云环境中基于时钟偏移的客户端设备识别（AINA 2012） 原文标题：

2012 26th IEEE International Conference on Advanced Information Networking and Applications

Clock Skew Based Client Device Identification

in Cloud Environments

Ding-Jie Huang , Kai-Ting Yang , Chien-Chun Ni , Wei-Chung Teng , Tien-Ruey Hsiang , and Yuh-Jye Lee
Department of Computer Science and Information Engineering

National Taiwan University of Science and Technology, Taipei City, Taiwan 106
Email: {D9515002, D9615007, weichung, trhsiang, yuh-jye}@mail.ntust.edu.tw

Department of Computer Science
Stony Brook University, Stony Brook, NY 11794, USA

Email: chni@cs.stonybrook.edu

Abstract--Along with the growth of cloud computing and possible invalid user login. Many candidates can be used as
mobile devices, the importance of client device identity concern the fingerprint of physical devices, such as IP address, MAC
over cloud environment is emerging. To provide a lightweight address, cookie, or web browser's configurations [1]. However,
yet reliable method for device identification, an application layer these attributes suffer the weaknesses of easy to forge, lack of
approach based on clock skew fingerprint is proposed. The uniqueness, and varying with environments, which make them
developed experimental platform adapts AJAX technology to insufficient to serve as device fingerprinting. In this paper,
collect the timestamps of client devices in the cloud server during we propose clock skew, a distinctive fingerprint, to identify
connection time, then calculate the clock skews of client devices. different devices.
Few methods based on linear regression and piecewise minimum
algorithm are developed to optimize the precision and shorten Clock skew is the difference of clocking speed between
timestamp collection process. A jump point detection scheme two clocks. Generally, modern processor's clocks present two
is also proposed to resolve the offset drifting problem, which is properties [2][4]: first, the clock skew between two devices
usually caused by switching network or temporary disconnection. is relatively stable over time; second, there is distinguishable
Finally, two experiments are conducted to study the effectiveness clock skew between any two physical devices. According
of clock skew fingerprint, and the results illustrate that the to these two properties, clock skew can be regarded as a
false positive rate and the false negative rate, in the worst case, fingerprint of any device with digital clock. Clock skew has
are both no more than 8% when the tolerance threshold is set been widely used as an attack method to reveal a web host
appropriately. behind HoneyPot or Tor networks [4][6]. Later, it is also
used to verify the identity of sensor motes [7,8]. This work
Index Terms--clock skew, device identity, cloud service, jump applies clock skew to identify client devices for server security
point detection in cloud environments, or even in classic web systems.

I. INTRODUCTION In this paper, we treat clock skew from a novel aspect
and regard it as a detection mechanism of adversary. Also,
The growth of cloud-based services in recent years has to display the usability of clock skew, a web page based
significantly changed the way how people use computers and skew detection system is constructed to collect the timestamps,
mobile devices, and also the way security attacks may be and five different methods are implemented on it to calculate
launched. The architecture of cloud differs from classic com- the clock skews of client devices. We provide an AJAX-
puter network in many ways. Network connections become based technique to periodically collect time information from
part of infrastructure on basic operations like data accessing, cloud service subscribers to the server. Device fingerprinting
and the server threats are further isolated under virtualization is then performed by estimating the clock skew via this time
technologies. Therefore, classic security issues such as user information. Through experiments performed on a testing plat-
privacy, data confidentiality and regulation concerns should form containing over 100 devices, the clock skew effectively
be reconsidered under the cloud computing environments. identifies client devices regardless of underlying networking
channels such as 3G, Wi-Fi, or ADSL, etc.
This paper studies the client device identification problem
of cloud security. Nowadays, people often subscribe cloud Furthermore, during our experiments, we observed that
services through personal devices such as mobile phones, sometimes packet offsets drift dramatically and thus cause a
tablets, and laptop computers. Therefore, user identity can be jump point. This problem is mainly caused by global time
associated to dedicated hardware. Device identification in the synchronization or network connection hand-off. In previous
cloud is useful in detecting unauthorized account access and work, since the packet collection period is long, this phe-
locating stolen devices. nomenon is ignored and have not been solved. To minimized
the packet collection period and speed up the clock skew
Device identification is realized by maintaining a registered computation, a jump point detection scheme is provided.
list of physical devices which are associated with valid users.
Once a user logs into the service via an unregistered de-
vice, service provider may ask the user to pass additional
verification, or raise an alarm to the system supervisor for

