Network Time Protocol Research Articles

Characterisation and synchronisation of a netted software defined radio radar

AbstractThe present work intends to characterise the combination of two netted software defined radios (SDR) and different radio frequency (RF) front‐ends installed in them, together with a two‐stratum time dissemination and synchronisation system. A modified implementation of the Network Time Protocol is used as coarse event synchronisation for either SDR back‐end. The White rabbit light embedded node implementation of the commonly known white rabbit synchronisation system (IEEE 1588 PTP‐2019) or arbitrary wave form generators are used as fine time dissemination system for either SDR. The resulting netted transceiver system is intended to compose a demonstrator for proof‐of‐concept experiments. The findings presented in this article show that the chosen combination of hardware and software is suitable for radar applications operating within L‐, S‐ and C‐bands. A channel coherency throughout the network with a relative modified Allan deviation of less than 80 fs for averaging intervals of 1 s, a phase noise better than −118 dBc/Hz at 10 Hz frequency offset and a fractional frequency lower than was measured. Within a single transceiver node, a fractional frequency lower than and phase noise of −124 dBc/Hz at 10 Hz frequency offset were measured as well. Multistatic radar systems exploit wide spatial diversity to enhance target detection and tracking, albeit with increased complexity when compared to a monostatic configuration. To exploit these benefits, all participating transceiver nodes within the netted radar need to synchronise to a common time base . The achieved synchronisation level increases the accuracy with which the chain of timed events at the transmitter and at the receiver side occur, intending to maximise the signal‐to‐noise ratio available at the receiver. The Universal software radio peripheral model X310 with two different daughterboard models as RF front‐end was used as SDR on either radar node. A network combining data and synchronisation purposes allowed the radar nodes under test to operate synchronously. The two‐stratum synchronisation system used glass fibres between 2 m and 5 km of length or coaxial cables with 2 m in length for network traffic, time and frequency dissemination purposes. The multiple RF front‐ends were stimulated by means of arbitrary waveform generators with calibrated traceability. Up‐chirp and sinusoid waveforms were used as stimuli for measuring the offset of either channel with regards of to ultimately estimate the achievable coherency limits of the system under test. Both analogue and digital evaluation methods were considered.

A Mixed Approach for Clock Synchronization in Distributed Data Acquisition Systems.

Proper timing synchronization is important when data from sensors are acquired by different devices. This paper proposes a simple but effective solution for System on Chip (SoC) architectures that integrates a general-purpose Field Programmable Gate Array (FPGA) with a CPU. The proposed approach relies on a network synchronization protocol implemented in software, such as Network Time Protocol (NTP) or Precision Time Protocol (PTP), and uses the FPGA to generate a clock reference that is maintained in step with the synchronized system clock. The clock generated by the FPGA is obtained from the FPGA oscillator via appropriate fractional clock division. Clock drift is avoided via a software program that periodically compares the FPGA and the system counters, respectively, and adjusts the fractional clock divider in order to slightly adjust the FPGA clock frequency using a Proportional Integral controller. A specific implementation is presented on the RedPitaya platform, generating a 1 MHz clock in step with the NTP synchronized system clock. The presented system has been used in a distributed data acquisition system for fast transient recording in the neutral beam test facility for the ITER nuclear fusion experiment.

Network Time Protocol based Black Box Timing Accuracy Analysis for Internet of Things Devices

With large-scale Cyber-Physical Systems (Internet of Things) deployments, the low-cost networked devices are becoming ubiquitous. Time stamping of events is a basic requirement and it is crucial for distributed/isolated systems/devices to work in unison. The system clocks of these devices are not very stable and their behaviour is affected by ageing and environmental conditions. A clock’s timing behaviour is generally analysed independently by comparison to a highly stable standard reference clock using specialized instruments. Network Time Protocol (NTP) is widely used for time synchronization over computer networks. As the NTP server clock is more stable in comparison to a client’s system clock, the variation in the end device’s clock offset values with respect to the NTP server clock over a long time can be considered for analysing the behaviour of the end device’s clock. This paper presents a method for analysing clock behaviour based on NTP messages. A computer programme is developed, which utilizes an open-source NTP client library to exchange NTP messages and records end device’s system clock’s offset variations over time for a given periodicity to analyse the behaviour. This black box analysis approach does not require any direct access to the end device’s clock circuit. The solution may be useful for analysing clock behaviour for long-term stability under actual environmental conditions, for deciding time synchronization periodicity to optimize the number of synchronization packet exchanges, and for pre-deployment timing stability assessment of devices for deployment scenarios having intermittent/non-availability of periodic time synchronization.

