阅读说明：本技术 一种基于最优估计的时间同步攻击检测与修正方法和装置 (Time synchronization attack detection and correction method and device based on optimal estimation ) 是由 冯旭哲 陆青 周超 胡梅 马超 刘宗敏 于 2021-03-26 设计创作，主要内容包括：本申请涉及一种基于最优估计的时间同步攻击检测与修正方法、装置、计算机设备和存储介质。所述方法包括：获取观测钟差序列,以钟差二项式模型参数和钟差攻击量为优化变量,以受到时间攻击时观测钟差序列和真实钟差序列的差值最小为优化目标,构建最优化模型,在约束条件下求解最优化模型,得到钟差二项式模型参数的估计值和钟差攻击量的估计值；根据钟差二项式模型参数的估计值拟合观测窗口内的钟差模型,确定观测窗口内的预测钟差序列；根据观测钟差序列和预测钟差序列得到接收机钟差模型拟合残差,根据接收机钟差模型拟合残差判断接收机是否受到时间同步攻击,若受到攻击,根据钟差攻击量的估计值对接收机当前的钟差解算值进行修正。(The application relates to a time synchronization attack detection and correction method and device based on optimal estimation, computer equipment and a storage medium. The method comprises the following steps: acquiring an observation clock error sequence, constructing an optimization model by taking a clock error binomial model parameter and a clock error attack amount as optimization variables and taking the minimum difference value between the observation clock error sequence and a real clock error sequence when being attacked by time as an optimization target, and solving the optimization model under a constraint condition to obtain an estimation value of the clock error binomial model parameter and an estimation value of the clock error attack amount; fitting a clock error model in an observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window; and obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting a current clock error calculation value of the receiver according to an estimated value of a clock error attack amount.)

1. A time synchronization attack detection and correction method based on optimal estimation is characterized by comprising the following steps:

acquiring an observation clock error sequence of the satellite time service receiver in an observation window;

according to the coefficient matrix of the observation clock error sequence and the binomial model for describing the clock error, taking the parameters of the clock error binomial model and the clock error attack amount as optimization variables, and taking the minimum difference value between the observation clock error sequence and the real clock error sequence when being attacked by time as an optimization target, constructing an optimization model, and solving the optimization model under the constraint condition to obtain the estimation value of the parameters of the clock error binomial model and the estimation value of the clock error attack amount; the clock error binomial model parameters comprise clock drift, frequency drift and clock error;

fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model;

and obtaining a receiver clock error model fitting residual error according to the observation clock error sequence and the prediction clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack amount.

2. The method according to claim 1, wherein, based on the observed clock difference sequence and the coefficient matrix of the binomial model for describing the clock difference, the optimization model is constructed by using the parameters of the binomial model for clock difference and the attack amount for clock difference as optimization variables and using the minimum difference between the observed clock difference sequence and the real clock difference sequence when being attacked by time as an optimization target, and the optimization model is solved under the constraint condition to obtain the estimated values of the parameters of the binomial model for clock difference and the estimated values of the attack amount for clock difference, comprising:

according to the coefficient matrix of the observation clock error sequence and the binomial model used for describing the clock error, the parameters of the clock error binomial model and the clock error attack amount are taken as optimization variables, the minimum difference value between the observation clock error sequence and the real clock error sequence when the clock error is attacked is taken as an optimization target, and the construction of the optimization model is as follows:

wherein the content of the first and second substances,；representing the sequence of observed clock differences,which is indicative of the current observation time instant,representing observation windowsThe length of the first and second support members,represents the observed clock error;an estimated value representing the clock error attack amount;a true value representing the amount of clock error attack;representing estimated values of said clock-difference binomial model parameters, whereinRespectively representing estimated values of clock drift, frequency drift and clock offset of the receiver;representing the true values of the parameters of the clock-difference binomial model;representing the coefficient matrix;a true value representing the receiver clock drift;

solving the optimization model under the constraint condition to obtain an estimated value of the clock error binomial model parameter and an estimated value of the clock error attack amount; the constraint condition is。

3. The method of claim 2, wherein fitting a clock model within the observation window based on the estimated values of the clock binomial model parameters, determining a sequence of predicted clock differences within the observation window based on the clock model, comprises:

fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model as follows:

wherein the content of the first and second substances,，nindicating a time sequence number within the observation window;representing the predicted clock error obtained from the clock error model.

