  Many critical computing applications rely on secure and dependable time which
is reliably synchronized across large distributed systems. Today's time
synchronization architectures are commonly based on global navigation satellite
systems at the considerable risk of being exposed to outages, malfunction, or
attacks against availability and accuracy. This paper describes a practical
instantiation of a new global, Byzantine fault-tolerant clock synchronization
approach that does not place trust in any single entity and is able to tolerate
a fraction of faulty entities while still maintaining synchronization on a
global scale among otherwise sovereign network topologies. Leveraging strong
resilience and security properties provided by the path-aware SCION networking
architecture, the presented design can be implemented as a backward compatible
active standby solution for existing time synchronization deployments. Through
extensive evaluation, we demonstrate that over 94% of time servers reliably
minimize the offset of their local clocks to real-time in the presence of up to
20% malicious nodes, and all time servers remain synchronized with a skew of
only 2 ms even after one year of reference clock outage.