An empirical study of reflection attacks using NetFlow data

Reflection attacks are one of the most intimidating threats organizations face. A reflection attack is a special type of distributed denial-of-service attack that amplifies the amount of malicious traffic by using reflectors and hides the identity of the attacker. Reflection attacks are known to be one of the most common causes of service disruption in large networks. Large networks perform extensive logging of NetFlow data, and parsing this data is an advocated basis for identifying network attacks. We conduct a comprehensive analysis of NetFlow data containing 1.7 billion NetFlow records and identified reflection attacks on the network time protocol (NTP) and NetBIOS servers. We set up three regression models including the Ridge, Elastic Net and LASSO. To the best of our knowledge, there is no work that studied different regression models to understand patterns of reflection attacks in a large network. In this paper, we (a) propose an approach for identifying correlations of reflection attacks, and (b) evaluate the three regression models on real NetFlow data. Our results show that (a) reflection attacks on the NTP servers are not correlated, (b) reflection attacks on the NetBIOS servers are not correlated, (c) the traffic generated by those reflection attacks did not overwhelm the NTP and NetBIOS servers, and (d) the dwell times of reflection attacks on the NTP and NetBIOS servers are too small for predicting reflection attacks on these servers. Our work on reflection attacks identification highlights recommendations that could facilitate better handling of reflection attacks in large networks.

Deep Dive into NTP Pool's Popularity and Mapping

Time synchronization is of paramount importance on the Internet, with the Network Time Protocol (NTP) serving as the primary synchronization protocol. The NTP Pool, a volunteer-driven initiative launched two decades ago, facilitates connections between clients and NTP servers. Our analysis of root DNS queries reveals that the NTP Pool has consistently been the most popular time service. We further investigate the DNS component (GeoDNS) of the NTP Pool, which is responsible for mapping clients to servers. Our findings indicate that the current algorithm is heavily skewed, leading to the emergence of time monopolies for entire countries. For instance, clients in the US are served by 551 NTP servers, while clients in Cameroon and Nigeria are served by only one and two servers, respectively, out of the 4k+ servers available in the NTP Pool. We examine the underlying assumption behind GeoDNS for these mappings and discover that time servers located far away can still provide accurate clock time information to clients. We have shared our findings with the NTP Pool operators, who acknowledge them and plan to revise their algorithm to enhance security.

Analysis of Damage to Network Time Protocol (NTP) Server on Cengkareng Radar Equipment in Perum LPPNPI Branch JATSC

The On The Job Training (OJT) program which will be implemented in 2022-2023 also includes collaboration with the LPPNPI Jakarta Air Traffic Service Center (JATSC) Branch Office. On The Job Training (OJT) involves various divisions that handle various equipment and facilities that support aviation safety, including equipment such as the Network Time Protocol (NTP) Server used to synchronize the time of equipment connected to the server network at the Jakarta Air Traffic Services Center (JATSC), thereby ensuring accurate operating times for all connected equipment. All of these efforts aim to improve safety and efficiency in aviation at the national and international levels. However, in this case, in operation, not all equipment always runs well, as does Network Time Protocol (NTP) server 1 at the LPPNPI Jakarta Air Traffic Services Center (JATSC) Branch. The purpose of this research is that the author wants to solve the problems that occur in On The Job Training (OJT) activities at Perum LPPNPI Jakarta Air Traffic Services Center (JATSC) Branch.

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Enhancing Wireless Sensor Network in Structural Health Monitoring through TCP/IP Socket Programming-Based Mimic Broadcasting: Experimental Validation

