the NTP Pool has consistently been the most popular time service. We further investigate the DNS component (GeoDNS) of the NTP Pool, which is responsible for mapping clients to servers. Our findings indicate that the current algorithm is heavily skewed, leading to the emergence of time monopolies for entire countries. For instance, clients in the US are served by 551 NTP servers, while clients in Cameroon and Nigeria are served by only one and two servers, respectively, out of the 4k+ servers available in the NTP Pool. We examine the underlying assumption behind GeoDNS for these mappings and discover that time servers located far away can still provide accurate clock time information to clients. We have shared our findings with the NTP Pool operators, who acknowledge them and plan to revise their algorithm to enhance security.

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Deep Dive into NTP Pool's Popularity and Mapping

Time synchronization is of paramount importance on the Internet, with the Network Time Protocol (NTP) serving as the primary synchronization protocol. The NTP Pool, a volunteer-driven initiative launched two decades ago, facilitates connections between clients and NTP servers. Our analysis of root DNS queries reveals that the NTP Pool has consistently been the most popular time service. We further investigate the DNS component (GeoDNS) of the NTP Pool, which is responsible for mapping clients to servers. Our findings indicate that the current algorithm is heavily skewed, leading to the emergence of time monopolies for entire countries. For instance, clients in the US are served by 551 NTP servers, while clients in Cameroon and Nigeria are served by only one and two servers, respectively, out of the 4k+ servers available in the NTP Pool. We examine the underlying assumption behind GeoDNS for these mappings and discover that time servers located far away can still provide accurate clock time information to clients. We have shared our findings with the NTP Pool operators, who acknowledge them and plan to revise their algorithm to enhance security.

Study of Methods and Techniques for Manipulating the Time Synchronization Component of NTP Servers in Computer Networks

Abstract In computer networks as well as in many other domains, time synchronization is carried out by some dedicated devices called time servers that uses network protocols, such as NTP (Network Time Protocol), PTP (Precision Time Protocol) or SNTP (Simple Network Time Protocol). Many domains and applications, such as, computer networks, security protocols, telecommunications, network services, and many others, depend on accurate time synchronization. According to the CVE (Common Vulnerabilities and Exposures) databases, between 2001-2022, more than 150 time synchronization protocols vulnerabilities have been reported. One of the most dangerous threats is the manipulation of the time synchronization information. Thus, the existence of such a vulnerability can generate serious security problems. Considering these aspects, in this article we aim to use some methods and techniques for the manipulation of the time component and use them to test some synchronization systems. This will require real-life scenarios of the use of time synchronization systems in which some methods and techniques are applied to exploit their vulnerabilities. Following these scenarios, we will be able to assess the risk to which these systems are exposed.

Key Extraction Using Ambient Sounds for Smart Devices

To secure communications, this article presents a key extraction scheme for smart devices using ambient sounds. Specifically, it is designed for the scenario when smart devices do not have any pre-loaded secrets. Moreover, it can be implemented when smart devices have no access to the online trusted third party or the Network Time Protocol server. In our scheme, smart devices achieve synchronization by making use of ambient sounds. Then, they calculate and obtain the pairing distance and secure distance by applying a band-pass filter. Completing these operations, two smart devices can directly extract a communication key. We analyze the security of our scheme and evaluate the performance of it by implementing the scheme using a few off-the-shelf devices. The experimental results indicate that compared with related schemes, the bit generation rate of our scheme has significant improvement (increases at least 80%), and it can reach 312 bit/s.

An Improved Network Time Protocol for Industrial Internet of Things.

In the industrial Internet of Things, the network time protocol (NTP) can be used for time synchronization, allowing machines to run in sync so that machines can take critical actions within 1 ms. However, the commonly used NTP mechanism does not take into account that the network packet travel time over a link is time-varying, which causes the NTP to make incorrect synchronization decisions. Therefore, this paper proposed a low-cost modification to NTP with clock skew compensation and adaptive clock adjustment, so that the clock difference between the NTP client and NTP server can be controlled within 1 ms in the wired network environment. The adaptive clock adjustment skips the clock offset calculation when the NTP packet run trip time (RTT) exceeds a certain threshold. The clock skew compensation addresses the inherent issue that different clocks (or oscillators) naturally drift away from each other. Both adaptive clock adjustment and clock skew compensation are environment dependent and device dependent. The measurement result in our experimental environment shows that the when the RTT threshold is set at 1.7 ms, the best synchronization accuracy is achieved.