1550-445X/12 $26.00 2012 IEEE 526

DOI 10.1109/AINA.2012.51
 In this work, we introduce clock skew as a effective client applied to server side for defense purpose. We discuss more
device identity in cloud services, and provide a solution to about the reason later at section III.
the jump point problem which to our knowledge has not been
discussed before. All of the above clock skew based techniques are attacking
methods that probe service providers on the Internet. To deploy
II. RELATED WORK clock skew as a defense mechanism, Huang et al. [7] proposed
a method to utilize clock skew on node identification in wire-
At first, we review several modern host identification less sensor networks. In their paper, clock skew fingerprinting
schemes. Then, clock skew based techniques developed for is proposed as a countermeasure against Sybil attack. Uddin's
wireless sensor networks and the Internet are discussed. work [8] also verified that the above-mentioned skew-based
scheme an effective fingerprinting approach if under a covert
A. Host Identification Techniques channel.

In previous studies [9], once an adversary successfully forge III. CLOCK SKEW BASED HOST IDENTIFICATION:
its identity to infect the cloud server, the adversary might SCENARIO AND PRELIMINARIES
prompt serious damage either to the service provider or to
the client. Thus, an effective scheme to identifying different In this section, the scenario and preliminaries of clock
clients is essential for any SaaS based service. skew based host identification are introduced. In the first part,
a scenario of how clock skew based scheme assists device
On the other hand, Remote host identification or finger- identification and malicious adversary detection is presented.
printing has been studied broadly. Possible applications vary The second part discusses preliminary basic knowledge of
from Bluetooth signal [10] to RFID tags. Gerdes et al. [11] computing clock skews and corresponding terminology. Then,
proposed a method to uniquely identify Ethernet devices by a brief description of the experimental platform is given. In
analyzing their analog signals. Later, Rasmussen et al. [12] the last part, the time collection process is further analyzed.
extended the radio fingerprinting technology to wireless sensor
networks, and demonstrated its feasibility through experi- A. Scenario of Clock Skew Based Client Device Identification
ments. Eckersley [1] presented a web browser-based device
fingerprinting approach which uses browser's configurations 1) Device identification system construction: The scenario
and plug-in information to characterize the device. Eckersley's of the client device identification system is showed in Fig. 1.
also showed that web browser's information can be easily Consider a user trying to login to a web-based cloud server.
traced. To confirm the validity of this login, the server checks if this
user already has one or more registered devices in the skew
B. Clock Skew based Attack and Defense Schemes value database.

Clock skew has been widely used in various attacks to detect If not, the server performs secondary authentication on the
and to reveal hidden hosts. In [4], Kohno et al. exploited client. Some currently popular methods include cell phone
clock skew to fingerprint a remote physical device by stealthily verification, email verification, and interactive method, to
record and analyze its ICMP or TCP timestamps. However, name but a few. If the user cannot pass the verification, login
for real world applications, using ICMP and TCP timestamps is denied. Users who passed the identification process may
have their limitation. ICMP timestamps are blocked by many choose whether to register the current device or not. In the
firewalls, and some operating systems in default disable TCP former case, a timestamp collection server starts to monitor
timestamps. Furthermore, their approach failed in anonymous the time difference between itself and the client device, and
networks like Tor in which end-to-end TCP connection is not calculates the relative clock skew accordingly. The estimated
possible [6]. clock skew value become the fingerprint of the client device,
and is stored in a database for later login.
Murdoch [5] proposed a clock skew based attack to re-
veal hidden services. The pseudonymous server identity was On the contrary, if there exist registered device in the
revealed due to the shift of clock skew which results from database, the server compares the clock skew of current client
increased server load and accordingly the CPU temperature. device with the registered one. If the difference of these two
This attack works in Tor network. However, it highly relies skews is under a tolerance threshold, the server accepts the
on large amount of traffic from the hidden server through device and consider the client has passed the verification. In
Tor network. Also, it requires large amount of timestamps contrast, if the difference exceeds the threshold, this account
in a short period of time to perform adequate clock-skew might be under an account hijacking attack. In this case, the
estimation. server then requires the user to provide further information to
verify his/her identity. The following steps are the same with
Later Zander and Murdoch developed an enhanced attack the no registered client device case. Finally, the server should
with synchronized sampling technique [6] which significantly raise an alarm to notify the associated client when potential
reduces the quantization error and thus cut the heavy network malicious intention is detected.
traffic necessary to previous attack. Also, their work is the
first one that undertakes the clock skew estimation through 2) Timestamp collection system of a cloud service: With
HTTP protocol. However, this attack model can not be directly the aid of clock skew fingerprinting technique, a cloud service
gains additional protection against malicious attackers. In

527
 Clients key in Server Client
username & password

Yes Check if the client has No Request
index.php
a registered device Main Web
Server Return
index.php + sync.js

Collecting time information and Laptop
estimating clock skew
Database AJAX packets
(timestamp)
Firewall
o
Yes | skew difference | No Timestamp o
Collection o

< threshold Yes Check if the client can No Server

pass other verification

Fig. 2. Scenario of timestamp collection.

Pass Register the client Reject to
login
verification Yes device or not No

and login The calculated clock skew are stored in the database server
for future use. Once a client requests the index page from the
Calculate the Login main web server, it returns the page including a script sync.js.
clock skew of This script then asks the client device to periodically send back
the device, then its time information to the timestamp collection server.

add it to In fact, we have built a prototype system to perform
registered list experiments of clock skew identification following the above
scenario. The main web server equips Ubuntu server operat-
DB ing system, running Apache web server. Because our skew
estimating method is based on Javascript, the accuracy of
Login timestamps is limited in one millisecond.
Fig. 1. Flowchart of clock skew based host identification system.
B. Terminology of Clock Behavior
fact, device fingerprint, as a physical attribute, is superior
to network parameters like IP address, MAC address, and The terminology used to represent the clock characteristics
cookie. Moreover, clock skew's two major properties, uneasy is as follows. The nomenclature from [3,8,13] is adapted is
to forge and device distinctness, solid our method as a prospect this paper. Consider Cx(t) as the time reported by the clock
candidate for cloud-based applications. of device x at real time t, Cx (t) dCx(t)/dt and Cx(t)
d2Cx(t)/dt2, t 0. Let Cc and Cs be the clocks of client
As stated earlier, Zander and Murdoch provided a clock and the timestamp collection server respectively:
skew estimating method based on HTTP request [6]. However,
their method cannot be directly applied at the server side in the 1) Offset: The difference between the time reported by Cc
above scenario. This is because their approach must frequently and by Cs, e.g., the offset of the client clock Cc relative
asks for the time information of remote host through HTTP to the server clock Cs is Cc(t) - Cs(t), t 0.
request, which is infeasible for a web server to perform in the
same way. Therefore, a cloud server needs a different approach 2) Frequency: The rate at which the clock progresses, e.g.,
to obtain time information from a client. the frequency at time t of Cc is Cc (t).

To force the client to return its own time informations back 3) Skew (): The difference in the frequencies of two
to server, AJAX technique is applied in our system because clocks, e.g., the skew of Cc relative to Cs at time t
every packet generated by AJAX contains the corresponding is (t) = Cc (t) - Cs (t).
timestamp. Since AJAX is implemented by Javascript and
Javascript is generally supported by web browsers, we assume 4) Drift: The drift of Cc relative to Cs at time t is Cc(t)-
that the execution of Javascript is allowed. Cs(t).

The architecture of the timestamp collection system is According to the above definitions, if the server accumulates
illustrated in Fig. 2. On the client side, a client connects to sufficient client time information, the clock skew of this
web server through Secure Sockets Layer (SSL) to provide client can be computed by the server locally.
a secured channel. On the server side, the main web server
provides general services to clients. Meanwhile, a timestamp C. Usage of Timestamps
collection server is settled to gather timestamps from clients.
With AJAX, timestamps can be collected by server in every
packet returned from client. Unless further specified, all clock
skew estimation is based on server clock Cs. Assume that
the timestamp collection server has received n AJAX packets

528
 Outlier can be represented as LR(N1i), while receiving ith request
from the client.
Fig. 3. Distribution of offset collected from the timestamp collection server.
In accumulated skew, every data, even outlier, is accumu-
from a client. Let timestamp tic represents the Cc time when ith lated in the data set. With vast data and time, this method pro-
packet sent out by the client; similarly, timestamp tis denotes vides stable and reliable result. However, in a short period of
the Cs time when the ith packet is received by the server. The time, accumulated skew is dramatically influenced by outliers.
estimated offset between server and client for the ith packet Moreover, errors caused by the outliers continuously affect
is denoted as oi, where oi = tsi - tic. Also, the period between the result for all the following computation. For example, as
the ith packet and the jth packet according to the server's shown in Fig. 4(a), estimated skews fluctuate enormously at
clock Cs is denoted as xij, where xij = tjs - tis. the red circle part due to huge network delay at this time.

