System and method for providing security for master clocks

Abstract

Embodiments describe monitoring network activity and behavior of authorized clocks to identify suspicious activity, and in response, removing a clock for an authorized clock list. In one embodiment, a network monitor detects changes in profiles corresponding to the authorized clocks such as a disconnecting from a port, changing a network location, unexpected changes in the clock signal, changes to the clock ID or MAC address, and the like. If the network monitor deems these changes suspicious, it removes the clock from the authorized clock list. When the current master clock fails, the PTP endpoints select a new master clock only if that clock is included in the authorized clock list. In this manner, the network monitor can constantly update the authorized clock list to ensure it contains only clocks that have not been tampered with or replaced with rogue clocks.