Traceability of network time service to UTC(NIM): online calibration

Network time service provided by Network Time Protocol (NTP) servers is widely used to synchronize the clocks of computers and other networked equipment. With the rapid development of smart devices and their applications, more NTP servers as time sources need to be calibrated to a legal time reference. This work proposes using a low-cost and convenient calibration method to investigate the time service capability of ten NTP servers located at different cities in China. The uncertainties (k = 2) of the time offsets between Coordinated Universal Time (National Institute of Metrology) and network time from NTP servers for a single measurement are generally less than 150 ms, and the uncertainties (k = 2) of the mean time offsets for 24 h are less than 85 ms. Calibration results were found at the same level when applying the two time references, which were maintained a time offset less than 10 ns and located more than 1000 km apart.

NDNTP: A Named Data Networking Time Protocol.

Named Data Networking (NDN) architectural features, including multicast data delivery, stateful forwarding, and in-network data caching, have shown promise for applications such as video streaming and file sharing. However, collaborative applications, requiring a multi-producer participation introduce new NDN design challenges. In this paper, we highlight these challenges in the context of the Network Time Protocol (NTP) and one of its most widely-used deployments for NTP server discovery, the NTP pool project. We discuss the design requirements for the support of NTP and NTP pool and present general directions for the design of a time synchronization protocol over NDN, coined Named Data Networking Time Protocol (NDNTP).

Smearing time: Critical temporality and corporate ontology

Since 1972 a leap second has been introduced into global time standardization systems, due to the discrepancy between Coordinated Universal Time and International Atomic Time. Until recently, the leap second has been a consensual, if mildly uncanny adjustment, a para-governmental temporal wobble. Google's explanation of its actions with regard to the insertion of a leap second smeared into its Network Time Protocol servers is couched in terms of a period extending initially over 20 h, ultimately reaching 24 h. Google is intent on taking ownership of the smear and transducing it into a technologically stabilised change. Although there are a number of different strategies of smearing time, Google advocates for its standard smear that it wants other digital giants like Bloomberg, Amazon and Microsoft to replicate. In this paper we first analyze Google's temporal strategy in terms of its affinities and departures from the classical view of time in Aristotle's core considerations in the Physics Book IV, in terms of a consonant enumeration but in our example at variable speeds/intervals, and then in terms of Wolfgang Ernst's conception of time-critical media. Leap seconds conform to Ernst's sense of kairotic time, an auspicious micro-moment that is both techno-mathematically pre-defined and decisive for ensuring operationality. Google executes smeared time-critical processes but wants to establish mastery over the measurement and manipulation of humanly imperceptible microtemporal events by inhabiting temporal ontology itself, proposing its practice, based on misleading its servers, as a model for other digital hegemons.

High-Performance Time Server Core for FPGA System-on-Chip

This paper presents the complete design and implementation of a low-cost, low-footprint, network time protocol server core for field programmable gate arrays. The core uses a carefully designed modular architecture, which is fully implemented in hardware using digital circuits and systems. Most remarkable novelties introduced are a hardware-optimized timekeeping algorithm implementation, and a full-hardware protocol stack and automatic network configuration. As a result, the core is able to achieve similar accuracy and performance to typical high-performance network time protocol server equipment. The core uses a standard global positioning system receiver as time reference, has a small footprint and can easily fit in a low-range field-programmable chip, greatly scaling down from previous system-on-chip time synchronization systems. Accuracy and performance results show that the core can serve hundreds of thousands of network time clients with negligible accuracy degradation, in contrast to state-of-the-art high-performance time server equipment. Therefore, this core provides a valuable time server solution for a wide range of emerging embedded and distributed network applications such as the Internet of Things and the smart grid, at a fraction of the cost and footprint of current discrete and embedded solutions.

Remote calibration of time from NTP servers

The Network Time Protocol (NTP), is used for time synchronization in most networked equipment. Seen as capable of 50 ms accuracy or better, it lacks calibration for metrological traceability to its reference, Coordinated Universal Time (UTC). In response to client requests for traceability, the National Research Council (NRC) has begun to monitor NTP servers and document their traceability. We use an NTP calibrator at NRC to measure the time offset of a remote client’s NTP server with respect to UTC(NRC). Standard NTP methods and systems are utilized, even for the NTP calibrator in the NRC Time Laboratory. The service aims at broad applicability rather than low uncertainty and can provide traceability to any networked computer that is configured as an NTP server. As with any calibration service, measurement results and the associated uncertainties are reported for each monitored NTP server for quality system records and auditing purposes, and we also make available near-real-time results and alerts.

