Exploring and Exploiting Synchrony Limitations of Time-Triggered Network-Agnostic Guardians

Exploring and Exploiting Synchrony Limitations of Time-Triggered Network-Agnostic Guardians Shreya Vithal Kulhalli, Mohammad Ibrahim Alkoudsi, Gerhard Fohler

arXiv:2606.27819v1 [cs.CR] 26 Jun 2026

RPTU Kaiserslautern-Landau Kaiserslautern, Germany {kulhalli,alkoudsi,[email protected]} Abstract—Time-triggered communication protocols rely on trusted components known as guardians to enforce adherence to predetermined network schedules. Networkagnostic guardians offer an efficient and scalable distributed solution with reduced implementation cost and complexity compared to network-aware alternatives. However, this efficiency is based on the guardian’s dependence on the controlled node for clock synchronization, which introduces a vulnerability: a malicious node can exploit this dependency to launch timing attacks against its guardian and eventually interfere with messages from other nodes on the network. In this paper, we establish a theoretical lower bound on the attainable clock synchronization precision between a node and its network-agnostic guardian. Building on this result, we introduce a timing attack that leverages the unavoidably imperfect clock synchrony to cause controlled and undetected de-synchronization of the guardian. The attack enables a malicious node to cause collisions with targeted critical network messages. We evaluate the effectiveness of the attack using a FlexRay field bus network model implemented in the OMNeT++ simulation framework. Our results show that the attack is able to remain undetected with 100% success and disrupts the transmission of the critical messages of the target node by causing collisions with them with 100% success. Index Terms—distributed real-time systems, dependability, security, timing attacks.

I. I NTRODUCTION AND R ELATED W ORK Time-triggered communication protocols (e.g., TTP [33], FlexRay [24], TTEthernet [34]) are designed to efficiently deliver the determinism and fault tolerance required by safety-critical systems [13]. These protocols provide timely network access by establishing a global time base through bounded-precision clock synchronization among nodes and by organizing network accesses according to a Time-Division Multiple Access (TDMA) strategy. In this scheme, each node is assigned exclusive slots on the channel and uses the full medium bandwidth during its slots. System designers compute the TDMA schedule offline and introduce gaps between consecutive slots to account for the unavoidably imperfect clock synchronization among

nodes, preventing inter-node transmission overlap (i.e., collisions). Fault isolation, and thus the preservation of determinism, is strengthened by bus guardians – trusted hardware components connected to each node that enforce adherence to the specified communication schedule [4], [30]–[32]. To contain faulty behavior, such as nodes attempting to transmit outside their TDMA slot boundaries, guardians typically require knowledge of the global time and the TDMA schedule. Achieving fault independence further demands that guardians resynchronize their local clocks to global time on their own. Consequently, contemporary network-aware guardians incorporate protocol- and topology-specific mechanisms, which increases both cost and complexity. In contrast, network-agnostic guardians avoid protocol-specific logic. Originally proposed under constrained fault assumptions [32], these guardians rely on their controlled node for clock synchronization to infer schedule alignment, significantly cutting complexity and cost. However, modern systems increasingly operate in harsher environments over extended mission durations, facing higher fault rates and targeted cyber-physical attacks [8], [11], [12], [17], [18], [26]–[28], [37]. Our paper assumes the presence of adversaries capable of inferring timing information about the target system. This assumption is well supported by significant prior research that demonstrates the plausibility of this threat. Pellizzoni et al. [23], Chen et al. [7], and Liu et al. [19] investigate threats emerging from covert side channels that adversaries can exploit to extract crucial timing information through timing-inference attacks. This assumption has also been adopted in methods targeting task scheduling rather than communication. Yoon et al. [36] introduce a schedule-obfuscation method that randomizes schedules while maintaining timing guarantees. Chen et al. [6] propose a protocol for obscuring predictable timing behavior in real-time systems using dynamic-priority scheduling. Krüger et al. [16] pursue

©2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

a similar motivation and investigate online and offline approaches for schedule randomization in time-triggered systems to mitigate timing-inference attacks. Recent research has revealed that attacks compromising the synchronization protocol pose a critical threat to determinism and fault isolation. For instance, PCSPOOF [20] demonstrated the first successful breach of isolation in Time-Triggered Ethernet (TTE), causing synchronization loss and dropping critical messages. This threat landscape reveals a critical vulnerability in network-agnostic guardians: their reliance on nodeprovided timing makes them susceptible to manipulation by a compromised node. In [2], Alkoudsi et al. demonstrated that under malicious threats, the dependency on the controlled node for synchronization enables time-domain attacks such as omission of relayed synchronization messages, replaying messages, and causing asymmetric reception that hinders fault attribution. They further proved that these attacks persist even with authenticated messaging. In this paper, we design an advanced replay attack that enables the malicious node to target and disrupt the transmission of a specific message in the schedule. The attack is based on the same principle as the replay attack in [2], where the compromised node gradually introduces arbitrarily small delays into the synchronization signal sent to its guardian, subtly altering its local perception of global time. In order to increase the effectiveness of the attack (as fast and stealthy as possible), we first derive a theoretical lower bound on the attainable precision of external clock synchronization between a node and its network-agnostic guardian, then compute the maximum covert per-resynchronization round injection delay that remains within this bound. By tracking global time progression and repeatedly applying such delay injections, the malicious node shifts the guardian’s view on global time until its slot aligns with the victim’s slot. During the victim’s slot, the malicious node transmits, causing a collision that invalidates the target critical message. We evaluate our attack in the OMNeT++ network simulation library [22], [35] with the FiCo4OMNeT FlexRay model [10] on an eight-node network, with each node extended with a network-agnostic guardian. The simulation results confirm the attack’s effectiveness in disrupting messages in the target slot with 100% success rate, underscoring the importance of coordination among network-agnostic guardians and enforcing node rejuvenation when malicious behavior cannot be precluded, as discussed in [2]. This work presents the following contributions: 1) Precision bound: we derive a lower bound on the attainable precision of external clock synchronization between a node and its network-agnostic guardian.