To illustrate the relation between server time and packet 2) Skew with Sliding-Windows: Comparing with the accu-
offset more clearly, (tis, oi) is plotted into a scatter diagram; mulated skew, a sliding-window skew takes sampling only
furthermore, the clock skew between server and client can be from the most recently short period of time. This prevent the
estimated as the slope of this diagram. An example is shown largely fluctuated data from poisoning skew estimation in long
in Fig. 3 , where trend of these dataset is decreasing with term.
a negative slope, which means that the clock skew between
client and server is negative. For sampling windows with size w, the sliding-windows
skew LR(Nij) must satisfy j - i = w.
IV. CLOCK SKEW ESTIMATION
Fig. 4(b) shows the result of sliding-windows skew with
As shown in previous section, skew can be estimated as window size 200; the suggestion on the window size is
the slope of the scatter diagram. However, due to occasionally provided in section V.
network delay or jitter, there are some outlier nodes that can
not be used to compute the clock skew. In this section, two As the result indicates, sliding-windows reduced the effect
basic techniques are illustrated to estimate the clock skew of outliers which is outside the sliding window, but if outliers
between the timestamp collection server and the client: lin- exist inside the window, this method still suffer from the
ear regression and piecewise minimum algorithm. Moreover, outlier effect. Therefore, to filter out these outliers, a method
for clock skew based host identification, we implement five to choose the suitable inliers is needed, especially under the
methods to estimate the clock skew between the server and environment that huge network delay happens randomly.
the client, and analyze the performance of each estimation.
Digressively, one may notice that the skew estimation in
A. Linear Regression Algorithm Fig. 4(b) are all 0 in the beginning. This is because the window
Linear regression is a method for a set of data points size w is 200, the skew estimation before 200 are marked as 0
for no enough data. All sliding-windows based methods have
to approach one line. Although this method is not robust this restriction.
while significant outliers exist in the data set [3], it is easy
to implement, and with less computation overhead. Here, 3) Sliding-Windows Skew with Lower-Bound Filter: To
four different types of mechanism based on linear regression disassemble the effect caused by outliers, the most effective
are proposed to approach the clock skew. In the following method is to filter them out, so a lower bound approach would
paragraph, LR(Nij) denotes the linear regression calculation be helpful here. For example, huge network delay exists at
for data set Nij, which contains the data from (tis, oi) to red circle part in Fig. 3 (i.e. the outliers); these points mostly
(tjs, oj ). caused by network delay may affect the correctness of skew
estimation enormously. In contrast, the offsets lie in the lower

1. Accumulated Skew: For accumulated skew, while pack- part are relative smooth. Hence, the closest skew estimation is

ets sent from the client are received by the server, the server calculated from the lower-bound dataset, as previous research
computes the estimated skew immediately. The estimated skew did [3]. In [3], Moon et al. suggests piecewise minimum
algorithm as a simple and efficient method for estimating clock
skew. Since piecewise minimum can be used to extract the
lower bound of offset, the algorithm is suitable to serve as the
low-bound filter.

For sliding-windows skew with lower-bound filter, the local
minimum offset is picked for every m packets in each sliding
window w. Thus, the amount of sampling data for skew esti-
mation is reduced to w/m. With this lower-bound filter, only
packets with minimal network delay are collected, thereby
minimizing the influence of the network. This lower-bound
skew estimation can be denoted as LR(M in(Nij)), where
M in(Nij) is the data set of local minimum offset between
ith request and jth.

As shown in Fig. 4(c), the skew estimation is much
smoother than the one in Fig. 4(b); the window size w is

529
200, m is 5 in this example, so the total data for one skew (a) Accumulated Skew
estimation is 40. By this method, the clock skew estimation
hence stable and capable for reducing the effect of huge (b) Skew with Sliding-Windows
network delay.
(c) Sliding-Windows Skew with Lower-Bound Filter

1. Accumulated Sliding-Windows Skew with Lower-Bound

Filter: Since the local minimum offset is useful to find the (d) Accumulated Sliding-Windows Skew with Lower-Bound Filter
lower-bound skew, we further calculate the accumulated skews Fig. 4. Comparison of each skew estimation by applying linear regression.
with these local minimum dataset and plot the corresponding
skew distribution diagram in Fig. 4(d). We found that this
method can both reduce the effect of huge network delay
and converge rapidly within 20 packets. This skew estimation
can be denoted as LR(M in(N1i)) while receiving ith request
from the client.