This paper presents the implementation of a synchronous Structural Health Monitoring (SHM) framework utilizing wireless, low-cost, and off-the-shelf components. Vibration-based condition monitoring plays a crucial role in assessing the reliability of structural systems by detecting damage through changes in vibration parameters. The adoption of low-cost Micro-Electro-Mechanical Systems (MEMS) sensors in Wireless Sensor Networks (WSNs) has gained traction, emphasizing the need for precise time synchronization to schedule wake-up times of multiple sensor nodes for data collection. To address this challenge, our proposed method introduces a TCP/IP socket programming-based mimic broadcasting mechanism and a scalable sensing network controlled by a central gateway, leveraging the Raspberry Pi Python platform. The system operates using Internet of Things (IoT) concepts and adopts a star topology, where a packet is transmitted from the gateway to initiate measurements simultaneously on multiple sensor nodes. The sensor node comprises a MEMS accelerometer, a real time clock DS3231 module and Raspberry Pi Zero 2W (RPi0-2W), while the gateway employs a Raspberry Pi 4 (RPi4). To ensure accurate time synchronization, all Pi0-2W nodes were configured as Network Time Protocol (NTP) clients, synchronizing with an RPi4 server using chrony, the reliable implementation of the NTP. Through experimental evaluations, the system demonstrates its effectiveness and reliability in achieving initial time synchronization. This study addresses the challenge of achieving precise time alignment between sensor nodes through the utilization of the Dynamic Time Wrapping (DTW) method for Frequency Domain Decomposition (FDD) applications. The contribution of this research significantly enhances the field by improving the accuracy and reliability of time-aligned measurements, with a specific focus on utilizing low-cost sensors. By developing a practical and cost-effective SHM framework, this work advances the accessibility and scalability of structural health monitoring solutions, facilitating more widespread adoption and implementation in various engineering applications

Assessment of an NTP service calibration over a Local Area Network

Nowadays, timekeeping is an essential component in modern computing. The Network Time Protocol (NTP) is a distributed service based on a hierarchical network protocol used to synchronize computer clocks over a network in an easy and scalable manner. Currently, this protocol is the main mechanism used on the internet to provide a common notion of time to all computers. The Real Instituto y Observatorio de la Armada (ROA) realizes Spanish legal time and disseminates it via the internet from two publicly accessible NTP time servers. In this study, it is assessed the implementation and characterization of two NTP time servers over a Local Area Network in client-to-server and server-to-server modes from the side of NTP protocol and all its functionalities. These measurements aim to analyze the client-to-server mode operation, forcing the polling interval at different values, and to verify the consistency of the results by employing the ppstest tool to compare one pulse‐per‐second from the UTC (ROA) with the client time offset. This comparison corroborates the proper operation of the NTP time server configured as stratum 1 and referred directly to UTC (ROA), and shows how a real deployment can be professionally deployed with the aim of distributing time over a public service using NTP.

Deep Dive into NTP Pool's Popularity and Mapping

Time synchronization is of paramount importance on the Internet, with the Network Time Protocol (NTP) serving as the primary synchronization protocol. The NTP Pool, a volunteer-driven initiative launched two decades ago, facilitates connections between clients and NTP servers. Our analysis of root DNS queries reveals that the NTP Pool has consistently been the most popular time service. We further investigate the DNS component (GeoDNS) of the NTP Pool, which is responsible for mapping clients to servers. Our findings indicate that the current algorithm is heavily skewed, leading to the emergence of time monopolies for entire countries. For instance, clients in the US are served by 551 NTP servers, while clients in Cameroon and Nigeria are served by only one and two servers, respectively, out of the 4k+ servers available in the NTP Pool. We examine the underlying assumption behind GeoDNS for these mappings and discover that time servers located far away can still provide accurate clock time information to clients. We have shared our findings with the NTP Pool operators, who acknowledge them and plan to revise their algorithm to enhance security.

A Dynamic Framework for Internet-Based Network Time Protocol.

Time synchronization is vital for accurate data collection and processing in sensor networks. Sensors in these networks often operate under fluctuating conditions. However, an accurate timekeeping mechanism is critical even in varying network conditions. Consequently, a synchronization method is required in sensor networks to ensure reliable timekeeping for correlating data accurately across the network. In this research, we present a novel dynamic NTP (Network Time Protocol) algorithm that significantly enhances the precision and reliability of the generalized NTP protocol. It incorporates a dynamic mechanism to determine the Round-Trip Time (RTT), which allows accurate timekeeping even in varying network conditions. The proposed approach has been implemented on an FPGA and a comprehensive performance analysis has been made, comparing three distinct NTP methods: dynamic NTP (DNTP), static NTP (SNTP), and GPS-based NTP (GNTP). As a result, key performance metrics such as variance, standard deviation, mean, and median accuracy have been evaluated. Our findings demonstrate that DNTP is markedly superior in dynamic network scenarios, a common characteristic in sensor networks. This adaptability is important for sensors installed in time-critical networks, such as real-time industrial IoTs, where precise and reliable time synchronization is necessary.

