Abstract: Various systems and methods for evaluating time synchronization values provided from a clock leader are discussed. An example method performed by a clock follower device includes: obtaining a timestamp from a time synchronization protocol that provides synchronized time values from a clock leader; determining, based on the timestamp, a measured time drift value that represents a time drift of a hardware clock, with the time drift observed relative to the clock leader; determining an estimated time drift value that models a time drift of the hardware clock, modeled from one or more environmental conditions experienced by the hardware clock; comparing the measured time drift value with the estimated time drift value; and adjusting a clock of the device based on the timestamp, in response to validating that the measured time drift value is within a statistically expected range corresponding to the estimated time drift value.

Abstract: Techniques for an attack-aware digital twin in a time sensitive network are described. A method includes receiving time information for a network by an attack-aware digital twin (AADT), the AADT to simulate operations of a clock manager for a node in the network based on models of the clock manager, generating model clock control information to adjust a clock to a network time for the network, the model clock control information to contain a malicious time sample introduced by a time desynchronization attack in the network, and removing the malicious time sample from the model clock control information to adjust the clock to the network time for the network. Other embodiments are described and claimed.

Abstract: A method may include obtaining a platform data set. The method may also include providing a user interface operable to interact with the platform data set. The method may further include obtaining a natural language question from the user interface. The method may also include extracting at least one component from the natural language question. The method may further include identifying a first primitive and a second primitive. The method may also include transforming the natural language question into the tool query based on the at least one component using the first primitive. The method may further include executing the tool query in the tool using the second primitive to obtain query results from the platform data set associated with the natural language question. The method may also include providing the query results to the user interface in a natural language format.

Abstract: Techniques include an apparatus to retrieve a first parameter for the IDS to monitor a device for a time-synchronized network. The first parameter may represent a number of messages the IDS needs to analyze in order to detect a security attack. The messages may comprise time information to synchronize a clock for a device to a network time for a time-synchronized network. The processor circuitry may retrieve a second parameter for a time sensitive application. The second parameter may represent a defined amount of time error tolerated by the time sensitive application, and determine a third parameter for the IDS based on the first and second parameters. The third parameter may represent a defined frequency to receive a number of messages with time information in order to detect the security attack on the device within a defined time interval. Other embodiments are described and claimed.

Abstract: Systems and methods to detect attacks on the clocks of devices in time sensitive networks are described. Particularly, the disclosed systems and methods provide detection and mitigation of timing synchronization attacks based on pseudo-random numbers generated and used to select and authenticate timing of transmission of messages in protected transmission windows.

Abstract: Techniques include a method, apparatus, system and computer-readable medium to enhance security for time-synchronized networking. A method includes decoding a reference message comprising time information to synchronize a hardware clock of a time sensitive network (TSN) node with a network time for a TSN, the reference message associated with a reference synchronization interval, selecting a virtual clock from a set of virtual clocks for the TSN node, the virtual clock associated with a first synchronization interval that is different from the reference synchronization interval, and adjusting a time for the virtual clock based on the time information from the reference message to synchronize the virtual clock with the network time for the TSN. Other embodiments are described and claimed.

Abstract: Techniques include a method, apparatus, system and computer-readable medium to detect, quantify and localize attacks to enhance security for time-synchronized networking. Embodiments include a diagnostic stream producer to produce diagnostic information providing evidence of a timing attack on a node of a time-synchronized network. Embodiments include a diagnostic stream consumer to consume diagnostic information, analyze the diagnostic information, and determine whether a node is under a timing attack. Other embodiments are described and claimed.

Abstract: Techniques include receiving a message with time information from a clock leader by a clock follower in a time-synchronized network (TSN), the time information to synchronize a clock to a network time for the TSN, retrieving an actual time offset value for the message, the actual time offset value to comprise a value between an actual sending time and an actual receiving time of the message, retrieving an estimated time offset value for the message, the estimated time offset value to comprise a value between an estimated sending time and an estimated receiving time of the message, the estimated time offset value generated using a physics-aware model of the TSN and a clock adjustment value for the clock based on the time information, and determining whether the time information for the message was modified to cause the clock to desynchronize based on difference information. Other embodiments are described and claimed.

Abstract: An apparatus for clock manager redundancy comprises a clock circuitry to manage a clock for a device; a first processing circuitry coupled to the clock circuitry to execute instructions to perform operations for a clock manager, the clock manager to receive messages with time information for a network and generate clock manager control information to adjust the clock to a network time for the network; a hardened execution environment coupled to the clock circuitry and the first processing circuitry, the hardened execution environment to comprise: a detector to monitor the clock manager and generate an alert when the detector identifies abnormal behavior of the clock manager; and a second processing circuitry to execute instructions to perform operations for a redundant clock manager, the redundant clock manager to take over operations for the clock manager in response to the alert from the detector. Other embodiments are described and claimed.

Abstract: Techniques to perform time recovery from attacks on delayed authentication in a time synchronized network are described. One embodiment comprises a method for decoding time information and a message authentication code (MAC) from a time message, the time information to synchronize a local clock for a device to a network time of a time synchronized network (TSN), and the MAC to authenticate the time message, determining whether the time message is authentic using the MAC, discarding the time information when the time message is not authentic, performing a bounded search to identify authentic time information using the MAC, and passing the authentic time information to a clock manager to synchronize the local clock to the network time of the TSN when the authentic time information is identified. Other embodiments are described and claimed.