As a result, by comparing these four types of skew esti-
mations, the lower-bound filter has the best performance on
filtering out the huge network delay in our experiments.

B. Quick Piecewise Minimum Algorithm

The quick piecewise minimum algorithm is achieved by
separating data into n segments and picking two minimum
offsets from first segment and fourth segment respectively. By
connecting these two minimum offsets, a slope of this line
can be obtained. In our experiment, n is set to 4. As shown
in Fig. 5, the black circles are offsets, the red squares are the
corresponding segments, and the two blue squares are the two
local minimum offsets. Thus, the estimated skew is the slope
of the black line between two blue squares.

As long as the data set is stable enough, the quick piecewise
minimum algorithm can achieve high stability with little
computation. Fig. 6 illustrates the skew estimated by this
method based on the same data with Fig. 3. Since the quick
piecewise minimum algorithm has low computation overhead,
it can be efficiently apply to other cloud service.

C. Jump Point Detection and Elimination

During packet collection period, a jump point of offset
occurs if the client is performing time synchronization with
a time server or roaming between different network providers.
An example of jump point, as shown in Fig. 7, is marked by
red circle. If this jump point phenomenon does not detected
by server, the skew estimation process would be affected by
the mass offset error, reacting in an inaccurate result. Thus,
an approach to detect jump point occurrence is needed while
implementing the skew estimation.

The main idea of this algorithm is to divide sequential times-
tamps into groups, where every pair of consecutive timestamps
in a group produces only a small time difference. Suppose diff
represents the difference between two adjoining offsets; the
diff is denoted as dij, where dij = oj - oi, i = j, i < j.
Also, another threshold k is set to check if the diff is too
large, thereby detecting the jump point. The basic jump point
detection algorithm is as follows:

1. Pick the local minimum offsets for every p packets.
2. Compute the diff between every pairs of contiguous

local minimum offsets.

1. Following detection process is divided into two classes:

530
 Offset Jump Point
(Second)
Offset
(Second)

Server Time (second) Server Time (second)

Fig. 5. Implementation of quick piecewise minimum algorithm. Fig. 8. Detection of jump point between two segments.

Fig. 6. Skew estimation by applying quick piecewise minimum algorithm. a) If derived diffs are all positive or all negative:
Denote the median of derived diffs as Med(diff).
Fig. 7. Offset distribution diagram between server and client with a jump If there exists a diff that diff > k Med(diff), a
point. jump point exists inside these p packets.

b) If only part of derived diffs are positive:
If positive diffs are followed by one negative diff
at x, this x is the jump point.
Similarly, negative diffs followed by one positive
diff is processed vice versa.

To prevent the error caused by the jump point, the skew es-
timation is executed before and after the jump point separately
by quick piecewise minimum algorithm. As shown in Fig. 8,
while the jump point is located at jth segment, the first half
estimated skew is calculated from 1th to (j -2)th segment; the
second half is calculated from (j + 1)th to the last segment.
Two segments are omitted from skew estimation because the
jump point may locate at (j - 1)th or jth segment. By this
segmental method, all candidate skews can be calculated.
To represent the moderate value of all skews, we pick the
median of these candidate skews as the estimated skew for
the corresponding client.

A homogeneous case of jump point is a time gap, which
is a period of time of blank packets, as shown in Fig. 9.
A time gap generally arises when user is moving around,
causing the change of network connection, resulting in a period
of disappearance. To detect this kind of jump point, simply
checking xij, where j = i + 1. If xij is larger than twice of
the assigned AJAX packet sending period, it is considered as
a time gap, and is treated as a jump point as well.

V. EXPERIMENTS AND EVALUATION

To evaluate the proposed host identify method, two different
experiments are held in this section. Principal parameters of
our experiments are set as follows.

To obtain high precision offsets, at least 200 AJAX packets
are collected for skew estimation in every experiment. Since
the time resolution of Javascript is 1 ms, at least 1000 seconds
is required to detect a offset up to 1 microsecond resolution.
Since our AJAX script generates a packet for every 5 seconds,
the minimum number of packets required would be 1000/5,
or 200.

531
Fig. 9. Offset distribution diagram between server and client with network processor, running MAC OS X 10.6.8, and the estimated skew
disconnection. is calculated by jump point detection with quick piecewise
minimum algorithm. As shown in table I, we at first connect
TABLE I this laptop to the server via common networks such as LAN,
THE ESTIMATED SKEW OF THE SAME DEVICE UNDER DIFFERENT ADSL, 3G, and Wi-Fi.

NETWORK ENVIRONMENTS According to the first four results, it justifies that clock
skew estimation is relative independent regardless of network
Network type Skew estimation Packets No. of IP addr. access media. It is worthy to notice that the estimated skew is
LAN fluctuated within 2.16 ppm, from -21.08 ppm to -23.24 ppm.
-21.91 ppm 1001 1 Since the clock skew may fluctuate with temperature men-
ADSL -23.24 ppm 207 1 tioned in [5,6,8], these experimental results seems acceptable
3G -22.74 ppm 13322 1 considering the short timestamp collecting time and possible
Wi-Fi -21.48 ppm 5837 1 noise related to network environments.
Tor -21.08 ppm 1400 1
-23.24 ppm 951 1 With the skew fluctuation, it is a trend-off to set a rea-
VM -23.71 ppm 1027 1 sonable tolerance threshold for detecting malicious login. If
-21.79 ppm 9810 1 the threshold is too small, the false positive rate would be
-23.06 ppm 1470 1 unacceptably high, which means that one device might be
-22.53 ppm 15007 55 treated as different device quite often. On the contrary, if the
-23.22 ppm 12922 57 threshold is too large, the false negative rate would raise, which
-22.88 ppm 24120 108 leads to high probability of accepting unregistered devices.
-113.19 ppm 868 1 Thus, after analyzing the table I, we consider a threshold of
-114.22 ppm 1001 1 1 ppm appropriate at the present stage. This threshold derives
-6.40 ppm 1001 1 a probability of misjudgement 7.4%, or (2.16 - 2)/2.16,
-6.83 ppm 890 1 assuming the probability density function of skew fluctuation
is uniformly distributed.
For the jump point detection, the parameter p is set to 20,
and the threshold k is also set to 20. p and k are adjustable Furthermore, the experimental environment in Tor is also
according to different network environments; with parameters listed in table I. In our experimental results, 200 packets is not
of smaller values, the jump point detecting process leads to a enough to calculate a stable estimation. However, the estimated
much sensitive result. skews diverge and are close to the common network cases,
as long as the collecting time is long enough. Finally, for
A. Same Device under Different Networks client hosts running inside a VM, the skews are stable but
unpredictably different from the real one. Kohno et al. [4]
The first experiment is performed with a laptop connecting had indicated that virtual machines do not have constant clock
to our timestamp collection system via multiple network ac- skews, and our experiments also shows the same results. In
cess techniques. Host behind Tor network and virtual machine addition, we found that the estimated skew under a VM is
(VM) are included in this experiment as well for reference. The relatively stable without rebooting it; however, after restarting
purpose of this experiment is to measure the skew variations the VM, the skew randomly changes to another stable value.
of one device under different network environments, thereby As shown in table I, the estimated skews of two clients are
simulating the situations that a device logins the cloud service -113.19 ppm and -114.22 ppm respectively, but their skews
from various kind of networks. In this experiment, the device changed to -6.4 ppm and -6.83 ppm after rebooting the system.
is an Apple MacBook with a 2.4 GHz Intel Core 2 Duo
B. Skew Distribution of Different Devices

To study the distinguishable property of clock skew, we
collected clock skews of 100 devices estimated by the same
timestamp collection server. The results vary from 67 ppm
to -499 ppm, and only the most close 90 skews, sorted by
their values, are illustrated in Fig. 10. Each cross in this
figure represents one device and the y coordinate stands for
its clock skew. Each clock skew is bound by an interval of 1
ppm range. As shown in this figure, many devices have their
intervals overlapped with others, which means that there exists
not negligible probability a user may pass the identification test
with unregistered devices. The worst case happens at device
number 20, whose interval overlaps with other 8 devices.
Therefore, with the threshold of 1 ppm, the maximum false
negative rate is currently 8%. We believe that further analysis