2) Target slot attack: we design a time-domain attack against network-agnostic guardians that causes collisions with a target critical message sent in a specific slot in the TDMA schedule. 3) Experimental evaluation: we validate the attack using fault injection in a simulated FlexRay network (using OMNeT++ and FiCo4OMNeT’s FlexRay model) augmented with network-agnostic guardians. The remainder of the paper is organized as follows. We state our system assumptions in Section II and subsequently cover some essential background on synchronizing clocks to establish a global notion of time in Section III. In Section IV, we derive a lower precision bound for external node–guardian synchronization, and exploit this bound, in Section V, to design our target slot attack. We present our experimental evaluation in Section VI. We propose countermeasures that can be adopted to mitigate the target slot attack in Section VII before drawing our conclusions in Section VIII. II. S YSTEM M ODEL We consider real-time distributed systems, as shown in Figure 1, which comprise N nodes that communicate by sending messages over a shared time-triggered network channels. Although we do not constrain our system to a specific time-triggered network protocol and topology, we assume that access to the network follows a TDMA strategy based on a predetermined schedule and a global notion of time. The schedule is organized into communication cycles, each consisting of a sequence of time slots, where a time slot is a fixed interval of global time that is uniquely identified by a (Slot ID) and is assigned exclusively to at most one node. We further assume that each communication cycle ends with a dedicated slot or segment for clock correction. During this segment, no communication occurs. Instead, all correct nodes adjust their perception of global time by proportionally stretching the duration of the clock correction segment, based on the estimated differences between their local clocks. We assume that clock drift remains bounded by a known value ρ, and denote local clock granularity by microtick (µT). We further assume that all nodes synchronize their local clocks, whether through internal synchronization mechanisms or by relying on an external time source, within a bounded precision πN N , for example, by using the fault-tolerant averaging algorithm [14]. This synchronization underpins the global time base between nodes, which ticks with coarser granularity than µT, termed macrotick (MT). As shown in Figure 1, each node incorporates a trusted, network-agnostic guardian component that determines when the node is permitted to transmit. It enforces

this by enabling or disabling the node’s send interface for a given communication channel through the transmission controller (TC). The guardian maintains its own notion of global time through an internal local clock, which it synchronizes with global time based on a periodic external clock synchronization (CS) signal emitted by the controlled node through a dedicated physical wire. The CS signal indicates the start of a communication cycle from the node’s perspective. We assume that guardians perform a rudimentary acceptance window check on the CS signal, considering it valid only if it arrives within a time window centered at the expected arrival time of this signal from the guardian’s perspective. The acceptance window has a minimum duration of 2πN G , accounting for potential clock drift in both directions. Here, πN G represents the synchronization precision between the node and its guardian. When accepted, the guardian aligns its clock with that of the node.

1) Precision Enhancement πconv : The parameter, precision of CF, quantifies how closely the clocks of correct nodes are synchronized after applying the CF. The CF achieves this by imposing an upper bound on the clock difference δ between any pair of correct nodes, such that δ ≤ πN N , where πN N denotes the precision of internal clock synchronization. In order for the CF to successfully converge the clocks, the inequality, πconv < δ has to be satisfied. 2) Accuracy Preservation α(δ): The parameter, accuracy of CF, defines the maximum permissible adjustment that a node may apply to its clock during a resynchronization cycle. The adjustment is constrained by the inequality α(δ) ≤ δ, ensuring that clock corrections remain within the bounds of the observed clock differences. In TT communication protocols, each node typically adjusts its perception of global time by recalibrating the macrotick duration gM T , based on the value produced by the convergence function. gM T is defined as an integer multiple of the node’s local clock granularity µT . The adjusted macrotick duration remains in effect until the subsequent resynchronization cycle. IV. P RECISION OF N ODE -G UARDIAN C LOCK S YNCHRONIZATION

Fig. 1: System Model We adopt the same failure model as in [2], in which nodes may exhibit arbitrary failures, whereas guardians and TCs are limited to crash failures. When a guardian crashes, it permanently disables its node’s ability to transmit on the network, thereby enforcing fail-silence. This behavior follows from the guardian’s role as a trusted component and from the inherent simplicity of network-agnostic guardian designs. III. BACKGROUND A. Clock Synchronization and Global Time Time-triggered communication follows a TDMA schedule, defined using the granularity of the shared global time base. In order to correctly follow the schedule, all nodes must have a consistent notion about global time progression. This includes agreement on the duration of the M T , denoted as gM T [15], [21]. Internally synchronizing the local clocks of nodes to maintain consistent view of global time progression typically involves exchanging clock values, computing pairwise clock differences, and applying a convergence function (CF) to bring clocks together. The CF is characterized by the following properties [25]:

Now, we turn to deriving a safe lower bound for the synchronization precision between a node and its network-agnostic guardian, under the assumptions stated in Section II. There are two primary sources that contribute to the clock deviation between a node and its network-agnostic guardian: 1) Clock drift: Refers to the gradual divergence between the node’s and guardian’s clocks due to the differences in oscillator frequencies. Let cd represent the clock deviation between the guardian and its node due to clock drift within a single resynchronization cycle. Since drift may occur in both directions, the maximum value of cd is 2ρRint , where ρ denotes the upper bound on the clock drift rate, and Rint is the duration of the resynchronization cycle. This scenario occurs when the node experiences the maximum negative drift rate and the guardian the maximum positive drift rate. Conversely, the minimum value of cd is −2ρRint , representing the scenario in which the node has the maximum positive drift rate and the guardian the maximum negative drift rate. 2) Node clock correction: The internal clock synchronization of the node’s clock to global time affects the difference between its clock and that of the guardian’s. Let cn denote the CF value applied

by the node during a resynchronization cycle. The value of cn lies within the range [−α(δ), +α(δ)], where α(δ) ≤ δ ≤ πN N (See Sec.III-A). cn reaches the boundary values in scenarios where the node experiences the maximum possible clock drift in the opposite direction relative to all other correct node clocks, and consequently, relative to global time. Lemma 1. For any resynchronization cycle, the correction value cg applied to the guardian’s clock upon accepting a CS signal by its node is determined by: cg = cn − cd (1) where cn is the correction value applied to the node’s clock during internal synchronization and cd is the deviation due to clock drift accumulated between the node and the guardian within a resynchronization cycle. Proof. Let tN cs denote the start-of-cycle time according to the node’s clock before applying the CF. After applying the correction value cn , the updated start-of-cycle time N becomes tN cs′ = tcs + cn . G Let tcs denote the start-of-cycle time according to the guardian’s clock, then we can write: N tG cs = tcs + cd The correction value cg is computed as the difference between the corrected time received from the node and the expected start-of-cycle time at the guardian: G N N cg = tN cs′ − tcs = (tcs + cn ) − (tcs + cd ) = cn − cd

From Lemma 1, a safe clock precision for the externally synchronized network-agnostic guardians must be equal to or greater than the maximum possible value of cg . Theorem 1 demonstrates that cg is bounded from above by the precision achieved through the internal clock synchronization between nodes πN N . Theorem 1. For any resynchronization cycle, the correction value cg applied to the guardian’s clock upon accepting a CS signal by its node is bounded by: |cg | ≤ πN N

(2)

Proof. Considering Equation 1, the maximum value of cg occurs when cn reaches its maximum positive value and cd reaches its maximum negative value. The maximum cn occurs when the node’s clock has the maximum negative drift rate relative to all other nodes (representing global time), which simultaneously exhibit the maximum positive drift rate. In addition, messages between nodes are subjected to the worst-case jitter and faults. Since α(δ) ≤ δ ≤ πN N , in the worstcase we have cn = πN N . In contrast, the minimum

cd occurs when the node’s clock exhibit the maximum positive drift rate relative to the guardian’s clock, while the guardian’s clock simultaneously experiences the maximum negative drift rate, yielding: cd = 2ρRint Since the node’s clock cannot possibly have the maximum positive and negative drift rates simultaneously, i.e., these scenarios are mutually exclusive, we have |cg | < 2ρRint + πN N . In Table I, we present the extreme cases of clock drift, illustrating opposing deviations among the node, the guardian, and the global time (collectively representing all other nodes in the system). For each case, the corresponding values of cd , cn , and cg are derived. In Case C, where the node and global time exhibit drift in the same direction, the value of cn is determined solely by additional sources of uncertainty in the network such as communication jitter and faults, whose effects are bounded by the interval |πN N − 2ρRint | based on the design assumptions of internal clock synchronization. Since all the extreme drift cases, shown in Table I, satisfy −πN N ≤ cg ≤ πN N , Equation 2 holds. Cases Clock Clock Drift cd cn cg Node ∓ρ ∓ρ A Guardian 0 ±πN N ±πN N Global time ±ρ Node ∓ρ ±ρ B Guardian ±2ρ · Rint ±πN N ±πN N ∓ 2ρ · Rint Global time ±ρ Node ±ρ ∓ρ C Guardian ∓2ρ · Rint ±πN N ∓ 2ρ · Rint ±πN N Global time ±ρ

TABLE I: Extreme cases of clock drift among the node, the guardian, and the global time, and corresponding values for cd , cn and cg . Corollary 1. The synchronization precision between a node and its network-agnostic guardian satisfies: πN G ≥ πN N (3) The proof follows directly from Theorem 1, as the maximum guardian clock correction value establishes this precision bound. Consequently, the inter-slot gaps in the TDMA schedule must be determined with respect to πN G rather than πN N . Note that πN G = πN N represents the best-case scenario for network-agnostic guardians. Depending on the physical deployment, however, additional factors such as CS signal propagation delay and processing jitter can result in πN G > πN N . This has direct implications for feasibility of the target slot attack: Any timing attack must operate within the πN G bound to avoid detection. V. TARGET S LOT ATTACK A. Attacker Model We consider an intelligent and malicious adversary capable of assuming complete control over a node, including sending messages over the network and performing

