Financial transactions, telecommunications networks, power grids, cloud services, aviation and defense as well as industrial control systems all rely on accurate time synchronization. When clocks drift, mobile networks start to have interference and eventually fail, power grids will start tripping and cause blackouts, production lines will get jammed, databases will be corrupted and more.

For decades, organizations have relied on technologies such as GPS and the Network Time Protocol (NTP) to synchronize time across distributed systems. Because these technologies are so widely used, many assume that accurate and reliable timing is simply a given.

However, when we started looking more closely at the topic we noticed a lot of accuracy, dependability, and sovereignty issues with the global time synchronization infrastructure. In fact, the majority of time synchronization systems are directly dependent on global navigation satellite systems (GNSS) such as GPS and Galileo.

And what we saw is that these systems can be jammed – see the map for a snapshot of the red zones. But jamming is not the only issue, there can be spoofing of GPS information resulting in transmitting false timing information to actually shift our timing. But the risk, of course, is not only that our clocks are wrong. The same timing signals help keep parts of our communications networks, financial systems, and power grids in sync.

This realization was the beginning of this research where we looked at ways to safeguard time synchronization by making use of SCION properties.

The hidden challenge of network timing

Traditional Internet routing has what is referred to as path asymmetry caused by hot potato routing. That means the reverse path often goes over a different link and in many cases even a different sequence of autonomous systems. The forward and backward directions then take noticeably different amounts of time.

Time synchronization protocols such as NTP and PTP assume both directions take equally long (symmetric paths). When they do not, half the difference ends up in an erroneous clock correction, and nothing in the protocol can detect it: the measurement is well-formed but wrong. Variable queueing in routers adds noise on top.

This is also why authentication is not enough. An attacker who delays packets shifts the clock without altering the transferred bytes, and no amount of cryptography can help here. The only defence is control over the path.

This is one reason why organizations with strict timing requirements have historically relied on dedicated networks or leased lines, sacrificing flexibility in exchange for full control and predictability.

How SCION supports dependable timing

SCION introduces a fundamentally different networking model that offers new possibilities for secure and precise time synchronization.

One of SCION’s unique capabilities is path control. Unlike the traditional Internet, SCION allows senders to control the paths through which their data passes.

When a packet reaches its destination, the receiver can use the path information embedded in the packet header to send traffic back over the same inter-domain route. This significantly improves path symmetry compared to conventional Internet routing.

More important is that the sender can use several paths at once. SCION exposes the path diversity that ordinary routing leaves unused, so a client can reach the same server over many paths in parallel and choose them deliberately. The client can prefer paths that are short, since every additional hop is another point where queueing can skew measurements, and paths that are disjoint, since paths with little overlap are more likely to fail independently and an attacker on one path cannot influence traffic on the others. Each path then yields its own measurement of the same reference time. Where a single measurement has to be trusted, a set of them can be compared, and the ones disagreeing with the rest are filtered out. A path under attack, a congested link, or a malfunctioning server is outvoted rather than blindly trusted.

From research to reality: Clockwire

Clockwire is the practical implementation of these ideas by the Network Security Group at ETH Zurich, and the step from research to a dependable software and hardware platform that critical infrastructure can run on. It combines timing information from several reference servers, each accessed concurrently over multiple symmetric SCION paths. A congested link, a failing server, or a capable on-path attacker delaying packets therefore has limited influence, and can be tolerated to a degree the public Internet does not allow.

Clockwire will be released as open source in late 2026, together with a documented reference architecture based on open standards. The aim is not a single product but an ecosystem: components from different manufacturers that interoperate and can be exchanged, reducing both vendor lock-in and supply-chain dependencies.

NetTimeLogic is the first company to take that route. They develop timing equipment for environments where accurate time is critical, and they built SCION support into it at a point when the technology was still at the research stage.

NetTime Logic’s timing devices are designed with redundancy and resilience at their core. They can combine and monitor multiple independent timing sources, including satellite-based systems such as GPS and Galileo as well as network-based synchronization, and can switch between or cross-check these sources when needed. This helps the devices detect failures or inconsistencies and continue providing reliable time even when an individual source, network path, or external reference becomes unavailable. High-performance oscillators provide additional protection during longer outages, enabling holdover accuracy of better than one microsecond over 48 hours and allowing precise synchronization to be maintained until a reliable external reference becomes available again.

Clockwire: Pilot deployment in Swiss ISD

As Clockwire moves toward production quality, two pilots provide the real-world environments for refining the design and implementation. The first is with SIDN Labs, which operates the Dutch time service time.nl and was an early adopter of SCION, a combination that made it a natural first partner. A Clockwire server there runs on a virtual machine and takes its reference from SIDN’s timing backbone. Clients at ETH Zurich reach it over up to eight paths provided by the research networks Switch, GÉANT and SURF.

The second deployment is based on Switzerland’s official time. METAS, the Federal Institute of Metrology, distributes UTC(CH) over a fibre network it runs together with Switch, and a dedicated line carries that reference to ETH Zurich, from where Clockwire serves it into the Swiss SCION production network.

A deployment at Frankfurter Bankgesellschaft in Zurich will run the NetTimeLogic’s timing hardware described above and reach ETH over more than 500 distinct paths.

The Cyber-Defence Campus of armasuisse adds further evaluation sites in Zurich, Thun and Lausanne. This is the pilot that will tell us how closely SCION-based time distribution can approach single-digit microseconds on production networks with production hardware.

The future of trusted time

As critical infrastructure becomes increasingly interconnected, timing will become even more important.

The discussion around digital sovereignty often focuses on cloud providers, data storage, and network connectivity. Yet time itself is also a strategic dependency.

Organizations that want resilient and sovereign digital infrastructure must start treating time synchronization as a critical service rather than an invisible utility.

By combining secure path-aware networking with intelligent timing systems, SCION opens the door to a new generation of trustworthy time infrastructure – one that is accurate, more resilient, and less dependent on vulnerable external systems.

Because when every microsecond matters, trusting the network is not enough. We must also be able to trust time itself.