Computer Time Services Internet Time Service

1 Page 1 NISTMeasurementServices: NAT'LINST.OFSTAND&TECH ' N!8T PUBLICATIONS REFERENCE NISTComputer iimeServices: InternetTimeService(ITS), AutomatedComputerTime Service(ACTS),andtime.gov WebSites NIST Special Publication 250-59... Open at page → 2 Page 2 rhe NationalInstituteofStandardsandTechnologywasestablishedin1988byCongressto"assist industryinthedevelopmentoftechnology .. .neededtoimproveproductquality,tomodernizemanufacturing processes,toensureproductreliability .... Open at page → 3 Page 3 NISTSpecialPublication250-59 NISTMEASUREMENTSERVICES: NISTComputerTimeServices:InternetTimeService (ITS),AutomatedComputerTimeService(ACTS),and time.govWebSites JudahLevine MichaelA.Lombardi AndrewN.Novick TimeandFrequen... Open at page → 4 Page 4 Certaincommercialentities,equipment,ormaterialsmaybeidentifiedinthisdocumentinorderto describeanexperimentalprocedureorconceptadequately.Suchidentification isnotintendedtoimply recommendation orendorsementbytheNationalIn... Open at page → 5 Page 5 CONTENTS Page Chapter1.InternetTimeService(ITS) 1 I.PhysicalDescriptionofITS 2 A.IntroductionandHistory 2 B.HowITSisUsedbyitsCustomers 3 C.ITSFacilities 4 1.ConfigurationofITSTimeServers 5 D.OrganizationalControlofITS 5... Open at page → 6 Page 6 1.PhysicalSecurity 33 2.SecurityAgainstExternalCommandEntryorLog-ins 33 3.LimitationsonFTPAccess 33 4.LimitationsonAllOtherAccess(includingtelnet,rlogin,andrsh) 34 I a)Log-inattemptsfromnon-registeredIPaddresses 34 b)Log... Open at page → 7 Page 7 2.CollectingStatistics(NumberofCalls)fromtheACTSServers 5 1 D.TechnicalDescriptionofClientSoftware 5 1 E.TimeCodeFormat 52 III.OperationalProceduresofACTS 53 A.HardwareMaintenance 53 B.SoftwareMaintenance 53 C.FailureMod... Open at page → 8 Page 8 2.TimeServerSoftware a)Javatimerequests b)Non-Javatimerequests 62 63 65 III.OperationalProceduresoftime.govWebSites 66 A.HardwareMaintenance 66 B.SoftwareMaintenance 66 C.FailureModes 66 1.ClientSideFailures 66 2.ServerS... Open at page → 9 Page 9 Chapter1-InternetTimeService(ITS) TheNationalInstituteofStandardsandTechnology(NIST)provides itsInternetTime Service(ITS)tothegeneralpublic.TheservicedistributesCoordinatedUniversalTime(UTC) keptatNISTandcalledUTC(NIST),... Open at page → 10 Page 10 I. PhysicalDescriptionofInternettimeService(ITS) TheInternetTimeserviceisbasedoncommercialUNIXworkstationswhoseclocksare synchronized toUTC(NIST)bymeansofperiodicdial-uptelephoneconnections tothe AutomatedComputerTimeSer... Open at page → 11 Page 11 TimingRequestsforNISTInternetTimeService t^r^oocnojaiajoooo-"-''--^-'-05a>a)a>05OTa)oooooooo COT- PsIinoO'i-CMlO OCM t^o Date Figure1.GrowthoftheInternetTimeServicebasedonnumberoftimingrequests. B.HowITSisUsedbyitsCustom... Open at page → 12 Page 12 •Usersofdistributeddatabasesystemswhomustguaranteethecorrecttimeorderof transactions thatmightbereceivedbyacentralserversometimeaftertheywereactually enteredintothesystem. •Distributeddata-loggingsystems,wheretheclockone... Open at page → 13 Page 13 hardwareforabout20minutes.TheUPSdevicesareconnectedtoageneratorthatstarts automaticallywhenthepowerfails.Thegeneratorisnormallyrunningwithin60secondsaftera powerfailure,andcansupporttheentireloadindefinitely. Thetimeserv... Open at page → 14 Page 14 II.TechnicalDescriptionofInternetTimeService