Document Open Access Logo

Schedule-Based Attack Against TSN TAS with Frame Preemption

Authors Omolade Ikumapayi , Vijay Banerjee , Sena Hounsinou , Gedare Bloom

PDF

File

Thumbnail PDF
PDF
LIPIcs.ECRTS.2026.12.pdf
  • Filesize: 1.85 MB
  • 23 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Security and privacy → Network security
  • Computer systems organization → Real-time system architecture
Keywords
  • schedule-based attack
  • time-sensitive networking
  • real-time system
  • adversarial blocking

Metrics

Abstract

Time-Sensitive Networking (TSN) achieves deterministic communication using mechanisms like Time-Aware Shaping, which manages the timing of network traffic streams using a Gate Control List (GCL). The GCL operates according to a cyclic schedule by opening and closing gates for priority (egress) queues in out-bound ports. However, the cyclic schedule in the GCL introduces potential security vulnerabilities to schedule-based attacks. This type of attack exploits TSN’s deterministic schedules to manipulate traffic flow and can impact availability and safety. Traditional intrusion detection systems (IDS) are commonly employed in TSN to detect malicious activities by monitoring traffic patterns and bandwidth usage. However, schedule-based attacks can align malicious packets with legitimate traffic, making the attack more stealthy and harder to detect by rate-based IDS. This paper presents a novel schedule-based attack that synchronizes malicious traffic to exploit predictability in TSN’s GCL schedule. This attack causes an adversarial blocking in which low-priority traffic delays higher-priority traffic without being detected using a rate-based IDS. We demonstrate the feasibility and impact of this schedule-based attack on TSN with off-the-shelf hardware.

Cite As Get BibTex

Omolade Ikumapayi, Vijay Banerjee, Sena Hounsinou, and Gedare Bloom. Schedule-Based Attack Against TSN TAS with Frame Preemption. In 38th European Conference on Real-Time Systems (ECRTS 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 375, pp. 12:1-12:23, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ECRTS.2026.12

Author Details

Omolade Ikumapayi
  • University of Colorado, Colorado Springs, CO, USA
Vijay Banerjee
  • Washington State University, Pullman, WA, USA
Sena Hounsinou
  • Metro State University, St Paul, MN, USA
Gedare Bloom
  • University of Colorado, Colorado Springs, CO, USA

Funding

This work is supported by NSF CNS-2046705 and Colorado Bill SB18-086.