Abstract: A computing node to implement a management entity in a CP-based network. The node including processing circuitry configured to encode an inquiry message requesting information on CPS capabilities. Response messages are received from a set of sensing nodes of a plurality of sensing nodes in response to the inquiry message. The response messages include the information on the CPS capabilities of the set of sensing nodes. A notification message indicating selecting of a sensing node as a sensing coordinator is encoded for transmission. Sensed data received in a broadcast message from the sensing coordinator is decoded. The sensed data including data associated with one or more non-V2X capable sensing nodes.

Abstract: Techniques include a method, apparatus, system and computer-readable medium to detect, quantify and localize attacks to enhance security for time-synchronized networking. Embodiments include a diagnostic stream producer to produce diagnostic information providing evidence of a timing attack on a node of a time-synchronized network. Embodiments include a diagnostic stream consumer to consume diagnostic information, analyze the diagnostic information, and determine whether a node is under a timing attack. Other embodiments are described and claimed.

Abstract: Various systems and methods for evaluating time synchronization values provided from a clock leader are discussed. An example method performed by a clock follower device includes: obtaining a timestamp from a time synchronization protocol that provides synchronized time values from a clock leader; determining, based on the timestamp, a measured time drift value that represents a time drift of a hardware clock, with the time drift observed relative to the clock leader; determining an estimated time drift value that models a time drift of the hardware clock, modeled from one or more environmental conditions experienced by the hardware clock; comparing the measured time drift value with the estimated time drift value; and adjusting a clock of the device based on the timestamp, in response to validating that the measured time drift value is within a statistically expected range corresponding to the estimated time drift value.

Abstract: Systems, apparatuses and methods may provide for technology that detects one or more non-compliant nodes with respect to a timing schedule, detects one or more compliant nodes with respect to the timing schedule, and identifies a malicious node based on positions of the one or more non-compliant nodes and the one or more compliant nodes in a network topography. The non-compliant node(s) and the compliant node(s) may be detected based on post-synchronization messages, historical attribute data and/or plane diversity data.

Abstract: Techniques for clock manager monitoring for time sensitive networks are described. An apparatus, comprises a clock circuitry to manage a clock for a device, a processing circuitry coupled to the clock circuitry, the processing circuitry to execute instructions to perform operations for a clock manager, the clock manager to receive messages with time information for a network and generate clock manager control information to adjust the clock to a network time for the network, and a detector coupled to the processing circuitry and the clock circuitry, the detector to receive the clock manager control information, generate model control information based on a clock model, compare the clock manager control information with the model control information to generate difference information, and determine whether to generate an alert based on the difference information. Other embodiments are described and claimed.

Abstract: Techniques to perform time recovery from attacks on delayed authentication in a time synchronized network are described. One embodiment comprises a method for decoding time information and a message authentication code (MAC) from a time message, the time information to synchronize a local clock for a device to a network time of a time synchronized network (TSN), and the MAC to authenticate the time message, determining whether the time message is authentic using the MAC, discarding the time information when the time message is not authentic, performing a bounded search to identify authentic time information using the MAC, and passing the authentic time information to a clock manager to synchronize the local clock to the network time of the TSN when the authentic time information is identified. Other embodiments are described and claimed.

Abstract: Techniques include a method, apparatus, system and computer-readable medium to detect, quantify and localize attacks to enhance security for time-synchronized networking. Embodiments include a diagnostic stream producer to produce diagnostic information providing evidence of a timing attack on a node of a time-synchronized network. Embodiments include a diagnostic stream consumer to consume diagnostic information, analyze the diagnostic information, and determine whether a node is under a timing attack. Other embodiments are described and claimed.

Abstract: Techniques for an attack-aware digital twin in a time sensitive network are described. A method includes receiving time information for a network by an attack-aware digital twin (AADT), the AADT to simulate operations of a clock manager for a node in the network based on models of the clock manager, generating model clock control information to adjust a clock to a network time for the network, the model clock control information to contain a malicious time sample introduced by a time desynchronization attack in the network, and removing the malicious time sample from the model clock control information to adjust the clock to the network time for the network. Other embodiments are described and claimed.

Abstract: Techniques include a method, apparatus, system and computer-readable medium to detect, quantify and localize attacks to enhance security for time-synchronized networking. Embodiments include a diagnostic stream producer to produce diagnostic information providing evidence of a timing attack on a node of a time-synchronized network. Embodiments include a diagnostic stream consumer to consume diagnostic information, analyze the diagnostic information, and determine whether a node is under a timing attack. Other embodiments are described and claimed.

Abstract: Systems, apparatuses, and methods to attest to and verify the integrity of cargo during transport by an autonomous vehicle are provided. An autonomous vehicle can discretize parameters associated with transportation of cargo and can generate a keyed hash digest from the discretized parameters. The keyed hash digest can be sent to a stakeholder in the transportation of the cargo to attest to the integrity of the cargo during transport.