ThissectiondescribesthetechnicaloperationoftheITS,includingadiscussionofthe hardwareused,andtheclientandserversidesoftware. A.TechnicalDescriptionofHardware TheITSisbuiltentir... Open at page → 15 Page 15 •Arubidiumoscillatorthatisnotontimebuthasafrequencyagingrateoflessthan 10"" per monthandashort-termfrequencystabilityofbetterthan8x 10''^ foraveragingtimesoflO"* sorless(servers 1,2,6,9). •Astabilizedquartzoscillatorthat... Open at page → 16 Page 16 •SupportfortransmittingInternationalAtomicTime(TAI)andUTCsimultaneously forusers whoneedcontinuityoftimeintervalsacrossleapseconds.Thiscapabilitywasdevelopedin collaborationwithDavidMillsoftheUniversityofDelaware. [5] 2.... Open at page → 17 Page 17 •Theexec,snmpandrpcdaemons,whichareusedtocheckforportscansandpossibledenial ofserviceattacks. •Thesendmailconfiguration, whichhasbeenmodified toaddress potential security vulnerabilities thatarepresentinthestandard.These... Open at page → 18 Page 18 frequencyestimateatepochtk(usingthemethodtobedescribedbelow)is .Thealgorithm drivesXktozerobyestimatingtheoptimumvalueforthefilteredfrequency andusesthis frequencytoperiodicallycorrecttheserverclock'stime. Thetimeoffsetm... Open at page → 19 Page 19 Tosimplifythealgorithm,theadjustmentintervalismodifiedsothatanevennumberof adjustmentsoccursduringthecaHbration interval tq.Themagnitudeoftheadjustment is recalculatedtothenearestmicrosecondbasedonthemodifiedadjustmentin... Open at page → 20 Page 20 spectraldensityvarieswithfrequency,or,equivalently,howtheirAllandeviation[9]varieswith averagingtime.Figure2showsthesquarerootoftheAllandeviationasafunctionofaveraging timeforatypicalserverclockoscillator,andthethreeline... Open at page → 21 Page 21 Whitefrequencyfluctuations are"besffromapredictionpointofview,becausean underlyingmeanfrequencyexists,andthefractionalfluctuationsaboutthismeancanbereduced withmoreaveraging.Thepredictionerrorincreasesonlyasthesquareroot... Open at page → 22 Page 22 Latency,ordelaysintroducedbytheoperatingsystemandhardware,alsocontributeto theuncertainty. Signalsreceivedthroughanyinputchannelaredelayedbythetimeneededto transmittheinformationbetweentheinputportandthehigherlevelproces... Open at page → 23 Page 23 andequation(2)isreplacedby y^-J^^^-- (7) Tk Equations(3)and(4)arenotaltered. Thelockclockalgorithmwastestedonthetimeservernamedtime_a.Thefirststepwasto evaluatethefree-runningperformance oftheserverclockoscillator. Conse... Open at page → 24 Page 24 time_a,ControlledClock 10^ , lO"^ 10^ 10^ AveragingTimeinSeconds(s) Figure3.TheAllandeviationforthetimeaserverclockwhencontrolledbythelockclock algorithm. Thereference linedrawnthroughthepointshasaslopeof-1,which is char... Open at page → 25 Page 25 formats. Interlockcharacterizestheserverclockintermsofitstimedifferenceandfrequency offsetwithrespecttotheexternalreference;bothparametersarethenusedtoadjusttheserver clocktoagreewithUTC(NIST). TheClockModel-Interlockcha... Open at page → 26 Page 26 X= (/,+J)- / (13) Ifthepathdelayissymmetrical,thend=A/2,and X= {t,-t,)+{t,-t,) 2 (14) Ifthepathdelayisnotexactlysymmetrical, thisestimatewillbewrongbyanamount proportional totheasymmetry. Iftheactualoutbounddelayisgivenh... Open at page → 27 Page 27 Figure4showsthepredictionerror,Cxasafunctionoftimewhentheinterlockalgorithm isrunning.Thiserroris£,{k)=|(x^- Xi^)\, i.e.,thedifferencebetweentheaveragemeasured