Improving Cell Tower Geo-Location Using Quantum Clock Timing

Precise round trip timing for a transmitted electromagnetic wave is key when triangulating using timing techniques i.e. TDoA, ToA and RTT. Using mobile based location services or network assisted location based trilateration, a low drift and high frequency clock is ideal. GPS has always had a leading edge it terms of accuracy when it came to triangulation, because the GPS satellites use quantum timers to keep precise time. This research work intends to minimise timing error by the use of high precision master clock from a Network Time Protocol (NTP) server driven by a caesium oscillator. In this work, we have proposed to negate the use of timing capabilities of the handheld device in calculating the time of propagation between itself and the radio access interface (Um interface) and instead use proprietary vendor quantum timing clocks. In the proposed model, the cell tower will send a time stamp on a Broadcast Control Channel (BCCH) burst. The burst will contain a time stamp on a Time Division Multiple access (TDM) time slot. Clock reference for the NTP server will be via GPS.

Real‐Time Video Latency Measurement between a Robot and Its Remote Control Station: Causes and Mitigation

This work presents a detailed study, characterization, and measurement of video latency in a real‐time video streaming application. The target application consists of an automatic control system in the form of a control station and the mini Remotely Operated Vehicle (ROV) equipped with a camera, which is controllable over local area network (LAN) and the Internet. Control signal transmission and feedback measurements to the operator usually impose real‐time constraints on the network channel. Similarly, the video stream, which is required for the normal system control and maneuvering, imposes further strict requirements on the network in terms of bandwidth and latency. Based on these requirements, controlling the system in real time through a standard Internet connection is a challenging task. The measurement of important network parameters like availability, bandwidth, and latency has become mandatory for remotely controlling the system in real time. It is necessary to establish a methodology for the measurement of video and network latency to improve the real‐time controllability and safety of the system as such measurement is not possible using existing solutions due to the following reasons: insufficient accuracy, relying on the Internet resources such as generic Network Time Protocol (NTP) servers, inability to obtain one‐way delay measurement, and many solutions only having support for web cameras. Here, an efficient, reliable, and cost‐effective methodology for the measurement of latency of a video stream over a LAN and the Internet is proposed. A dedicated stratum‐1 NTP server is used and the necessary software needed for acquiring and measuring the latency of a video stream from a generic IP camera as well as integration into the existing ROV control software was developed. Here, by using the software and dedicated clock synchronization equipment (NTP server), it was found that normal video latencies in a LAN were in the range of 488ms – 850ms, while latencies over the Internet were measured to be in the range of 558ms – 1211ms. It is important to note that the values were obtained by using a generic (off‐the‐shelf) IP camera and they represent the actual latencies which might be experienced during control over long range and across international territory borders.

Measurement of One-Way Delays in IP Networks

The NetTestBox combined hardware–software complex, which supports measurement of IP network performance metrics, is created. The metrics are intended for estimation of the quality of Internet connections. The basic aspects of the implementation of measurements of one-way network delays in the complex are described. The selection of a network time protocol server for NetTestBox is evaluated. Results of measurements of the duration of the main components of a network delay are presented.

NTP DRDoS Attack Vulnerability and Mitigation

The Network Time Protocol (NTP) is used to synchronize clocks of various computer devices such as personal computers, tablets, and phones based their set time zones. The network of devices that use these NTP servers form a huge distributed network that attracted a number of attacks from late 2013 towards early 2014. This paper presents a hands-on test of the Distributed Reflection Denial of Service (DRDoS) attack by the monlist command, provides more vulnerability in the protocol, and offers mitigation to these vulnerabilities. A Kali Linux server was used to test the monlist command on its localhost. The results showed that a request with a size of 234 bytes got a response of 4,680 bytes. A busy NTP server can return up to 600 addresses which were theoretically calculated to return approximately 48 kilobytes in 100 packets. Consequently, this results in an amplification factor of 206×. The knowledge of the way the attack can be propagated was an important step in thwarting the attack and mitigating more such threats in the same protocol.

A Matter of Timing: Consumer Electronics and Network Time

Network time protocol (NTP) has become widely used across the Internet to synchronize clocks on computers and, more recently, on a wide variety of handheld devices. You are using NTP on a daily basis without even knowing it?when you set your mobile phone to get its time from the local network, you are linking into a global network of NTP servers that coordinate time across the entire Internet.

High accuracy sequence of event system based on GPS

In order to meet the resolution requirement of hundreds of microseconds,microsecond global clock synchronization must be achieved in Sequence of Event(SOE) system.By means of assessing the existing clock synchronization methods and analyzing the cause of the error in the clock synchronization process,a new method based on the combination of improved Network Time Protocol(NTP) server synchronization and 1PPS synchronization was proposed.That is: advanced NTP server was used to eliminate the clock error between the control stations,"cross-second" phenomenon was avoided in this situation;1 PPS was used to synchronize the millisecond counters in order to eliminate the crystal accumulated error of Field Programmable Gate Array(FPGA).This method is simple,precise and stable.The resolution of SOE system by using this technique can be up to 0.5 ms,and it has been applied to the turbine protection system in a power plant successfully.