clock synchronization. The adversary correspondingly has access to the same information as the node itself, including critical timing parameters associated with clock synchronization (precision, maximum drift rate, resynchronization cycle) and the communication schedule. Hence, the adversary knows which slots are designated for the transmission of critical messages. These assumptions are supported by analyses of adversaries capable of inferring crucial timing information through timing inference attacks [7], [16], [19], as discussed in Section I. The primary objective of the adversary is to disrupt the transmission of a critical message in the schedule. This objective can only be achieved by manipulating the global time perception of the guardian of the compromised node such that its assigned TDMA slot coincides with that of the critical message. Achieving this objective requires the adversary to only evade detection by the guardian. B. Attack Procedure The procedural flow of the target slot attack is presented in Figure 2. In accordance with [2], the compromised node initiates the attack by creating a virtual clock that is initialized with the value of the compromised node’s clock and remains unsynchronized with the global time. The virtual clock is employed by the node to monitor the progression of the attack. Afterwards, the node halts message transmission on the network, thereby leading other nodes in the cluster to infer its fail-silence. Note that this step is optional, as the objective is only to cause a collision with a specific message. Subsequently, the node enters a repetitive cycle in which, it computes and applies the maximum delay that can be covertly introduced with the CS signal Tinj during each resynchronization cycle (described in detail in Sec. V-C), followed by checking node’s slot overlap with the target slot with reasonable accuracy (considering precision πN N ). Once slot overlap is achieved, the node transmits a message on the network that collides with and invalidates the targeted critical message.

Fig. 2: The procedural flow of the target slot attack. accumulate a clock deviation of 2ρRint . At the end of cycle i, node A injects a delay of TIN J together with the CS signal to guardian A. In order to pass the guardian’s acceptance window check, TIN J must satisfy the inequality: 2ρRint + TIN J ≤ πN G . Reordering the terms, we obtain: TIN J = πN G − 2ρRint

(4)

Since πN G > 2ρRint the node is always able to covertly inject delays along with the CS signal. Note that injecting larger values than in Eq. 4 may also go undetected depending on the clock deviation between the node and its guardian. However, since the actual clock drift values are uncertain, Eq. 4 represents an upper bound on the delay that can be covertly introduced during each resynchronization cycle regardless of the clock deviation between the node and its guardian.

C. Maximum Covertly Injected Delay The maximum delay that the node may inject when delivering the CS signal to its guardian without being detected by its acceptance window check is limited by the maximum clock deviation between their clocks within a resynchronization cycle, that is 2ρRint , and the clock synchronization precision between the node and its guardian πN G . Consider the example in Figure 3, which illustrates one communication cycle (cycle i) of duration Rint . In this cycle, node A and its network-agnostic guardian A experience the maximum clock drift rates −ρ and +ρ, respectively. As a result, the node and the guardian

Fig. 3: Illustration of the maximum delay TIN J that can be covertly introduced during each resynchronization cycle, independent of the actual clock deviation between the node and the guardian.

D. Required Clock Deviation for Slot Overlap The clock deviation required (at the time of initiation of the attack) for an attacker’s slot to overlap with that of a victim node is influenced by the relative positioning of these two slots within the communication cycle and the direction of the injected delay. For a given direction of injected delay, the necessary clock deviation is determined by evaluating the portion of the communication cycle that must be traversed. For instance, given a TDMA schedule comprising 10 slots, if the attacker occupies Slot 5 and the victim occupies Slot 4, a positive injected delay necessitates traversing nine slots plus the correction segment, whereas a negative delay requires traversing only one slot. Consequently, the attacker selects the delay direction that minimizes the required clock deviation, thereby accelerating the attack’s execution. The required clock deviation for slot overlap in macroticks (MT) is given by: Nslot lslot + Ncorr lcorr ± 1 where, Nslot denotes the number of slots to be traversed, lslot represents the slot size in MT. Ncorr denotes the correction segment count (set to 1 if a correction segment must be traversed and 0 otherwise). lcorr represents the size of the correction segment in MT. The additional one accounts for inherent imperfections in clock synchronization, with a positive sign for positive injected delays and a negative sign for negative delays. It is important to note that, before runtime, the attacker cannot precisely predict when slot overlap with the victim node will occur, since it cannot forecast future clock differences. Consequently, in each resynchronization cycle, the attacker must rely on the current clock deviation relative to the victim node as an indicator, and iteratively compare it to the required clock deviation until slot overlap is successfully achieved. Since we already account for imperfect synchronization in the required clock deviation, identification of slot overlap is accurate within ±πN N . Therefore, once slot overlap is identified, it is certain that the message sent by the attacker during its slot will collide with the victim node’s message. VI. E XPERIMENTAL E VALUATION In this section, we evaluate the effectiveness of the target slot attack through simulation-based experiments. The experimental configuration employs the OMNeT++ simulation library [3], augmented with the FiCo4OMNeT [5], [10] extension, to instantiate a FlexRay network comprising eight nodes (FRNode)s that communicate in accordance with the TDMA schedule presented in Table II via the FlexRay bus (FRBus). One execution of the TDMA schedule represents a communication cycle that ends with the clock correction

segment, also known in the FlexRay protocol as the network idle time (NIT) segment. We extend each FRNode with a custom guardian submodule that follows the structure and assumptions specified in Section II. Additionally, we implement a module, FRAttackerNode, to represent a compromised node that performs the target slot attack. In the instantiated network, unitE represents the compromised node, which is allocated the 5th slot in the communication cycle. Slot ID 1 2 3 4 5 6 7 8 Node unit1 unit2 unit8 unit5 unitE unit7 unit6 unit3 NIT