time-difference atsomeepochandthevaluepredictedusingequation... Open at page → 28 Page 28 Strain-Synchronized toSeattleTimeServer 12.5 - 10 - 7.5 - -10- 1 2 3 4 5 TimeinDaysFrom25January1997 Figure5.ThetimeoffsetofthestrainclockwithrespecttoUTCasmeasuredfromthe ACTStimesignals.TheACTScomparisonsarecharacteriz... Open at page → 29 Page 29 improvesupontheinterlockalgorithmbecause itisself-configuring, andcanadaptitselfto fluctuationsintheasymmetryofthenetworkdelay. Autolockwasdeveloped inresponsetotwoobservationsmadeatNIST.Thefirst observationwasthatITSusa... Open at page → 30 Page 30 adjustedonceperdayuntilthetwoareroughlyequal;thesizeofthegroupisincreasedifthe uncertainty islargerthanrequested,anddecreased iftheuncertainty isalreadybetterthan requested.Assumingthatthemeasurementnoiseiswhitephasenois... Open at page → 31 Page 31 freerunforthatintervalandneedstobecalibratedmoreoften.Ifthepredictionerrorissmaller thanthedesireduncertainty,thecalibrationintervalisacceptable. Ifthepredictionerrorismuchsmallerthanthemeasurementnoise,thenthecalibratio... Open at page → 32 Page 32 TimeDifference,LocalClock-UTC T3 a o o C/3 0.075 - 0.05 - 0.025 - -0.025 - -0.05 - 10 20 30 EpochinDaysfrom24March1998 Figure6.ThetimedifferenceinsecondsbetweenthelocalclockandUTC(NIST). IntervalBetweenCalibrationCycles... Open at page → 33 Page 33 Figure8showstheaveragefrequencyoffsetoftheclockasestimatedbythealgorithm, measuredinpartsin10^.Diurnaleffectsarevisibleonoccasion,buttheyaresmallerthanthe randomwalkfrequencynoise,whichdominatesthenoisespectrum atthisper... Open at page → 34 Page 34 Thesecondexperimentconfiguredtheautolockalgorithmforanuncertaintyof1s,using thesameserversasinthepreviousexperiment.Thecahbrationintervalwassetto32000s,and specifiedamaximumcalibrationintervalof200000s.Thetimeconstantfor... Open at page → 35 Page 35 copiesoftheclientsoftwareanddocumentation. Allothernetwork-basedaccessiscompletely blockedorisenabledandgovernedbythesecuritypolicydescribedinSectionIII.F. Theserversalsoincludereportinganddiagnosticsoftwarethatmonitorth... Open at page → 36 Page 36 TherearemanycommerciallyavailableITStimeclients.AlthoughNISTisnotallowed torecommend,endorse,orreviewcommercialproducts, itdoesmaintainalistofallknown softwarepublishers.Newpublishersareaddeduponrequest.Thislistcanbefoun... Open at page → 37 Page 37 Tables.TheNISTDaytimeTimeCodeFormat. JJJJJYR-MO-DAHH:MM:SSTTLHmsADVUTC(NIST)OTM^tiiiliii where: JJJJJistheModifiedJulianDate(MJD).TheMJDisthelastfivedigitsoftheJuWOTf whichissimplyacountofthenumberofdayssinceJanuary 1,47... Open at page → 38 Page 38 responsibilityoftheclientsoftware.The32-bitbinaryformatcanrepresenttimesoveraspanof about136yearswitharesolutionof1s.Thereisnoprovisionforincreasingtheresolutionor increasingtherangeofyears. ThestrengthoftheTimeprotocolt... Open at page → 39 Page 39 III.OperationalProceduresofInternetTimeService ThissectiondiscussesthehardwareandsoftwaremaintenancerequiredbyITS. Italso discussestheITSfailuremodesandsecurityissues. A.HardwareMaintenance Theserversaremaintainedbyamain... Open at page → 40 Page 40 NISTtimeserverssupportthesameservices,theclientsoftwaresimplyhastotryanotherIP addressafteraqueryfails.Theoperationaldetailsvaryfromoneclientprogramtoanother;the NTPdaemon,forexample,willdothisautomaticallyandwithoutspec... Open at page → 41 