Internet of things-blockchain lightweight cryptography to data security and integrity for intelligent application

The industrial internet of things (IoT) plays a major role in the growth of automation and increasing digital connectivity for machine-to-machine communication. The research community has extensively investigated the possibility of IoT and blockchain integration for the last couple of years. The major research is focused on the benefits of integrating blockchain with IoT. In this work, we first focus on the issue of integrating IoT nodes with blockchain networks, especially for non-real-time IoT nodes that do not have an in-built clock mechanism. As a result, they cannot establish communication with real-time blockchain networks. Another critical security issue is protecting data coming from IoT devices to blockchain networks. Blockchain is enough mature to protect the data in its ecosystem. However, information coming from outside of the world does not have any guarantee of data integrity and security. This paper first addresses the clock synchronization issue of IoT nodes with blockchain using a network time protocol and then proposes an IoT-blockchain light-weight cryptographic (IBLWC) approach to secure the entire IoT-blockchain ecosystem. This paper also presents the performance analysis of IBLWC as a suitable and cost-effective solution that incurs less processing overhead for IoT-blockchain-based applications.

Ethernet-based timing system for accelerator facilities: The IFMIF-DONES case

This article presents the design of a timing system for accelerator facilities, which relies on a general networking approach based on standard Ethernet protocols that keeps all the devices synchronized to a common time reference. The case of the IFMIF-DONES infrastructure is studied in detail, providing a framework for the implementation of the timing system. The network time protocol (NTP) with software timestamping and the precision time protocol (PTP) with hardware timestamping are used to synchronize devices with sub-millisecond and sub-microsecond accuracy requirements, respectively. The design also considers the utilization of IEEE 1588 high accuracy default PTP profile (PTP-HA) to provide sub-nanosecond accuracy for the most demanding components. Three different solutions for the design of the timing system are discussed in detail. The first solution considers the deployment of one time-dedicated network for each synchronization protocol, while the second one proposes the integration of the synchronization data of NTP and PTP into the networks of the facility. The third solution relies on the single distribution of PTP-HA to all the systems. The final design aims to be fully based on standard technologies and to be cost-efficient, seeking for interoperability and scalability, and minimizing the impact on other systems in the facility. An experimental setup has been implemented to evaluate and discuss the suitability of the solutions for the timing system by studying the synchronization accuracy obtained with NTP, PTP and PTP-HA under different network conditions. It includes a timing evaluation platform that tries to resemble the network architecture foreseen in the facility. The measured results revealed that PTP is the most limiting protocol for the second solution. Using the default PTP configuration, it tolerates less than 20% of maximum bandwidth utilization for symmetric bidirectional flows, and around 30% in the case of unidirectional flows (server to client or client to server), with the current setup and using switches without enabled timing support. This case study provides a better understanding of the trade-off between bandwidth utilization, synchronization accuracy and cost in these kinds of facilities.

Study of Methods and Techniques for Manipulating the Time Synchronization Component of NTP Servers in Computer Networks

Abstract In computer networks as well as in many other domains, time synchronization is carried out by some dedicated devices called time servers that uses network protocols, such as NTP (Network Time Protocol), PTP (Precision Time Protocol) or SNTP (Simple Network Time Protocol). Many domains and applications, such as, computer networks, security protocols, telecommunications, network services, and many others, depend on accurate time synchronization. According to the CVE (Common Vulnerabilities and Exposures) databases, between 2001-2022, more than 150 time synchronization protocols vulnerabilities have been reported. One of the most dangerous threats is the manipulation of the time synchronization information. Thus, the existence of such a vulnerability can generate serious security problems. Considering these aspects, in this article we aim to use some methods and techniques for the manipulation of the time component and use them to test some synchronization systems. This will require real-life scenarios of the use of time synchronization systems in which some methods and techniques are applied to exploit their vulnerabilities. Following these scenarios, we will be able to assess the risk to which these systems are exposed.

On the Challenges of Acoustic Energy Mapping Using a WASN: Synchronization and Audio Capture

Acoustic energy mapping provides the functionality to obtain characteristics of acoustic sources, as: presence, localization, type and trajectory of sound sources. Several beamforming-based techniques can be used for this purpose. However, they rely on the difference of arrival times of the signal at each capture node (or microphone), so it is of major importance to have synchronized multi-channel recordings. A Wireless Acoustic Sensor Network (WASN) can be very practical to install when used for mapping the acoustic energy of a given acoustic environment. However, they are known for having low synchronization between the recordings from each node. The objective of this paper is to characterize the impact of current popular synchronization methodologies as part of the WASN to capture reliable data to be used for acoustic energy mapping. The two evaluated synchronization protocols are: Network Time Protocol (NTP) y Precision Time Protocol (PTP). Additionally, three different audio capture methodologies were proposed for the WASN to capture the acoustic signal: two of them, recording the data locally and one sending the data through a local wireless network. As a real-life evaluation scenario, a WASN was built using nodes conformed by a Raspberry Pi 4B+ with a single MEMS microphone. Experimental results demonstrate that the most reliable methodology is using the PTP synchronization protocol and audio recording locally.

Peningkatan Keamanan pada Simple Network Time Protocol (SNTP) untuk Mendeteksi Cybercrime di dalam Aktivitas Jaringan

Today's cybercrime methods are extremely diverse. The methods employed by attackers are becoming more diverse and intricate. Malicious software, commonly referred to as malware, is utilized in these various attacks. Malware threats and their propagation can be accomplished in several different ways. Good governance facilitates prevention via migration, assisting the security team and network infrastructure IT. This paper discusses efforts to enhance the security of the Simple Network Time Protocol (SNTP) to detect cybercrime on the network. Based on the results of the conducted experiments, we determined that by updating the Simple Network Time Protocol, implementing the client-server antivirus, and scanning every client connected to the local network or centrally, we could detect the types of attacks that frequently occur on the network system, thereby protecting all client computers from malware, viruses, worms, and Trojan horses. Based on the antivirus migration data, the employed research method can find information on cybercrimes that involve malware that enters the network and is successfully cleaned or quarantined before being automatically blocked.

IoT Based Health Monitoring System for Physiological Investigation

The health monitoring system is emerged in the recent times since it is most desirable for checking physiological conditions. Internet of Things (IoT) based health care is one of the growing research which helps to monitor the physiological conditions in a repeated span of time. This technology is much obliged especially during epidemic conditions. Hence, present study focuses on development of distembot system which is used to measure temperature, pulse rate and respiratory rate of a person for a repeated span of time. It is identified that wrist position provides the accurate measurements of human body conditions. Hence in this paper, wrist watch is developed as distembot system. Initially, distembot system is designed and fabricated using Fused Deposition Modelling (FDM) technology. Then, temperature sensor and pulse sensor amped heart rate sensor are employed in the system to measure temperature, pulse rate and respiratory rate of a person. The distembot system is interfaced with respective sensors using ESP32 module. Network Time Protocol (NTP) is adopted to synchronize the clock over a network and OLED is interfaced with the system to display the measurements. The digital values of various measurements are extracted from the device using Wi-Fi module. The results suggested that proposed system is performing effectively to monitor the human health conditions in a repeated span of time.

Ultra Wideband-based wireless synchronization of IEEE 1588 clocks

Time-Sensitive Networking (TSN) requires clock synchronization superior to the well-known Network Time Protocol (NTP). The IEEE 802.1AS-2020 used for synchronization in TSN networks is based on the IEEE 1588-2019 standard (also known as Precision Time Protocol, PTP) defines methods and tools to perform sub-microsecond time synchronization over vari- ous communication channels. However, the IEEE 1588 implementation is commonly used with wired communication protocols, although there are use cases that could gain an advantage from a wireless solution. This paper investigates the possibility of PTP clock synchronization through wireless Ultra Wideband (UWB) communication. UWB excels where other wireless technologies are lacking: it provides high accuracy timestamping even if multipath propagation is present. The method is evaluated using commercial, well-accessible cheap hardware, resulting in the order of 10-nanosecond accuracy. The paper also highlights the main error components and requirements for improving wireless PTP synchronization.

Key Extraction Using Ambient Sounds for Smart Devices

To secure communications, this article presents a key extraction scheme for smart devices using ambient sounds. Specifically, it is designed for the scenario when smart devices do not have any pre-loaded secrets. Moreover, it can be implemented when smart devices have no access to the online trusted third party or the Network Time Protocol server. In our scheme, smart devices achieve synchronization by making use of ambient sounds. Then, they calculate and obtain the pairing distance and secure distance by applying a band-pass filter. Completing these operations, two smart devices can directly extract a communication key. We analyze the security of our scheme and evaluate the performance of it by implementing the scheme using a few off-the-shelf devices. The experimental results indicate that compared with related schemes, the bit generation rate of our scheme has significant improvement (increases at least 80%), and it can reach 312 bit/s.