TABLE II: TDMA schedule for the instantiated FlexRay network. The network parameters in OMNeT++ are configured using their default values and units1 , except in cases where Table III provides a different choice. For completeness, the table also includes default parameters that, while unchanged, are relevant to the discussion in this section. Network parameter Value pdMicrotick 12.5 ns gdMacrotick 1 µs gdStaticSlot 4 MT gdNIT 2 MT numberOfNodesChannelA 8

Reasoning FiCo4OMNeT default FiCo4OMNeT default FiCo4OMNeT default FiCo4OMNeT default Number of nodes, N ≥ 3F + 1, numberOfNodesChannelB 8 F = 1 faulty node →N ≥4 gNumberOfStaticSlots 8 to provide each node in the communication cycle with a designated slot gCycleCountMax 7 smallest value configurable in FiCo4OMNeT for a concise TDMA schedule pOffsetCorrectionOut2 80 µT the maximum offset correction is limited by the maximum clock deviation between the internally synchronized node clocks, πN N maxDrift 18.75 ps maximum clock deviation due to drift between two non-synchronized clocks in a single microtick. maxDriftChange 1 ps based on example network syncnodes from FiCo4OMNeT gdActionPointOffset 2 MT to ensure transmission window alignment [4], for πN N = 1 M T . channel.delay2 127.94 ns sets maximum propagation delay for deriving the parameter aAssumedPrecision

TABLE III: Network configuration parameters for the simulated network model. The parameter maxDrift is defined by the FiCo4OMNeT simulation model to simulate the clock 1 The units are abbreviated as follows: µs – microseconds, ns – nanoseconds, ps – picoseconds, M T – macroticks, µT – microticks.

drift phenomenon. We arrive at the configured value using pdMicrotick and the maximum clock frequency deviation considered for FlexRay, cClockDeviationMax (0.0015 s/s) [9]. The parameter, pdmaxDrift (not to be confused with maxDrift), refers to the maximum clock deviation between two nodes with non-synchronized clocks for one communication cycle, due to clock drift alone. It is also referred to as Drift Offset (Γ) [15]. Table IV lists key network parameters derived from the configured network parameters, connecting the network simulation to the theoretical understanding of a time-triggered network. To set πN N in FlexRay, the parameter aAssumedPrecision must be configured. This parameter, given in Table IV, can be derived using the largest microtick and the total propagation delay, adPropagationDelayMax (See equations 11 and 13 in the FlexRay’s protocol specifications [9]). adPropagationDelayMax is indirectly configured using the parameter channel.delay2 . We assume aAssumedP recision = 1 M T 2 as the default and maximum value, to meet the reasonableness condition of the global time base [15]. We assume πN G = πN N , which represents the bestcase scenario for network-agnostic guardians, as shown in the proof in Section IV. Network parameter gClockDeviationMax(ρ) aMicroPerMacroNom (M T /uT ) pMicroPerCycle(Rint )

Basis cClockDeviationMax gdMacrotick pdMicrotick

(gdNIT + gdStaticSlot × gNumberOfStaticSlots) × aMicroPerMacroNom gClockDeviationMax pdmaxDrift/ Drift Offset ceil(2× (1-gClockDeviationMax)) (Γ = ⌈2ρRint ⌉) × gMacroperCycle) adPropagationDelayMax2 2 × channel.delay aAssumedPrecision See Section VI (πN N )

Value 0.0015 s/s 80 µT 2720 µT

9 µT 255.88 ns 1 MT

TABLE IV: Derived network parameters (using Table III) for the simulated network model. Each experiment comprises multiple simulation configurations, with each simulation running for 147 communication cycles (sim-time-limit [22]) and repeated 500 times. The configuration parameters are specified using their default units or as a fraction of πN N . In Section VI-A, we examine how the clock synchronization precision between the attacker node and its guardian, πN G , influences the covertness of the target slot attack. In Section VI-B, we evaluate the attack procedure from Section V-B for every possible victim node for our network model. The relative slot position of the victim node with respect to the attacker’s slot determines the clock deviation required for slot overlap. 2 This value is recalculated for every configuration in experiment VI-A

Taking this into account, and assuming a fixed πN G along with a random clock drift drawn from the interval [0, ρ] at the beginning of each communication cycle, we evaluate whether the attacker node can successfully achieve slot overlap with the victim node. A. Maximum Covertly Injected Delay The purpose of the first experiment is two-fold: 1) to validate, through simulation, the theoretical expression in Equation 4, which represents the maximum delay that can be injected covertly with the CS signal from the node to its guardian, 2) to show that, attacks using injected delay greater than maximum covert injected delay can remain undetected with varying success, depending on the choice of the precision for node-guardian clock synchronization. We evaluate three simulation configurations by setting three values of πN N , and correspondingly πN G , and then varying TIN J in the range [0, πN G + ρRint ] for each value of πN G . The upper limit of the range of injected delay accounts for either the node or guardian local clock drifting maximally, while reflecting the low probability of both clocks drifting maximally in opposite directions. According to the constraints for aAssumedPrecision [9], if the timing inaccuracies of the physical layer are considered negligible (adP ropagationDelayM ax = 0), aAssumedP recision ≈ 0.5 M T . Consequently, we assume aAssumedP recision ≥ 0.5M T for the configurations, though the specific values selected are representative. The precision of internal clock synchronization, πN N depends on [15], • the maximum divergence of any two clocks, or drift offset Γ, • the convergence function, ϕ which, in turn, depends on Byzantine error and the latency jitter of synchronization messages due to physical layer timing inaccuracies, such as propagation delay. The maximum covert injected delay, as discussed in Section V-C, is calculated using the precision of nodeguardian clock synchronization, πN G and the drift offset, Γ. However, since Γ influences the choice of πN G , we set the test configurations directly for different values of πN G . We set the values of πN N , and correspondingly πN G , by varying the maximum propagation delay using the channel.delay parameter. The required configuration values are given in Table V. We adapt the value of pOffsetCorrectionOut for each configuration accordingly. For each configuration, we report the percentage of undetected attacks, which we define as the ratio of simulation repetitions in which the attack remains undetected to the total number of repetitions (500).