Page 41 solutionforauseristouseeitherthedaytimeorNTPformats,butthedesignersofsome proprietarynetworkoperatingsystemshavebeenunwiHingtodothat.Thesamequestionabout howtorespondwhentheserverisnothealthyalsoexistsforthemorerobustfor... Open at page → 42 Page 42 legitimateuserwhoknowsthecorrectpassword. Allpubliclyavailabledirectoriesaremarked read-only. 4.LimitationsonAllOtherAccess(includingtelnet,riogin,andrsh) Accessthroughtelnetandothertypesoflog-insislimitedtoaparticular s... Open at page → 43 Page 43 theserveratMicrosoft.Thisattackusedanetwork"sniffer"tocaptureauserpassword,andour responsewastoinstalltheone-timepasswordsystemthatwecurrentlyhaveinplace.Our loggingsystemhasrecordedlotsofattempts,someofwhicharemorehumor... Open at page → 44 Page 44 IV.Customers ThissectiondescribesthenumberofITSusers,theservicecapacity,andthewaysthat NISTinteractswithandsupportstheusers. A. EstimatedNumberofUsers AsillustratedinFigure1,theITSwasreceivingwellover300milliontimingrequ... Open at page → 45 Page 45 Reportsofseriousproblemsarehandledimmediately,butthesearerare.Suggestionsfor newfeaturesormodifications areconsideredandareimplemented ifpossible.Theclient softwaredistributedbyNISTisgenerallyupgradedabouttwoorthreetimes... Open at page → 46 Page 46 V.MeasurementUncertainties Thissectiondiscussesthemeasurement uncertaintiesofthesignalstransmittedbythe ITSservers,andofthesignalsreceivedbyITSclients. Italsodiscussesestablishingtraceability toUTC(NIST). A.Uncertainties... Open at page → 47 Page 47 timinguncertaintyoftheserversthemselves.Ontheotherhand,achentinJapancontactinga serverontheEastCoastoftheUnitedStateswillreceivemessageswithanuncertaintyofabout 25ms(la).Theactualworstcasecanbemuch,muchworse,withuncertai... Open at page → 49 Page 49 Chapter2.AutomatedComputerTimeService(ACTS) TheAutomatedComputerTimeService(ACTS)wasthefirstcomputertimeservice offeredbyNIST,makingitsdebutonMarch9,1988.Sincethatdate,ACTShasdistributed Coordinated UniversalTime(UTC)kep... Open at page → 50 Page 50 I.PhysicalDescriptionofACTS ACTSisbasedonstandardrack-mounted serversrunningtheDOSoperatingsystem. Eachserversupportsfromtwotosixmodems,andisdirectlyconnectedtotheUTC(NIST)time scaleviaacoaxialcable.Additionalserverscont... Open at page → 51 Page 51 •E-commerceande-businessuserswhosynchronizetheclocksofsystemsusedtotimestamp commercialandfinancial transactions. Thisclassofusersalsoincludescommercial applicationssimilartothefunctionofaNotaryPublicortotheRegisteredMai... Open at page → 52 Page 52 However,supportingspeedsupto19,200bits/swasdonetomake iteasierforthefastest modems(56K)tonegotiateaconnection. TheprivaterotaryusedtosynchronizetheITStimeserversisequippedwith1200bit/s modems.Thesemodemshavemorestabledel... Open at page → 53 Page 53 II.TechnicalDescriptionofACTS ThissectionsummarizesthetechnicaloperationofACTS,includingadiscussionofthe hardwareused,andtheclientandserversidesoftware.Foramuchmoredetaileddiscussion, pleaseseetheTechnicalReferenceManual... Open at page → 54 Page 54 •Thisoscillator isusedtomeasuretheround-trippathdelayduringanACTSphonecall witharesolutionof0.1ms. • Itkeepstheserver'soperatingsystemclock(DOSclock)fastwithrespecttoUTCbyabout 0.77s(14+1DOS-clock ticks).TheDOSclockisste... Open at page → 55 Page 55 Thesoftwareisnotdesignedtooperateinamulti-taskingenvironmentandmaynotwork