Method for self-synchronizing time between communicating networked systems using timestamps

• US 7,676,679 B2
• Filed: 02/15/2005
• Issued: 03/09/2010
• Est. Priority Date: 02/15/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Weis, Brian E., McGrew, David A.
• Primary Examiner(s): Colin; Carl
• Assistant Examiner(s): Song; Hee
• Application Number:
  US11/059,178
• Publication Number:
  US 20060184797A1
• Time in Patent Office: 1,848 Days
• Field of Search: 370/412, 370/469, 370/516, 713/150, 713/152, 713/170, 713/400, 713/401, 713500-503, 713/178, 713/375
• US Class Current: 713/178
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

Nodes in a network include a pseudo-timestamp in messages or packets, derived from local pseudo-time clocks. When a packet is received, a first time is determined representing when the packet was sent and a second time is determined representing when the packet was received. If the difference between the second time and the first time is greater than a predetermined amount, the packet is considered to be stale and is rejected, thereby deterring replay. Because each node maintains its own clock and time, to keep the clocks relatively synchronized, if a time associated with a timestamp of a received packet is later than a certain amount with respect to the time at the receiver, the receiver'"'"'s clock is set ahead by an amount that expected to synchronize the receiver'"'"'s and the sender'"'"'s clocks. However, a receiver never sets its clock back, to deter attacks.

Claims

1. A machine-implemented method of synchronizing a pseudo-time clock of a sender of a packet and a pseudo-time clock of a receiver of the packet, the method comprising:

receiving, at the receiver, the packet sent from the sender;

determining a first pseudo-time associated with the pseudo-time clock of the receiver;

determining a second pseudo-time associated with the pseudo-time clock of the sender based on information in the packet;

determining whether the pseudo-time clock of the receiver and the pseudo-time clock of the sender are unsynchronized by more than an allowed amount, based on comparing the first pseudo-time and the second pseudo-time;

in response to determining that the pseudo-time clock of the sender is lagging the pseudo-time clock of the receiver by more than an allowed amount, sending, from the receiver to the sender, a packet comprising information from which a new pseudo-time can be determined that is based on the pseudo-time clock of the receiver,

wherein the method is performed by the receiver, and wherein the receiver comprises a processor.

2. A machine-implemented method as in claim 1, further comprising advancing the pseudo-time clock of the receiver in response to determining that the pseudo-time clock of the receiver is lagging the pseudo-time clock of the sender by more than the allowed amount.

3. A machine-implemented method as in claim 1, wherein the determining step comprises determining whether a difference between the first pseudo-time and the second pseudo-time is less than a predetermined amount.

4. A machine-implemented method as in claim 1, further comprising receiving at the receiver a message having information about an encryption key and a pseudo-time associated with an IPSec Security Association.

5. A machine-implemented method as in claim 1 wherein the first pseudo-time is determined from a pseudo-timestamp in a field of the packet.

6. A machine-implemented method as in claim 1 wherein the first pseudo-time is determined from a pseudo-timestamp in a portion of a field of the packet that contains a number of bits that is greater than a value determined based on an expected lifetime of a security association and a duration of time for a pseudo-time clock to generate two consecutive pseudo-times.

7. A machine-implemented method according to claim 1, wherein the pseudo-time clock of the receiver is not set backwards in pseudo-time even if the receiver'"'"'s pseudo-time clock is determined to have a pseudo-time that is expected to be advanced with respect to the pseudo-time clock of the sender.

8. A machine-implemented method as in claim 1, wherein the pseudo-time clock of the receiver advanced only according to a specified small amount.

9. A machine-implemented method according to claim 1, wherein the pseudo-time clock of the receiver is not set backwards in pseudo-time even if the receiver'"'"'s pseudo-time clock is determined to have a pseudo-time that is expected to be advanced with respect to the pseudo-time clock of the sender.

10. A machine-implemented method of synchronizing a pseudo-time clock of a sender of a packet and a pseudo-time clock of a receiver of the packet, the method comprising:

a sender including a first pseudo-timestamp in a first packet, wherein the first pseudo-timestamp includes information from which a first pseudo-time can be determined, and wherein the first pseudo-time is based on a first pseudo-time clock associated with the sender;

the sender sending the first packet to a receiver;

in reply, the sender receiving a second packet from the receiver;

the second packet having a second pseudo-timestamp that includes information from which a second pseudo-time can be determined, wherein the second pseudo-time is based on a second pseudo-time clock, wherein the second pseudo-time clock is associated with the receiver;

the sender determining that the first pseudo-time clock is expected to be lagging the second pseudo-time clock-based on the second pseudo-timestamp by more than a predetermined amount; and

the sender advancing the second pseudo-time clock to a pseudo-time that is expected to be synchronized with the first pseudo-time clock within a predetermined tolerance,

wherein the method is performed by the sender, and wherein the sender comprises a processor.

11. A machine-implemented method according to claim 10, wherein the second packet has an empty payload.

12. An apparatus for synchronizing a pseudo-time clock of a sender of a packet and a pseudo-time clock of a receiver of the packet, the method comprising:

one or more processors;

means for receiving, at the receiver, the packet sent from the sender;

means for determining a first pseudo-time associated with the pseudo-time clock of the receiver;

means for determining a second pseudo-time associated with the pseudo-time clock of the sender based on information in the packet;

means for determining whether the pseudo-time clock of the receiver and the pseudo-time clock of the sender are unsynchronized by more than an allowed amount, based on comparing the first pseudo-time and the second pseudo-time;

means for sending, from the receiver to the sender, a packet comprising information from which a new pseudo-time can be determined that is based on the pseudo-time clock of the receiver, in response to determining that the pseudo-time clock of the sender is lagging the pseudo-time clock of the receiver by more than an allowed amount.

13. An apparatus as in claim 12, further comprising means for advancing the pseudo-time clock of the receiver in response to determining that the pseudo-time clock of the receiver is lagging the pseudo-time clock of the sender by more than the allowed amount.

14. An apparatus as in claim 12, wherein the determining step comprises determining whether a difference between the first pseudo-time and the second pseudo-time is less than a predetermined amount.

15. An apparatus as in claim 12, further comprising means for receiving at the receiver a message having information about an encryption key and a pseudo-time associated with an IPSec Security Association.

16. An apparatus as in claim 12, wherein the first pseudo-time is determined from a pseudo-timestamp in a field of the packet.

17. An apparatus as in claim 12, wherein the first pseudo-time is determined from a pseudo-timestamp in a portion of a field of the packet that contains a number of bits that is greater than a value determined based on an expected lifetime of a security association and a duration of time for a pseudo-time clock to generate two consecutive pseudo-times.

18. An apparatus as in claim 12, wherein the pseudo-time clock of the receiver advanced only according to a specified small amount.