4. The method of claim 3, wherein determining whether the receiver is under a time synchronization attack based on a current clock offset in the observed clock offset sequence and the predicted clock offset sequence comprises:

obtaining a fitting error sequence of each moment in the observation window according to the difference value of the observation clock error sequence and the prediction clock error sequence，；

From the fitting error sequence，，Representing the step length of the sliding window to obtain the mean value of the fitting errorAnd standard deviation of；

Judgment ofFitting error of time of dayWhether or not to fall onWithin the interval, ifThen the receiver is considered to be inThe time is not attacked by time synchronization ifThen the receiver is considered to be inThe time of day is subject to a time synchronization attack.

5. The method of claim 4, wherein the modifying the current clock offset solution of the receiver according to the estimated value of the clock offset attack amount if the receiver is attacked comprises:

if the receiver is attacked, correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack quantity, and obtaining the corrected clock error calculation value as follows:

wherein the content of the first and second substances,is shown inmAn estimate of the amount of said clock error attack at a time.

6. The method of claim 5, wherein determining whether the receiver is under time synchronization attack according to the current clock offset in the observed clock offset sequence and the predicted clock offset sequence, and if the receiver is under attack, after correcting the current clock offset calculation value of the receiver according to the estimated value of the clock offset attack amount, the method comprises:

moving the observation window backwardAnd (5) continuously carrying out time synchronization attack detection and correction on each observation epoch.

7. The method according to any one of claims 1 to 6, wherein acquiring the sequence of observation clock differences of the satellite timing receiver in the observation window comprises:

and resolving to obtain an observation clock error sequence in an observation window according to the satellite navigation signal received by a receiving antenna of the satellite time service receiver.

8. An optimal estimation based time synchronization attack detection and modification apparatus, the apparatus comprising:

the observation clock error sequence acquisition module is used for acquiring an observation clock error sequence of the satellite time service receiver in an observation window;

the optimization model solving module is used for constructing an optimization model by taking clock error binomial model parameters and clock error attack quantity as optimization variables and taking the minimum difference value between an observation clock error sequence and a real clock error sequence when the clock error binomial model is attacked by time as an optimization target according to the observation clock error sequence and a coefficient matrix of a binomial model for describing clock error, and solving the optimization model under the constraint condition to obtain an estimation value of the clock error binomial model parameters and an estimation value of the clock error attack quantity; the clock error binomial model parameters comprise clock drift, frequency drift and clock error;

the predicted clock difference sequence acquisition module is used for fitting a clock difference model in the observation window according to the estimated value of the clock difference binomial model parameter and determining a predicted clock difference sequence in the observation window according to the clock difference model;

and the clock error correction module is used for obtaining a receiver clock error model fitting residual error according to the observation clock error sequence and the prediction clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack amount if the receiver is attacked.

9. A computer device comprising a memory and a processor, the memory storing a computer program, wherein the processor implements the steps of the method of any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 7.

Technical Field

The application relates to the field of satellite time service anti-spoofing, in particular to a time synchronization attack detection and correction method and device based on optimal estimation, computer equipment and a storage medium.

Background

With the continuous improvement of the technology level, the precision requirement of each industry on time synchronization becomes higher and higher. For example, power systems utilize phase measurement units to estimate the state of the grid in real time and perform system control and power scheduling accordingly, while phase measurement units rely heavily on precise time synchronization, which can be achieved by satellite navigation solutions or network time synchronization protocols. Besides, time synchronization is widely used in the fields of mobile communication, aviation control, robot cooperative control, and sensor-based passive positioning.