532
Estimated skew valuex 10-5 [3] S. Moon, P. Skelly, and D. Towsley, "Estimation and removal of clock
skew from network delay measurements," in INFOCOM '99. Eighteenth
0 Annual Joint Conference of the IEEE Computer and Communications
Societies. Proceedings. IEEE, vol. 1, mar 1999, pp. 227 234 vol.1.
-1
[4] T. Kohno, A. Broido, and K. Claffy, "Remote physical device finger-
-2 printing," in IEEE Transactions on Dependable and Secure Computing,
vol. 2, no. 2, April-June 2005, pp. 93108.
-3
[5] S. J. Murdoch, "Hot or not: revealing hidden services by their clock
-4 skew," in CCS '06: Proceedings of the 13th ACM Conference on
Computer and Communications Security, New York, NY, USA, 2006,
-5 pp. 2736.
10 20 30 40 50 60 70 80 90 100
[6] S. Zander and S. J. Murdoch, "An improved clock-skew measurement
Device number technique for revealing hidden services," in Proceedings of the 17th
conference on Security symposium. Berkeley, CA, USA: USENIX
Fig. 10. The sorted skew of estimated devices Association, 2008, pp. 211225.

on skew estimation of different network environments would [7] D.-J. Huang, W.-C. Teng, C.-Y. Wang, H.-Y. Huang, and J. M. Heller-
help reducing the tolerance threshold, thus reduce both false stein, "Clock skew based node identification in wireless sensor net-
positive rate and false negative rate. works," in IEEE Global Communications Conference, 2008, pp. 1877
1881.
VI. CONCLUSIONS AND FUTURE WORK
This paper addressed the client device identification issue [8] M. Uddin and C. Castelluccia, "Toward clock skew based wireless sensor
in cloud environment, and proposed a clock skew based node services," in Wireless Internet Conference (WICON), 2010 The 5th
fingerprinting technique and a practical scenario. Client device Annual ICST, March 2010, pp. 19.
identification strengthen the account safety, and the proposed
scenario suggests a potential secondary authentication ap- [9] Top threats to cloud computing v1.0. [Online]. Available:
proach without users' awareness most of the time. Several https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf
classical methods are introduced and implemented to estimate
the skews of client devices, and the treatment of jump points, [10] J. Hall, M. Barbeau, and E. Kranakis, "Detection of transient in radio
usually caused by switching network or temporary discon- frequency fingerprinting using signal phase," in Proceedings of IASTED
nection, is also discussed at the first time. To examine the International Conference on Wireless and Optical Communications
effectiveness of clock skew, we implemented a web based (WOC '03), 2003.
skew estimation platform and conducted two experiments. The
initial study includes over 100 client devices from 5 different [11] R. M. Gerdes, T. E. Daniels, M. Mina, and S. F. Russell, "Device iden-
network media. The experiment results showed that the false tification via analog signal fingerprinting: A matched filter approach,"
positive rate and the false negative rate, in the worst case, in Proceedings of the 2006 Network and Distributed System Security
are both no more than 8% when the tolerance threshold is Symposium (NDSS '06), February 2006.
set to 1 ppm. With the potential of clock skew fingerprint
be revealed, the further work would include improving the [12] K. Bonne Rasmussen and S. Capkun, "Implications of radio fingerprint-
precision of skew estimation utilizing linear programming ing on the security of sensor networks," Sept. 2007, pp. 331340.
method and accumulating the knowledge of skew fluctuation
in different network media. [13] S. Jana and S. K. Kasera, "On fast and accurate detection of unauthorized
wireless access points using clock skews," in MobiCom '08: Proceedings
ACKNOWLEDGMENT of the 14th ACM international conference on Mobile computing and
This work was supported under the National Science Coun- networking, 2008, pp. 104115.
cil Grants 100-2218-E-011-008.

REFERENCES

[1] P. Eckersley, "How unique is your web browser?" in Privacy Enhancing
Technologies. Springer Berlin / Heidelberg, 2010, vol. 6205, pp. 118.

[2] V. Paxson, "On calibrating measurements of packet transit times,"
in Proceedings of the 1998 ACM SIGMETRICS joint international
conference on Measurement and modeling of computer systems, ser.
SIGMETRICS '98/PERFORMANCE '98. New York, NY, USA: ACM,
1998, pp. 1121.

533