properlyinthe"DOSWindow"ofanotheroperatingsystemthatdoesnotallowsoftware routinestodirectlyaccesshardware. Inparticular,thesoftwaremustbeabletowri... Open at page → 56 Page 56 2.TheSteady-StateCycle Thiscycleisimplemented intheprogramACTS.C. Itisdrivenbythetickvalue describedabove.Thisisanintegergivingthetimeintickssincethelastintegersecondand rangesfrom0to18or19. Thesteadystatecyclestartsasso... Open at page → 57 Page 57 4.SendingOn-TimeMarkers(OTM)toEachActivePort ThenextphaseoftheloopissendingthetimecodesandOTMstoeachactiveport(a portwithacallercurrentlyconnected). Thisisdoneusingtheinternalclockboard.The software initiallyadvancestheO... Open at page → 58 Page 58 5.DynamicRangeofthePathDelayMeasurements Thedynamicrangeofthepathdelaymeasurements isHmitedbythefactthattheDOS clockisrunningfastby13to15ticks.ThetimecodeisgeneratedatthestartoftheDOSclock second.Underworst-casecondition... Open at page → 59 Page 59 ThemonitoringsoftwareobtainstimecodesfromtheACTSserversandcomparesthem toREF_CLK. Thetimecodesareobtainedintwodifferentways,byeavesdroppingonthe server'sserialHnes,orbycalHngtheserverthroughamodemandtelephoneline(inthesa... Open at page → 60 Page 60 bytheamountoftheactualpathdelay.ACTScandothisbyusingaloop-backtechniqueto calibratethepath.Theloop-backtechniqueworksiftheclientsoftwarereturnstheOTMto NISTafteritisreceived.EachtimetheOTMisreturned,theserver(asdescribed... Open at page → 61 Page 61 III.OperationalProceduresofACTS ThissectiondiscussesthehardwareandsoftwaremaintenancerequiredbyACTS. Italso discussestheACTSfailuremodesandsecurityissues. A.HardwareMaintenance TheACTSserversaremaintainedbyNISTTimeandFre... Open at page → 62 Page 62 tosixlinesfromtheACTSrotary). SinceACTShasalotofexcesscapacitybasedonthe currentsystemload,hardwarefailuresareusuallytransparenttoclients. b)Timecodefailures TheACTSmonitordescribedintheSectionII.Cofthischapterisabletofi... Open at page → 63 Page 63 IV.Customers ThissectiondescribesthenumberofACTSusers,theservicecapacity,andthewaysthat NISTinteractswithandsupportsusers. ACTSTelephoneCalls . 1 , , 30000 28000 26000 24000 22000 20000 18000 16000 14000 12000 10000 8000... Open at page → 64 Page 64 daylightsavingtimetostandardtime(thelastSundayinOctober).Therewasalsoalargespike ontheyear2000(Y2K)rolloveronJanuary 1,2000. Itisinterestingtonotethatthenumberof callsduringthesepeakcallingperiodshavedeclinedatalinearrat... Open at page → 65 Page 65 V.MeasurementUncertainties Thissectiondiscussesthemeasurement uncertaintiesofthesignalstransmittedbythe ACTSservers,andofthesignalsreceivedbyACTSclients. Italsodiscussesestablishing traceabilitytoUTC(NIST). A.Uncertainti... Open at page → 66 Page 66 C.EstablishingTraceabilitytoUTC(NIST) ACTS isnormallyusedtoestablish traceability toUTC(NIST) fortime-of-day measurements only,althoughtimeintervalmeasurements aresometimesmadeusingACTSasa reference,andevenfrequencymeasu... Open at page → 67 Page 67 Chapter3-time.govWebSites NISTfirstprovidedatime-of-dayclockontheTimeandFrequencyDivisionwebsitein 1997.ThepopularityoftheclockpromptedNISTtocreatetwoseparatewebsitesdedicatedto presentingthecurrenttime-of-dayusingthetim... Open at page → 68 Page 68 I.PhysicalDescriptionoftime.govWebSites Thetime.govandnist.time.govwebsitesarehostedonwebserversmaintained in Boulder,ColoradobytheInformationTechnologyLaboratory(ITL)ofNIST.Thewebsites