Positioning, navigation and time service are three basic services of a global satellite navigation system. The satellite time service is the most important time service method at present because of the characteristics of wide audience, good accuracy, long-term stability and the like. The time service type receiver is used as a main device for realizing time synchronization, and high-precision time is obtained by resolving the received satellite navigation signal, so that a standard time signal is provided for each system. At present, the time synchronization system based on the GPS/BDS uses civil GPS/BDS signals, and the signal structure of the civil satellite navigation signals is disclosed, which makes the time synchronization system vulnerable to time synchronization attack. The attack aiming at the time synchronization system is to inject false satellite navigation signals into the receiver, so that the target receiver solves and obtains wrong time information, and further, the time of an important infrastructure department of the opposite party cannot be synchronized. Time synchronization attacks, which typically do not see the effect immediately, cause losses and hazards that are covert and persistent, so efficient time synchronization attack resistant algorithms are necessary.

The prior art has the problem of poor real-time performance.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a time synchronization attack detection and correction method, apparatus, computer device and storage medium based on optimal estimation, which can improve the real-time performance of the algorithm.

A time synchronization attack detection and correction method based on optimal estimation comprises the following steps:

acquiring an observation clock error sequence of the satellite time service receiver in an observation window;

according to a coefficient matrix of an observation clock error sequence and a binomial model for describing clock errors, taking parameters of the clock error binomial model and a clock error attack amount as optimization variables, and taking the minimum difference value between the observation clock error sequence and a real clock error sequence when being attacked by time as an optimization target, constructing an optimization model, and solving the optimization model under a constraint condition to obtain an estimation value of the parameters of the clock error binomial model and an estimation value of the clock error attack amount; the clock error binomial model parameters comprise clock drift, frequency drift and clock error;

fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model;

and obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting a current clock error calculation value of the receiver according to an estimated value of a clock error attack amount.

In one embodiment, the method further comprises the following steps: according to the coefficient matrix of the observation clock error sequence and the binomial model used for describing the clock error, the parameters of the clock error binomial model and the clock error attack amount are taken as optimization variables, the minimum difference value between the observation clock error sequence and the real clock error sequence when the clock error is attacked is taken as an optimization target, and the construction of the optimization model is as follows:

wherein the content of the first and second substances,；a sequence of observed clock differences is represented,which is indicative of the current observation time instant,which represents the length of the observation window,represents the observed clock error;an estimated value representing the clock error attack amount;a true value representing the amount of clock error attack;representing estimated values of clock-error binomial model parameters, whereinRespectively representing estimated values of clock drift, frequency drift and clock offset of the receiver;representing the true values of the parameters of the clock-difference binomial model;representing a coefficient matrix;a true value representing the receiver clock drift;

solving the optimized model under the constraint condition to obtain an estimated value of clock error binomial model parameters and an estimated value of clock error attack quantity; the constraint condition is。

In one embodiment, the method further comprises the following steps: fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model as follows:

wherein the content of the first and second substances,，nindicating a time sequence number within the observation window;representing the predicted clock error obtained from the clock error model.

In one embodiment, the method further comprises the following steps: obtaining the fitting error sequence of each time in the observation window according to the difference value of the observation clock difference sequence and the predicted clock difference sequence，；

From the fitting error sequence，，Representing the step length of the sliding window to obtain the mean value of the fitting errorAnd standard deviation of；

Judgment ofFitting error of time of dayWhether or not to fall onWithin the interval, ifThen the receiver is considered to be inThe time is not attacked by time synchronization ifThen the receiver is considered to be inThe time of day is subject to a time synchronization attack.

In one embodiment, the method further comprises the following steps: if the receiver is attacked, correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack quantity, and obtaining the corrected clock error calculation value as follows:

wherein the content of the first and second substances,is shown inmAn estimate of the amount of clock-error attack at a time.