References

  1. Mohammad Ashjaei, Mikael Sjödin, and Saad Mubeen. A novel frame preemption model in tsn networks. Journal of Systems Architecture, 116:102037, 2021. URL: https://doi.org/10.1016/J.SYSARC.2021.102037.
  2. Vijay Banerjee, Sena Hounsinou, Yanyan Zhuang, Monowar Hasan, and Gedare Bloom. On evading randomization-based defense in hierarchical real-time systems. ACM Trans. Cyber-Phys. Syst., 10(2), 2026. URL: https://doi.org/10.1145/3783983.
  3. Sanjoy Baruah, Pontus Ekberg, Mehdi Hosseinzadeh, Ao Li, Bryan Ward, and Ning Zhang. Who’s Afraid of Butterflies? A Close Examination of the Butterfly Attack. In 2023 IEEE Real-Time Systems Symposium (RTSS), pages 53-63, 2023. ISSN: 2576-3172. URL: https://doi.org/10.1109/RTSS59052.2023.00015.
  4. Lucia Lo Bello, Mohammad Ashjaei, Gaetano Patti, and Moris Behnam. Schedulability analysis of time-sensitive networks with scheduled traffic and preemption support. Journal of Parallel and Distributed Computing, 144:153-171, 2020. URL: https://doi.org/10.1016/J.JPDC.2020.06.001.
  5. Daniel Bujosa, Julian Proenza, Alessandro V Papadopoulos, Thomas Nolte, and Mohammad Ashjaei. An improved worst-case response time analysis for avb traffic in time-sensitive networks. In 2024 IEEE Real-Time Systems Symposium (RTSS), pages 135-147. IEEE, 2024. URL: https://doi.org/10.1109/RTSS62706.2024.00021.
  6. Nurefşan Sertbaş Bülbül and Mathias Fischer. Preemptive DoS attacks on Time Sensitive Networks. In GLOBECOM 2023-2023 IEEE Global Communications Conference, pages 4289-4294. IEEE, 2023. URL: https://doi.org/10.1109/GLOBECOM54140.2023.10437837.
  7. Chien-Ying Chen, Amiremad Ghassami, Stefan Nagy, Man-Ki Yoon, Sibin Mohan, Negar Kiyavash, Rakesh B Bobba, and Rodolfo Pellizzoni. Schedule-based side-channel attack in fixed-priority real-time systems. Technical report, University of Illinois Urbana-Champaign, 2015. Google Scholar
  8. Doğanalp Ergenç, Cornelia Brülhart, Jens Neumann, Leo Krüger, and Mathias Fischer. On the security of ieee 802.1 time-sensitive networking. In 2021 IEEE International Conference on Communications Workshops (ICC Workshops), pages 1-6. IEEE, 2021. URL: https://doi.org/10.1109/ICCWORKSHOPS50388.2021.9473542.
  9. Doğanalp Ergenç, Robin Schenderlein, and Mathias Fischer. Tsnzeek: An open-source intrusion detection system for ieee 802.1 time-sensitive networking. In 2023 IFIP Networking Conference (IFIP Networking), pages 1-6. IEEE, 2023. URL: https://doi.org/10.23919/IFIPNETWORKING57963.2023.10186421.
  10. Florian Fischer and Dominik Merli. Security considerations for ieee 802.1 time-sensitive networking in converged industrial networks. In 2022 International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME), pages 1-7. IEEE, 2022. URL: https://ieeexplore.ieee.org/abstract/document/9988000/.
  11. Mahdi Fotouhi, Alessio Buscemi, Abdelwahab Boualouache, Florian Jomrich, Christian Koebel, and Thomas Engel. Assessing the impact of attacks on an automotive ethernet time synchronization testbed. In 2023 IEEE Vehicular Networking Conference (VNC), pages 223-230. IEEE, 2023. URL: https://doi.org/10.1109/VNC57357.2023.10136275.
  12. Sena Hounsinou, Mark Stidd, Uchenna Ezeobi, Habeeb Olufowobi, Mitra Nasri, and Gedare Bloom. Vulnerability of controller area network to schedule-based attacks. In 2021 IEEE Real-Time Systems Symposium (RTSS), pages 495-507, 2021. URL: https://doi.org/10.1109/RTSS52674.2021.00051.
  13. Omolade Ikumapayi, Paul Agbaje, Yanyan Zhuang, Habeeb Olufowobi, and Gedare Bloom. Deadline-based class assignment for time-sensitive network frame preemption. In Proceedings of the IEEE International Conference on Industrial Technology (ICIT). IEEE, 2024. Google Scholar
  14. Omolade Ikumapayi, Vijay Banerjee, Sena Hounsinou, and Gedare Bloom. Work-in-progress: Vulnerability of tsn tas with frame preemption to schedule-based attack. In 2025 IEEE Real-Time Systems Symposium (RTSS), pages 632-635. IEEE, 2025. URL: https://doi.org/10.1109/RTSS66672.2025.00065.
  15. Sina Yari Karin, Hakan Aydin, Dakai Zhu, Steven Drager, and Matthew Anderson. Impact of priority assignment on schedule-based attacks in real-time embedded systems. Journal of Systems Architecture, 145:103021, 2023. URL: https://doi.org/10.1016/J.SYSARC.2023.103021.
  16. Ao Li, Marion Sudvarg, Han Liu, Zhiyuan Yu, Chris Gill, and Ning Zhang. PolyRhythm: Adaptive Tuning of a Multi-Channel Attack Template for Timing Interference. In 2022 IEEE Real-Time Systems Symposium (RTSS), pages 225-239, 2022. ISSN: 2576-3172. URL: https://doi.org/10.1109/RTSS55097.2022.00028.
  17. Mitra Nasri, Thidapat Chantem, Gedare Bloom, and Ryan M. Gerdes. On the pitfalls and vulnerabilities of schedule randomization against schedule-based attacks. In 2019 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS), pages 103-116, 2019. URL: https://doi.org/10.1109/RTAS.2019.00017.
  18. NXP Semiconductors. Real-Time Edge User Guide, 2024. URL: https://www.nxp.com/docs/en/user-guide/REALTIMEEDGEUG.pdf.
  19. R. Ramaswamy, Ning Weng, and T. Wolf. Characterizing network processing delay. In IEEE Global Telecommunications Conference, 2004. GLOBECOM '04., volume 3, pages 1629-1634 Vol.3, 2004. URL: https://doi.org/10.1109/GLOCOM.2004.1378257.
  20. Deep Shrestha, Zhibo Pang, and Dacfey Dzung. Precise clock synchronization in high performance wireless communication for time sensitive networking. IEEE Access, PP:1-1, February 2018. URL: https://doi.org/10.1109/ACCESS.2018.2805378.
  21. Soc-e. Time-sensitive networking (tsn) in the electric sector: Security, 2018. Accessed: 2024-02-12. URL: https://soc-e.com/wp-content/uploads/2018/04/security_SAS_TSN-180405.pdf.
  22. Daniel Thiele and Rolf Ernst. Formal worst-case performance analysis of time-sensitive ethernet with frame preemption. In 2016 IEEE 21st International Conference on Emerging Technologies and Factory Automation (ETFA), pages 1-9. IEEE, 2016. URL: https://doi.org/10.1109/ETFA.2016.7733740.
  23. Daniel Thiele, Rolf Ernst, and Jonas Diemer. Formal worst-case timing analysis of ethernet tsn’s time-aware and peristaltic shapers. In 2015 IEEE Vehicular Networking Conference (VNC), pages 251-258. IEEE, 2015. URL: https://doi.org/10.1109/VNC.2015.7385584.
  24. Mustafa Topsakal and Selcuk Cevher. Impact analysis of denial of service attacks in ieee 802.1 time sensitive networking. In 2022 30th Signal Processing and Communications Applications Conference (SIU), pages 1-4. IEEE, 2022. URL: https://doi.org/10.1109/SIU55565.2022.9864840.
  25. Marian Ulbricht, Stefan Senk, Hosein K Nazari, How-Hang Liu, Martin Reisslein, Giang T Nguyen, and Frank HP Fitzek. Tsn-flextest: Flexible tsn measurement testbed. IEEE Transactions on Network and Service Management, 21(2):1387-1402, 2023. URL: https://doi.org/10.1109/TNSM.2023.3327108.
  26. Man-Ki Yoon, Sibin Mohan, Chien-Ying Chen, and Lui Sha. Taskshuffler: A schedule randomization protocol for obfuscation against timing inference attacks in real-time systems. In 2016 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS), pages 1-12. IEEE, 2016. Google Scholar
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact