4.2 Global clock synchronization

Global clock synchronization is a key component in Amazon Sidewalk security. Each device in the network shall have its clock synchronized with the Amazon Sidewalk Cloud. The synchronized clock is the base for encrypted messages between Endpoints and the cloud. Devices that do not have a valid time synchronization can only exchange time synchronization commands with the Amazon Sidewalk Cloud.

The absolute time clock used in Amazon Sidewalk is Global Positioning System (GPS) Epoch time in seconds. The source of the correct time value is the Amazon Sidewalk Cloud. GCS time is verified by CMAC authentication between the Gateway and the Endpoint. For more information, see figure 4.4.

The Gateway’s clock is synchronized by exchanging GET_TIME / RESP_TIME messages using an encrypted tunnel to the Network server. For more information, see section 8.1 and section 4.2. An Endpoint in synchronous mode that has successfully finished the Beacon discovery process uses an uplink slot to send a GET_TIME command with a counter-based CMAC. An Endpoint in asynchronous mode sends a GET_TIME command after initialization. The GET_TIME command is received by the Gateway and forwarded by the Gateway plugin to the Network Server. The Network Server decodes and verifies the GET_TIME command. If the Network Server successfully verified the GET_TIME command the Network server returns a Notify command to the Gateway. The Notify Command from the Network Server contains a flex counter-based CMAC. The Gateway builds a RESP_TIME response command with the Gateway’s GCS time. The data frame containing the RESP_TIME response command is encrypted with a counter-based CMAC and sent back to the Endpoint. If the Endpoint successfully received the RESP_TIME response command, the Endpoint synchronizes its own clock with the Gateway’s clock source. Further data exchange uses GCS time-based security procedures.

fig 4.4 GCS WAN message sequence

Application commands used for the time synchronization are: GET_TIME, RESP_TIME. For more information on GET_TIME and RESP_TIME formats, see section 4.2. End-to-end communications that use time synchronization commands shall use keys that are generated as follows:

1. If the Endpoint clock is not synchronized, the counter is used to generate keys.
2. If the Endpoint clock is synchronized, the Endpoint time is used to generate keys.

For more information on key management and key rotation see: section 4.4. For more information on encrypted messaging see section 4.7.

Configuration parameters of the time synchronization operations are:

1. gcs_ret_num - the value indicates the number of subsequent GET_TIME commands that may be sent with the first gcs_resp_timeout interval value if the RESP_TIME command is not received. When gcs_ret_num is reached then gcs_resp_timeout is increased.

   gcs_ret_num = 3

2. gcs_resp_timeout - the time interval that an Endpoint shall wait for a RESP_TIME command. The gcs_resp_timeout value is constant until the count of transmitted GET_TIME commands is less than or equal to gcs_ret_num. When the count of transmitted GET_TIME commands reaches gcs_ret_num, then the interval between subsequent GET_TIME commands is increased up to a defined maximum value. If the RESP_TIME is not received and gcs_resp_timeout reaches the maximum value then a GET_TIME command shall be sent at the maximum defined interval until the RESP_TIME command is received.

   gcs_resp_timeout the first interval until gcs_ret_num is reached is 30 s, and then the timeout value is 3 min, then 5 min, then 8 min, then 10 min, then 15 min.

3. gcs_sync_int - the value indicates the frequency of sending GET_TIME command for the clock synchronization maintenance

   gcs_sync_int = 2 h

The clock shall be synchronized with the Amazon Sidewalk Cloud in the following cases:

1. The device is powered on or reset. Time synchronization shall be done as soon as possible. SubG-CSS, and SubG-FSK devices synchronize the clock at different points in time as follows:

   1. A SubG-CSS device shall synchronize the clock after the protocol stack is on so that transmit and receive are possible
   2. A SubG-FSK device shall synchronize the clock after the protocol stack is on, and after Beacon synchronization is achieved. NOTE: Clock synchronization could happen on other PHYs prior to the SubG-FSK Beacon synchronization.

   For flow charts of all procedures from the Amazon Sidewalk application viewpoint, see Chapter 8.

2. Maintenance of the correct clock value on a device side. The device shall synchronize the clock frequently at an interval of gcs_sync_int. Frequent clock synchronization is required because oscillator drift can cause the device’s clock to float away from the Amazon Sidewalk network clock. The clock drift on the device side shall be less than +/- gcs_clock_drift seconds. When the time drift value received in RESP_TIME is greater than the time drift of the Endpoint then the Endpoint shall not update its clock value.

   gcs_clock_drift = 60 s

For values of gcs_ret_num, gcs_resp_timeout, gcs_sync_int and gcs_clock_drift see Appendix B.3.

---