In one embodiment, the method further comprises the following steps: obtaining a receiver clock error model fitting residual error according to the observation clock error sequence and the prediction clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, if so, correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack amount, and moving the observation window backwardsAnd (5) continuously carrying out time synchronization attack detection and correction on each observation epoch.

In one embodiment, the method further comprises the following steps: and resolving to obtain an observation clock error sequence in an observation window according to the satellite navigation signal received by a receiving antenna of the satellite time service receiver.

An optimal estimation based time synchronization attack detection and correction device, comprising:

the observation clock error sequence acquisition module is used for acquiring an observation clock error sequence of the satellite time service receiver in an observation window;

the optimization model solving module is used for establishing an optimization model by taking parameters of a clock error binomial model and a clock error attack amount as optimization variables and taking the minimum difference value between the observed clock error sequence and a real clock error sequence when the clock error binomial model is attacked by time as an optimization target according to a coefficient matrix of the observed clock error binomial model and the binomial model used for describing the clock error, and solving the optimization model under the constraint condition to obtain an estimation value of the parameters of the clock error binomial model and an estimation value of the clock error attack amount; the clock error binomial model parameters comprise clock drift, frequency drift and clock error;

the system comprises a prediction clock error sequence acquisition module, a clock error model generation module and a clock error correction module, wherein the prediction clock error sequence acquisition module is used for fitting a clock error model in an observation window according to an estimated value of a clock error binomial model parameter and determining a prediction clock error sequence in the observation window according to the clock error model;

and the clock error correction module is used for obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack amount if the receiver is attacked.

A computer device comprising a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program:

acquiring an observation clock error sequence of the satellite time service receiver in an observation window;

according to a coefficient matrix of an observation clock error sequence and a binomial model for describing clock errors, taking parameters of the clock error binomial model and a clock error attack amount as optimization variables, and taking the minimum difference value between the observation clock error sequence and a real clock error sequence when being attacked by time as an optimization target, constructing an optimization model, and solving the optimization model under a constraint condition to obtain an estimation value of the parameters of the clock error binomial model and an estimation value of the clock error attack amount; the clock error binomial model parameters comprise clock drift, frequency drift and clock error;

fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model;

and obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting a current clock error calculation value of the receiver according to an estimated value of a clock error attack amount.

A computer-readable storage medium, on which a computer program is stored which, when executed by a processor, carries out the steps of:

acquiring an observation clock error sequence of the satellite time service receiver in an observation window;

according to a coefficient matrix of an observation clock error sequence and a binomial model for describing clock errors, taking parameters of the clock error binomial model and a clock error attack amount as optimization variables, and taking the minimum difference value between the observation clock error sequence and a real clock error sequence when being attacked by time as an optimization target, constructing an optimization model, and solving the optimization model under a constraint condition to obtain an estimation value of the parameters of the clock error binomial model and an estimation value of the clock error attack amount; the clock error binomial model parameters comprise clock drift, frequency drift and clock error;

fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model;

and obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting a current clock error calculation value of the receiver according to an estimated value of a clock error attack amount.

According to the time synchronization attack detection and correction method and device based on optimal estimation, the computer equipment and the storage medium, an observation clock difference sequence of the satellite time service receiver in an observation window is obtained, the clock difference binomial model parameters and the clock difference attack amount are used as optimization variables, the minimum difference value between the observation clock difference sequence and the real clock difference sequence when the satellite time service receiver is attacked is used as an optimization target, an optimization model is constructed, the optimization model is solved under the constraint condition, and the estimation value of the clock difference binomial model parameters and the estimation value of the clock difference attack amount are obtained; then, fitting a clock error model in an observation window according to the estimated value of the clock error binomial model parameter, and further determining a predicted clock error sequence in the observation window; and obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting a current clock error calculation value of the receiver according to an estimated value of a clock error attack amount. Compared with other time synchronization attack resisting algorithms, the algorithm provided by the invention can be detected and corrected in real time, is good in real time and has a good effect on resisting time synchronization attack.