channel.delay (ns) 127.94 65.44 2.94

TABLE V: Network parameters for Experiment VI-A configurations.

Figure 4 depicts the results for the first configuration, with precision πN G = 1 macrotick (MT). Similarly, the figures 5 and 6, depict the results for πN G = 0.75 MT and πN G = 0.5 MT, respectively. The maximum covert injected delay calculated for each value of πN G has been indicated for reference. The results indicate that as long as TIN J complies with Eq. 4, unitE remains undetected. Further, an attacker may inject a delay larger than the maximum covert value and still remain undetected. For clock deviation between the node and the guardian smaller than Γ, TIN J values exceeding the theoretical maximum can still result in a CS signal that passes the acceptance window check, since Eq. 4, being pessimistic, assumes the maximum possible clock drift between the node and the guardian. The percentage of undetected attacks, for a particular value of injected delay greater than the maximum, depends on πN G . The plots in Figures 4 through 6, evidently, do not depict strictly decreasing functions. Though this behavior is only observed for the plots in Figures 4 and 6, for each value of πN G , there is a small interval of TIN J in the approximate range of [0.97, 1.02] × πN G for our experiment where the percentage of undetected attacks may increase. The reason lies in the clock deviation calculation at the guardian during clock synchronization. To simulate a real-time clock, we convert the OMNeT++ simulation time to guardian local clock microticks using a ceiling operation, introducing a possible error of ±1 microtick. Considering the randomness of simulated clock drift and the ceiling operation error, the node and guardian clock deviation can reach or exceed πN G , for TIN J in the range [0.97, 1.02] × πN G . This can result in a short spike in the percentage of undetected attacks during the interval. B. Required Clock Deviation for Slot Overlap The purpose of the second experiment is to demonstrate successful target slot attacks that remain undetected and invalidate specific target frames through collision with messages from the attacker. We test seven simulation configurations, and in each configuration unitE targets a specific slot in the schedule. During each simulation, with a specific victim node, unitE (Slot 5) statically calculates the required clock deviation for slot overlap with the target slot and performs acceptance window attacks against its guardian using the maximum covert injected delay. Considering the

Percentage of undetected attacks(%)

aAssumedPrecision/πN G 1 M T / 80 µT 0.75 M T / 60 µT 0.5 M T / 40 µT

100

50

πN G = 1 M T

0 0

25

50 75 89 100 Tinj /πN G (%)

Fig. 4: For πN G = 1 M T , percentage of undetected attacks for increasing values of injected delay. Percentage of undetected attacks(%)

Config. no. 1 2 3

100

50

πN G = 0.75 M T

0 0

25

50 75 85 100 Tinj /πN G (%)

Fig. 5: For πN G = 0.75 M T , percentage of undetected attacks for increasing values of injected delay. values for πN N (aAssumedPrecision) and Drift Offset (Γ), the maximum covert injected delay is 0.89 × πN G . In each communication cycle, unitE calculates the clock deviation from the victim node using the received message and compares it to the required clock deviation for slot overlap. If overlap is identified, unitE transmits its message during the scheduled slot to invalidate the critical message sent during the target slot. We consider the attack successful when it disrupts the critical message transmitted during the target slot. Table VI summarizes the results, showing the percentage of successful attacks, calculated as the ratio of repetitions with successful disruption of the critical message to the total number of repetitions (500) for each selected victim node. The results indicate that, for each target slot (7 configurations) during every repetition (500), unitE identifies

Percentage of undetected attacks(%)

100

50

πN G = 0.5 M T

0 0

25

50 78 Tinj /πN G (%)

100

Fig. 6: For πN G = 0.5 M T , percentage of undetected attacks for increasing values of injected delay. Config. no. 1 2 3 4 5 6 7

Target slot 1 2 3 4 6 7 8

Required clock deviation (MT) 15 11 7 3 5 9 13

successful attacks (%) 100% 100% 100% 100% 100% 100% 100%

TABLE VI: Results for the required clock deviation and percentage of successful target slot attacks. slot overlap accurately despite random clock drift and its message causes a collision with the target frame. The second experiment supports the applicability of the attack parameters maximum injected delay, the required clock deviation for slot overlap (at the time of initiation of the attack), and the attack procedure successfully employing both in mounting target slot attacks. When the parameters are appropriately chosen, the attack remains undetected by the guardian, continuously injects covert delay and monitors the relative clock deviation with respect to the target until a slot overlap is identified, which makes the collision with the target critical frame certain, as explained in Section V. VII. C OUNTERMEASURES The chosen clock-synchronization precision between a node and its network-agnostic guardian does not prevent targeted-slot attacks, as demonstrated by the theoretical result in Section IV. We complement this analytic finding with the simulation study in Section VI-A, which evaluates the attack’s covertness as a function of the injecteddelay parameter TIN J for a fixed πN N . Alkoudsi et al. [1], [2] investigated the coordination of proactive and reactive node rejuvenation as a mechanism to maintain synchrony among network-agnostic guardians in the presence of malicious nodes. Assuming