provideatime-of-dayclockdisplay(us... Open at page → 69 Page 69 Pleaseclickatimezone PRlUfiCYSTfiTEMENTaSECURITYNOTICE DISHELE JfiVflRNIMftTION Figure11.Thetimezonemapdisplayedbythetime.govwebsite. C.time.govWebSiteFacilities Thetime.govwebsitesarehostedonwebserversmaintained inenvir... Open at page → 70 Page 70 II.TechnicalDescriptionoftime.govWebSites Thissectionsummarizesthetechnicaloperationofthetime.govwebsites,includinga discussionofthehardwareusedandtheserverandclientsoftware. A.TechnicalDescriptionofHardware Thetime.govw... Open at page → 71 Page 71 IndianaareareasthatdonotobserveDST.The "-5" indicatesthatthereisa5hourtimeoffset betweenEasternstandardtimeandUTC.TheHTMLcodeattemptstodeterminewhetherthe client'swebbrowsersupportsJava.Ifitdoes,theword"java"isincludedwi... Open at page → 72 Page 72 Thetimeuncertaintyofthedisplayisroughlyequaltotheamountoftimerequiredto comparetheserverandclientclocks.Thisincludesthetimeittakesfortheapplettocallthe timeserver,querytheuser'scomputerclock,convertthestringstotimesincet... Open at page → 73 Page 73 Iftheclient'swebbrowserisleftopenwhileconnectedtothesite,thetime-of-daywill becontinuouslydisplayed.TheJavaappletmakesanewtimerequestevery10minutes,and resynchronizes thetime-of-daydisplay.Theprocessisalsostartedoverifth... Open at page → 74 Page 74 III. OperationalProceduresoftime.govWebSites Thissectiondiscussesthehardwareandsoftwaremaintenancerequiredbythetime.gov websites. Italsodiscussesthefailuremodesandsecurityissues. A.HardwareMaintenance Thewebserverandoper... Open at page → 75 Page 75 D.RecordKeeping Informationpertaining totheservice,includingdocumentation ofsoftwarechanges, systemmaintenance,outages,andsoforth,isarchivedatNISTforatleastseveralyears. E.SecurityIssues Thissectiondiscussesthesecurityof... Open at page → 76 Page 76 mindthatthemetrictypicallyusedtostatethepopularityofawebsiteispageviews,orthe numberofpagesdisplayedbyasite.Ifpageviewswereshownonthegraphinsteadoftime requests,thenumberswouldprobablybehigherbyafactoroftwoormore,sincemo... Open at page → 77 Page 77 V.MeasurementUncertainties Thissectiondiscussesthemeasurement uncertaintiesofthesignalstransmittedbythe time.govservers,andofthesignalsreceivedbythetime.govclients. Italsorecommendsthatthe time.govsignalsshouldnotbeusedt... Open at page → 78 Page 78 [Si ^ n Open at page → 79 Page 79 CitedReferences [I] Postel,J.Daytimeprotocol.NetworkWorkingGroupReportRFC-867.USCInformation SciencesInstitute;1983May. [2] Postel, J.Timeprotocol.NetworkWorkingGroupReportRFC-868.USCInformation SciencesInstitute;1983May... Open at page → 80 Page 80 [14] Anderson,RossJ.;Harris,GeorgiaL.SpecificationsandTolerancesforFieldStandard Stopwatches. Natl.Inst.Stand.Technol.105-5;1997October.10p. [15]Sullivan,D.B.ACTSsetscomputertimeandmuchmore.BroadcastEngr.;112-116,1989 No... Open at page → 81 Page 81 Mills,D.L.InternetTimekeepingAroundtheGlobe.Proc,29thPreciseTimeandTimeInterval PlanningandApplicationsMeeting(PTTI),LongBeach,CA.1997December.365-371. Monington,K.E.;Levine J.PrinciplesofInternetTimeSynchronization. Pro... Open at page → 83 Page 83 TechnicalPublications Periodical JournalofResearchoftheNationalInstituteofStandardsandTechnology—ReportsNISTresearch anddevelopmentinthosedisciplinesofthephysicalandengineeringsciencesinwhichtheInstituteis active.Thesein... Open at page →