Drawings

FIG. 1 is a schematic flow chart of a method for time-synchronized attack detection and correction based on optimal estimation according to an embodiment;

FIG. 2 is a schematic flow chart of a method for time-synchronized attack detection and correction based on optimal estimation in another embodiment;

FIG. 3 is a schematic diagram of detecting and correcting a mutant time synchronization attack as contemplated in one embodiment;

FIG. 4 is a diagram of detecting and correcting a persistent time synchronization attack as is involved in one embodiment;

FIG. 5 is a block diagram of an embodiment of an apparatus for time-synchronized attack detection and modification based on optimal estimation;

FIG. 6 is a diagram illustrating an internal structure of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

The time synchronization attack detection and correction method based on the optimal estimation can be applied to the following application environments. Executing a time synchronization attack detection and correction method based on optimal estimation through a satellite time attack detection terminal, acquiring an observation clock error sequence of a satellite time service receiver in an observation window, constructing an optimal model by taking clock error binomial model parameters and a clock error attack amount as optimization variables and taking the minimum difference value between the observation clock error sequence and a real clock error sequence when the satellite time service receiver is subjected to time attack as an optimization target, and solving the optimal model under a constraint condition to obtain an estimated value of the clock error binomial model parameters and an estimated value of the clock error attack amount; then, fitting a clock error model in an observation window according to the estimated value of the clock error binomial model parameter, and further determining a predicted clock error sequence in the observation window; and obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting a current clock error calculation value of the receiver according to an estimated value of a clock error attack amount.

In one embodiment, as shown in fig. 1, there is provided a time synchronization attack detection and correction method based on optimal estimation, comprising the following steps:

and 102, acquiring an observation clock error sequence of the satellite time service receiver in an observation window.

The deviation between the time obtained by the satellite time service receiver and the standard system time is called receiver clock error, and the clock error of the receiver can be expressed by a binomial model within a period of time as follows:

in the formula (I), the compound is shown in the specification,for receiver at reference timeDeviation from system time, also known as receiver clock error;for receiver internal clock at reference timeFrequency drift relative to actual frequency;is the drift factor of the receiver clock frequency, i.e. the clock drift.

In the prior art, a binomial coefficient is determined by performing polynomial fitting on observation data, and a sliding window mode is adopted to recur backwards so as to ensure that the obtained coefficient has good continuity.

104, according to the observation clock error sequence and the coefficient matrix of the binomial model for describing the clock error, taking the parameters of the clock error binomial model and the clock error attack amount as optimization variables, and taking the minimum difference value between the observation clock error sequence and the real clock error sequence when being attacked by time as an optimization target, constructing an optimization model, and solving the optimization model under the constraint condition to obtain the estimation value of the parameters of the clock error binomial model and the estimation value of the clock error attack amount;

the coefficient matrix is predefined according to a clock-difference binomial model structure. In the embodiment, the optimal estimation mode is adopted, the solution of the clock error binomial model parameters and the clock error attack amount is converted into the solution optimization model, and the algorithm provided by the invention can be detected and corrected in real time, so that the time synchronization attack resisting method has a good effect.

And step 106, fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model.

The predicted clock difference sequence is obtained according to a clock difference binomial model constructed by the estimated binomial model parameters, and has certain continuity and predictability.

And 108, obtaining a receiver clock difference model fitting residual according to the observation clock difference sequence and the prediction clock difference sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock difference model fitting residual, and if so, correcting the current clock difference calculation value of the receiver according to the estimated value of the clock difference attack quantity.

If the difference between the observed clock difference value obtained by the receiver at the observation time and the clock difference value predicted by the binomial is too large, the receiver is considered to be attacked by time synchronization, and the current clock difference calculation value of the receiver needs to be corrected according to the estimated value of the clock difference attack amount.

