DoS-resistant distributed time synchronization for virtual private networks

In order to securely exchange data over the Internet, more and more organizations utilize virtual private networks (VPNs) which form potentially large overlay networks. Recently, approaches for VPN autoconfiguration have been presented, and while VPNs usually do not address availability, novel systems based on peer-to-peer communication can do so. Nevertheless, there are no satisfying solutions for time synchronization within VPNs that are designed for availability against denial-of-service (DoS) attacks, node failure, and network partitioning. The Network Time Protocol (NTP) is widely used, but relies on hierarchical structures, and thus is not suitable for scenarios with high availability requirements. Thus, in this article we present a novel, fully distributed, and fault tolerant time synchronization approach, that is designed to be transparently integrated in VPN gateways. Combining diffusion-based round-trip-synchronization with an external and internal attacker detection, the proposed mechanism is making a contribution to resilient VPN design.