a secure start-up service, guardian-enforced rejuvenation establishes an initial interval of correctness post node rejuvenation. During this interval, nodes are deemed trustworthy, enabling guardians to safely synchronize their clock offsets. Consequently, periodic proactive node rejuvenation systematically eliminates the presence and effects of an attacker. Simultaneously, the exchange of authenticated messages and the utilization of a membership protocol allow guardians to detect and reactively rejuvenate compromised nodes, albeit at the cost of increased communication bandwidth. In the specific context of the targeted slot attack, which relies on a cumulative injection effect to gradually desynchronize guardians, node rejuvenation serves a critical role: Proactive rejuvenation [1], [29] effectively constrains the attacker’s ability to align with a victim slot by upper-bounding the time available for an attacker to accumulate drift. Furthermore, having guardians exchange and cross-verify system-level data, such as TDMA positioning and membership information enables guardians to identify compromised nodes and enforce their reactive rejuvenation. We suspect that proactive rejuvenation alone may suffice for certain system configurations, depending on the structure of the communication schedule, the clock synchronization protocol, and the time required to compromise a node. Relying solely on proactive measures could facilitate the design of more efficient, yet still timedomain attack-resilient, network-agnostic guardians. VIII. C ONCLUSION Network-agnostic guardians are trusted components that enforce predetermined schedules and ensure temporal fault containment, while offering significant advantages over network-aware variants in terms of cost, complexity and scalability. However, a major caveat is their reliance on the controlled node for clock synchronization. In this paper, we advanced the understanding of timing attacks against network-agnostic guardians by presenting a target slot attack that invalidates a specific message in the time-triggered schedule. We established a lower bound on the precision of external clock synchronization between a node and its network-agnostic guardian, as well as identified the maximum delay that can be covertly injected alongside the node’s clock synchronization signal to its guardian. By systematically injecting such delays, the adversary can alter the guardian’s perception of global time until its designated slot aligns with the target slot, resulting in the malicious node’s message colliding with and invalidating the critical message sent during the target slot. Simulation results from an eight-node FlexRay network validate the attack’s effectiveness with 100% success and

demonstrate its significant impact on message delivery within time-triggered communication protocols that use network-agnostic guardians. The identified vulnerability of network-agnostic guardians to timing attacks underscores the importance of coordination among guardians. Since communication between guardians is costly, we will explore, in future work, the interplay between enforcing proactive node rejuvenation by network-agnostic guardians and the necessity for explicit communication among guardians. R EFERENCES [1] Mohammad Ibrahim Alkoudsi, Gerhard Fohler, and Marcus Völp. Tolerating Resource Exhaustion Attacks in the Time-Triggered Architecture. In 2022 XII Brazilian Symposium on Computing Systems Engineering (SBESC), pages 1–8, 2022. [2] Mohammad Ibrahim Alkoudsi, Gerhard Fohler, and Marcus Völp. A Network-Agnostic Approach to Enforcing CollisionFree Time-Triggered Communication. In 2023 IEEE 28th Pacific Rim International Symposium on Dependable Computing (PRDC), pages 71–77, 2023. [3] András Varga and OpenSim Ltd. OMNeT++ User Guide. OpenSim Ltd. [4] Günther Bauer, Hermann Kopetz, and Wilfried Steiner. The Central Guardian Approach to Enforce Fault Isolation in the Time-Triggered Architecture. In 6th International Symposium on Autonomous Decentralized Systems (ISADS 2003), 9-11 April 2003, Pisa, Italy, pages 37–44. IEEE Computer Society, 2003. [5] Stefan Buschmann, Till Steinbach, Franz Korf, and Thomas C. Schmidt. Simulation based timing analysis of FlexRay communication at system level. In Jan Himmelspach, Kurt Vanmechelen, and Wentong Cai, editors, 6th International ICST Conference on Simulation Tools and Techniques, SimuTools ’13, Cannes, France, March 6-8, 2013, pages 285–290. ICST/ACM, 2013. [6] Chien-Ying Chen, Monowar Hasan, AmirEmad Ghassami, Sibin Mohan, and Negar Kiyavash. REORDER: securing dynamicpriority real-time systems using schedule obfuscation. CoRR, abs/1806.01393, 2018. [7] Chien-Ying Chen, Sibin Mohan, Rodolfo Pellizzoni, Rakesh B. Bobba, and Negar Kiyavash. A novel side-channel in real-time schedulers. In Björn B. Brandenburg, editor, 25th IEEE RealTime and Embedded Technology and Applications Symposium, RTAS 2019, Montreal, QC, Canada, April 16-18, 2019, pages 90–102. IEEE, 2019. [8] Thomas M. Chen and Saeed Abu-Nimeh. Lessons from stuxnet. Computer, 44(4):91–93, 2011. [9] Flexray Consortium. FlexRay Communications System - Protocol Specification - Version 3.0.1, 2010. [10] CoRE-RG. FiCo4OMNeT: Fieldbus Communication for OMNeT++. https://github.com/CoRE-RG/FiCo4OMNeT/, 2013– 2025. Accessed: 2025-08-15. [11] David Goldstein. Mouse click could plunge city into darkness, experts say. CNN, 2018. Last accessed: 12-12-2022. [12] Andy Greenberg. Hackers remotely kill a jeep on the highway—with me in it. wired, 2015. Last accessed: 12-12-2022. [13] Hermann Kopetz and Günther Bauer. The time-triggered architecture. volume 91, pages 112–126. IEEE, 2003. [14] Hermann Kopetz and Wilhelm Ochsenreiter. Clock Synchronization in Distributed Real-Time Systems. IEEE Trans. Computers, 36(8):933–940, 1987. [15] Hermann Kopetz and Wilfried Steiner. Real-Time Systems Design Principles for Distributed Embedded Applications, Third Edition. Springer, 2022. [16] Kristin Krüger, Marcus Völp, and Gerhard Fohler. Vulnerability analysis and mitigation of directed timing inference based attacks on time-triggered systems. In Sebastian Altmeyer, editor, 30th Euromicro Conference on Real-Time Systems, ECRTS 2018, Barcelona, Spain, July 3-6, 2018, volume 106 of LIPIcs, pages