In the time synchronization attack detection and correction method based on optimal estimation, an observation clock error sequence of a satellite time service receiver in an observation window is obtained, a clock error binomial model parameter and a clock error attack amount are used as optimization variables, the minimum difference value between the observation clock error sequence and a real clock error sequence when the satellite time service receiver is attacked is used as an optimization target, an optimization model is constructed, the optimization model is solved under a constraint condition, and an estimation value of the clock error binomial model parameter and an estimation value of the clock error attack amount are obtained; then, fitting a clock error model in an observation window according to the estimated value of the clock error binomial model parameter, and further determining a predicted clock error sequence in the observation window; and obtaining a receiver clock error model fitting residual error according to the observed clock error sequence and the predicted clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, and if so, correcting a current clock error calculation value of the receiver according to an estimated value of a clock error attack amount. Compared with other time synchronization attack resisting algorithms, the algorithm provided by the invention can be detected and corrected in real time, is good in real time and has a good effect on resisting time synchronization attack.

In one embodiment, the method further comprises the following steps: according to the coefficient matrix of the observation clock error sequence and the binomial model used for describing the clock error, the parameters of the clock error binomial model and the clock error attack amount are taken as optimization variables, the minimum difference value between the observation clock error sequence and the real clock error sequence when the clock error is attacked is taken as an optimization target, and the construction of the optimization model is as follows:

wherein the content of the first and second substances,；a sequence of observed clock differences is represented,which is indicative of the current observation time instant,which represents the length of the observation window,represents the observed clock error;an estimated value representing the clock error attack amount;representing trueness of clock error attackA value;representing estimated values of clock-error binomial model parameters, whereinRespectively representing estimated values of clock drift, frequency drift and clock offset of the receiver;representing the true values of the parameters of the clock-difference binomial model;representing a coefficient matrix;a true value representing the receiver clock drift;

solving the optimized model under the constraint condition to obtain an estimated value of clock error binomial model parameters and an estimated value of clock error attack quantity; the constraint condition is。

In one embodiment, the method further comprises the following steps: fitting a clock error model in the observation window according to the estimated value of the clock error binomial model parameter, and determining a predicted clock error sequence in the observation window according to the clock error model as follows:

wherein the content of the first and second substances,，nindicating a time sequence number within the observation window;representing the predicted clock error obtained from the clock error model.

In one embodiment, the method further comprises the following steps: obtaining the fitting error sequence of each time in the observation window according to the difference value of the observation clock difference sequence and the predicted clock difference sequence，(ii) a From the fitting error sequence，，Representing the step length of the sliding window to obtain the mean value of the fitting errorAnd standard deviation of(ii) a Judgment ofFitting error of time of dayWhether or not to fall onWithin the interval, ifThen the receiver is considered to be inThe time is not attacked by time synchronization ifThen the receiver is considered to be inThe time of day is subject to a time synchronization attack. If the receiver is attacked, correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack quantity, and obtaining the corrected clock error calculation value as follows:

wherein the content of the first and second substances,is shown inmAn estimate of the amount of clock-error attack at a time.

In one embodiment, the method further comprises the following steps: obtaining a receiver clock error model fitting residual error according to the observation clock error sequence and the prediction clock error sequence, judging whether the receiver is attacked by time synchronization according to the receiver clock error model fitting residual error, if so, correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack amount, and moving the observation window backwardsAnd (5) continuously carrying out time synchronization attack detection and correction on each observation epoch.

In one embodiment, the method further comprises the following steps: and resolving to obtain an observation clock error sequence in an observation window according to the satellite navigation signal received by a receiving antenna of the satellite time service receiver.

It should be understood that, although the steps in the flowchart of fig. 1 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a portion of the steps in fig. 1 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

In one embodiment, as shown in fig. 2, a time synchronization attack detection and correction method based on optimal estimation is provided, which includes the following steps:

step (1): the receiver is obtained by resolving according to the satellite navigation signal received by the receiving antennakClock difference value of receiver of time of day；

Step (2): will be provided withkMarking the actual clock error attack amount of the timeLength of sliding observation windowThe step size of the sliding is marked. When the receiver is in normal operation, the signal is calculated and obtainedAfter a true receiver clock difference valueWithin the observation window of (a) solving the following optimization model:

wherein，Is a receiver clock difference sequence, and each item of the sequence is a clock difference value obtained by the receiver after normal resolving in the step (1) or correction in the step (6).The sequence is the estimated clock error attack quantity of each time, and the estimation result is 0 to indicate that the receiver is not attacked by time synchronization at the time.Is estimated to bekA fitting coefficient of a receiver clock error binomial model of a time, whereinRespectively representing the clock drift, frequency drift and clock offset of the receiver, because the clock drift of the high-precision crystal oscillator used by the general receiver is less than that of the common receiver in a short timeIn magnitude, therefore there areSatisfy the requirement of。The coefficient matrix is obtained by using a clock error binomial model of the receiver in an observation windowThe discretization of each observation epoch in the interior is obtained by:

and (3): utilizing the receiver clock error binomial model parameters obtained in the step (2)To fit the observation windowInner receiver clock error model:

wherein。

And (4): using the product obtained in step (1)Receiver clock error solution value of each time in time periodSubtracting the model fitting value obtained in the step (3)So as to obtain the receiver clock error fitting error of each time in the current observation windowThen calculating the fitting error sequence of the receiver clock error modelMean value ofAnd standard deviation of；

And (5): judging fitting errorWhether or not to fall onWithin the interval, ifThen the receiver is considered to be inThe time is not attacked by time synchronization, and the clock error at the time is calculatedIs a normal value ifIf yes, executing step (6);

and (6): utilizing the clock error attack amount estimated in the step (2)To the clock difference solutionAnd (5) correcting:

the corrected clock errorIn place of the receivermClock error calculation value of time. Moving the observation window backwardAnd (4) observing the epoch and returning to the step (2).

In another specific example, MATLAB simulation software of MathWorks company and a high-precision positioning type receiver board UB4B0 of Unicorecomm company are used for verifying the time synchronization attack detection and correction method. The time synchronization attack signal is obtained through simulation on the basis of the received real satellite signal, the attack signal cannot influence the position calculation result of the receiver, and only influences relevant parameters of a receiver clock. The relationship between the clock error obtained by the receiver receiving the real satellite signal and the clock error obtained by the receiver when the receiver receives the mutant time synchronization attack and the clock error obtained by the receiver after the receiver receives the mutant time synchronization attack is shown in figure 3 (a), the mutant time synchronization attack starts from the 60 th s, and the time attack amount isThe error between the receiver clock difference corrected by the method and the clock difference obtained by resolving the received real satellite signal is shown in fig. 3 (b), and the maximum error between the receiver clock difference and the clock difference is about. The relationship between the clock offset obtained by the receiver receiving the real satellite signal and the clock offset obtained by the receiver when suffering the continuous time synchronization attack and the clock offset obtained by the receiver after being corrected by the method is shown in fig. 4 (a), the continuous time attack starts from the 60 th s, and the time attack amount is aboutThe error between the receiver clock difference corrected by the method and the clock difference obtained by resolving the received real satellite signal is shown in fig. 4 (b), and the maximum error between the receiver clock difference and the clock difference is. By passingThe embodiment shows that the algorithm provided by the invention has better time synchronization attack detection and correction effects.

In one embodiment, as shown in fig. 5, there is provided an optimal estimation-based time synchronization attack detection and modification apparatus, including: an observation clock difference sequence obtaining module 502, an optimization model solving module 504, a prediction clock difference sequence obtaining module 506 and a clock difference correction module 508, wherein:

an observation clock difference sequence obtaining module 502, configured to obtain an observation clock difference sequence of the satellite time service receiver in an observation window;

an optimization model solving module 504, configured to construct an optimization model according to a coefficient matrix of an observation clock difference sequence and a binomial model used for describing clock differences, with parameters of the clock difference binomial model and a clock difference attack amount as optimization variables, and with a minimum difference between the observation clock difference sequence and a real clock difference sequence when subjected to time attack as an optimization target, and solve the optimization model under a constraint condition to obtain an estimated value of the parameters of the clock difference binomial model and an estimated value of the clock difference attack amount; the clock error binomial model parameters comprise clock drift, frequency drift and clock error;