22:1–22:17. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2018. [17] Robert M Lee, Michael J Assante, and Tim Conway. German steel mill cyber attack. Industrial Control Systems, 30(62):1–15, 2014. [18] Robert M. Lee, Michael J. Assante, and Tim Conway. Analysis of the cyber attack on the ukrainian power grid, March 2016. [19] Songran Liu and Wang Yi. Task parameters analysis in schedulebased timing side-channel attack. IEEE Access, 8:157103– 157115, 2020. [20] Andrew Loveless, Linh Thi Xuan Phan, Ronald Dreslinski, and Baris Kasikci. PCSPOOF: Compromising the safety of timetriggered ethernet. In Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP), pages 2324–2341, May 2023. [21] Roman Obermaisser. Time-Triggered Communication. CRC Press, Inc., USA, 1st edition, 2011. [22] OpenSim Ltd. OMNeT++ Simulation Manual. OpenSim Ltd. [23] Rodolfo Pellizzoni, Neda Paryab, Man-Ki Yoon, Stanley Bak, Sibin Mohan, and Rakesh Bobba. A generalized model for preventing information leakage in hard real-time systems. In 21st IEEE Real-Time and Embedded Technology and Applications Symposium, Seattle, WA, USA, April 13-16, 2015, pages 271– 282. IEEE Computer Society, 2015. [24] M. Rausch. FlexRay: Grundlagen, Funktionsweise, Anwendung. Hanser eLibrary. Hanser, 2008. [25] Fred B. Schneider. Understanding Protocols for Byzantine Clock Synchronization. Technical report, Cornell University, USA, 1987. [26] Sarah Scoles. The feds want these teams to hack a satellite—from home. wired, 2020. Last accessed: 12-12-2022. [27] D.P. Shepard, Jahshan Bhatti, and Todd Humphreys. Drone hack: Spoofing attack demonstration on a civilian unmanned aerial vehicle. GPS World, 23:30–33, 08 2012. [28] Jill Slay and Michael Miller. Lessons learned from the maroochy water breach. In Eric Goetz and Sujeet Shenoi, editors, Critical Infrastructure Protection, pages 73–82, Boston, MA, 2008. Springer US. [29] Paulo Sousa, Nuno Ferreira Neves, and Paulo Verı́ssimo. Proactive resilience through architectural hybridization. In Hisham Haddad, editor, Proceedings of the 2006 ACM Symposium on Applied Computing (SAC), Dijon, France, April 23-27, 2006, pages 686–690. ACM, 2006. [30] Wilfried Steiner. TTEthernet: Time-triggered services for Ethernet networks. In 2009 IEEE/AIAA 28th Digital Avionics Systems Conference, pages 1.B.4–1–1.B.4–1, 2009. [31] Gang-Neng Sung, Chun-Ying Juan, and Chua-Chin Wang. Bus guardian design for automobile networking ecu nodes compliant with flexray standards. In 2008 IEEE International Symposium on Consumer Electronics, pages 1–4, 05 2008. [32] Christopher Temple. Avoiding the Babbling-Idiot Failure in a Time-Triggered Communication System. In Digest of Papers: FTCS-28, The Twenty-Eigth Annual International Symposium on Fault-Tolerant Computing, Munich, Germany, June 23-25, 1998, pages 218–227. IEEE Computer Society, 1998. [33] TTTech. TTP Communication Protocol Specification, FEB 2011. [34] TTTech. Time-Triggered Ethernet Communication Protocol Specification, NOV 2016. [35] Antonio Virdis and Michael Kirsche. Recent Advances in Network Simulation The OMNeT++ Environment and its Ecosystem: The OMNeT++ Environment and its Ecosystem. Springer, 01 2019. [36] Man-Ki Yoon, Sibin Mohan, Chien-Ying Chen, and Lui Sha. Taskshuffler: A schedule randomization protocol for obfuscation against timing inference attacks in real-time systems. In 2016 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS), Vienna, Austria, April 11-14, 2016, pages 111–122. IEEE Computer Society, 2016. [37] Kim Zetter. A cyberattack has caused confirmed physical damage for the second time ever. wired, 2015. Last accessed: 12-12-2022.