a predicted clock difference sequence obtaining module 506, configured to fit a clock difference model in the observation window according to the estimated value of the clock difference binomial model parameter, and determine a predicted clock difference sequence in the observation window according to the clock difference model;

and the clock offset correction module 508 is configured to obtain a receiver clock offset model fitting residual according to the observed clock offset sequence and the predicted clock offset sequence, judge whether the receiver is attacked by time synchronization according to the receiver clock offset model fitting residual, and correct a current clock offset calculation value of the receiver according to an estimated value of a clock offset attack amount if the receiver is attacked.

The optimization model solving module 504 is further configured to construct an optimization model, according to the observed clock difference sequence and the coefficient matrix of the binomial model used for describing the clock difference, with the clock difference binomial model parameters and the clock difference attack amount as optimization variables, and with the minimum difference between the observed clock difference sequence and the real clock difference sequence when subjected to time attack as an optimization objective:

wherein the content of the first and second substances,；a sequence of observed clock differences is represented,which is indicative of the current observation time instant,which represents the length of the observation window,represents the observed clock error;an estimated value representing the clock error attack amount;a true value representing the amount of clock error attack;representing estimated values of clock-error binomial model parameters, whereinRespectively representing estimated values of clock drift, frequency drift and clock offset of the receiver;representing the true values of the parameters of the clock-difference binomial model;representing a coefficient matrix;a true value representing the receiver clock drift;

solving the optimized model under the constraint condition to obtain an estimated value of clock error binomial model parameters and an estimated value of clock error attack quantity; the constraint condition is。

The predicted clock difference sequence obtaining module 506 is further configured to fit a clock difference model in the observation window according to the estimated values of the clock difference binomial model parameters, and determine that the predicted clock difference sequence in the observation window is:

wherein the content of the first and second substances,，nindicating a time sequence number within the observation window;representing the predicted clock error obtained from the clock error model.

The clock error correction module 508 is further configured to obtain a fitting error sequence at each time in the observation window according to a difference between the observed clock error sequence and the predicted clock error sequence，；

From the fitting error sequence，，Representing the step length of the sliding window to obtain the mean value of the fitting errorAnd standard deviation of；

Judgment ofFitting error of time of dayWhether or not to fall onWithin the interval, ifThen the receiver is considered to be inThe time is not attacked by time synchronization ifThen the receiver is considered to be inThe time of day is subject to a time synchronization attack. If the receiver is attacked, correcting the current clock error calculation value of the receiver according to the estimated value of the clock error attack quantity, and obtaining the corrected clock error calculation value as follows:

wherein the content of the first and second substances,is shown inmAn estimate of the amount of clock-error attack at a time.

The clock error correction module 508 is also used for moving the observation window backwardAnd (5) continuously carrying out time synchronization attack detection and correction on each observation epoch.

The observation clock difference sequence obtaining module 502 is further configured to obtain an observation clock difference sequence in the observation window by resolving according to a satellite navigation signal received by a receiving antenna of the satellite time service receiver.

For specific limitations of the time synchronization attack detection and correction device based on the optimal estimation, see the above limitations on the time synchronization attack detection and correction method based on the optimal estimation, which are not described herein again. The modules in the above-mentioned time synchronization attack detection and correction device based on optimal estimation can be wholly or partially realized by software, hardware and their combination. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in fig. 6. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a time synchronization attack detection and modification method based on an optimal estimate. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.

Those skilled in the art will appreciate that the architecture shown in fig. 6 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In an embodiment, a computer device is provided, comprising a memory storing a computer program and a processor implementing the steps of the above method embodiments when executing the computer program.

In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which computer program, when being executed by a processor, carries out the steps of the above-mentioned method embodiments.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.