Systems and methods for altering time data

• US 10,592,662 B1
• Filed: 09/13/2017
• Issued: 03/17/2020
• Est. Priority Date: 09/13/2017
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Sobel, William E.
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US15/702,781
• Time in Patent Office: 916 Days
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2125 Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 9/005 for timing attacks

Abstract

The disclosed computer-implemented method for altering time data may include (i) identifying an untrusted executable that is capable of making queries to an operating system of the computing device, (ii) intercepting a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time, (iii) calculating an offset value for the current time that is within a predetermined margin of the current time, and (iv) providing, in response to the request, the untrusted executable with the offset value for the current time instead of the current time. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for altering time data, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying an untrusted executable that is capable of making queries to an operating system of the computing device;

intercepting a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time;

calculating an offset value for the current time that is within a predetermined margin of the current time;

providing, in response to the request, the untrusted executable with the offset value for the current time instead of the current time;

storing the offset value for the current time;

intercepting, at a later time, an additional request by the untrusted executable to query the system clock of the operating system of the computing device for the later time;

calculating, based at least in part on the stored offset value, a new offset value for the later time that is within a predetermined margin of the later time and that comprises an interval between the new offset value and the later time that is not equal to a previous interval that was used to calculate the stored offset value; and

providing, in response to the additional request, the untrusted executable with the new offset value for the later time instead of the later time, thereby preventing the untrusted executable from obtaining accurate system clock information.

2. The computer-implemented method of claim 1, wherein providing the untrusted executable with the offset value for the current time comprises thwarting a potential timing attack attempted by the untrusted executable by providing the untrusted executable with the offset value for the current time instead of the current time.

3. The computer-implemented method of claim 2, wherein thwarting the potential timing attack comprises preventing the untrusted executable from leveraging accurate system clock information to determine an amount of time taken to execute an encryption operation by preventing the untrusted executable from obtaining the accurate system clock information.

4. The computer-implemented method of claim 1, wherein identifying the untrusted executable comprises determining that a reputation rating for the untrusted executable provided by a reputation system falls below a predetermined threshold for trustworthiness.

5. The computer-implemented method of claim 1, wherein identifying the untrusted executable comprises determining that a reputation rating provided by a reputation system for an entity that hosts the untrusted executable falls below a predetermined threshold for trustworthiness.

6. The computer-implemented method of claim 1, wherein intercepting the request by the untrusted executable to query the system clock of the operating system comprises hooking an application programming interface of the operating system in order to intercept requests to the system clock of the operating system.

7. The computer-implemented method of claim 1, wherein calculating the new offset value comprises ensuring that the new offset value does not represent an earlier time than the stored offset value.

8. The computer-implemented method of claim 1, wherein calculating the offset value for the current time comprises calculating a partially randomized value to serve as an interval between the offset value and the current time.

9. A system for altering time data, wherein:

the system comprises;

an identification module, stored in memory, that identifies an untrusted executable that is capable of making queries to an operating system of a computing device;

an interception module, stored in memory, that intercepts a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time;

a calculation module, stored in memory, that calculates an offset value for the current time that is within a predetermined margin of the current time;

a providing module, stored in memory, that provides, in response to the request, the untrusted executable with the offset value for the current time instead of the current time; and

at least one physical processor configured to execute the identification module, the interception module, the calculation module, and the providing module; and

wherein;

the calculation module calculates the offset value for the current time by storing the offset value for the current time;

the interception module intercepts, at a later time, an additional request by the untrusted executable to query the system clock of the operating system of the computing device for the later time;

the calculation module calculates, based at least in part on the stored offset value, a new offset value for the later time that is within a predetermined margin of the later time and that comprises an interval between the new offset value and the later time that is not equal to a previous interval that was used to calculate the stored offset value; and

the providing module provides, in response to the additional request, the untrusted executable with the new offset value for the later time instead of the later time, thereby preventing the untrusted executable from obtaining accurate system clock information.

10. The system of claim 9, wherein the providing module provides the untrusted executable with the offset value for the current time by thwarting a potential timing attack attempted by the untrusted executable by providing the untrusted executable with the offset value for the current time instead of the current time.

11. The system of claim 10, the providing module thwarts the potential timing attack by preventing the untrusted executable from leveraging accurate system clock information to determine an amount of time taken to execute an encryption operation by preventing the untrusted executable from obtaining the accurate system clock information.

12. The system of claim 9, wherein the identification module identifies the untrusted executable by determining that a reputation rating for the untrusted executable provided by a reputation system falls below a predetermined threshold for trustworthiness.

13. The system of claim 9, wherein the identification module identifies the untrusted executable by determining that a reputation rating provided by a reputation system for an entity that hosts the untrusted executable falls below a predetermined threshold for trustworthiness.

14. The system of claim 9, wherein the interception module intercepts the request by the untrusted executable to query the system clock of the operating system by hooking an application programming interface of the operating system in order to intercept requests to the system clock of the operating system.

15. The system of claim 9, wherein the calculation module calculates the new offset value by ensuring that the new offset value does not represent an earlier time than the stored offset value.

16. The system of claim 9, wherein the calculation module calculates the offset value for the current time by calculating a partially randomized value for the offset value.

17. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify an untrusted executable that is capable of making queries to an operating system of the computing device;

intercept a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time;

calculate an offset value for the current time that is within a predetermined margin of the current time;

provide, in response to the request, the untrusted executable with the offset value for the current time instead of the current time;

store the offset value for the current time;

intercept, at a later time, an additional request by the untrusted executable to query the system clock of the operating system of the computing device for the later time;

calculate, based at least in part on the stored offset value, a new offset value for the later time that is within a predetermined margin of the later time and that comprises an interval between the new offset value and the later time that is not equal to a previous interval that was used to calculate the stored offset value; and

provide, in response to the additional request, the untrusted executable with the new offset value for the later time instead of the later time, thereby preventing the untrusted executable from obtaining accurate system clock information.

18. The non-transitory computer-readable medium of claim 17, wherein the one or more computer-readable instructions cause the computing device to provide the untrusted executable with the offset value for the current time by thwarting a potential timing attack attempted by the untrusted executable by providing the untrusted executable with the offset value for the current time instead of the current time.

19. The non-transitory computer-readable medium of claim 18, wherein thwarting the potential timing attack comprises preventing the untrusted executable from leveraging accurate system clock information to determine an amount of time taken to execute an encryption operation by preventing the untrusted executable from obtaining the accurate system clock information.

20. The non-transitory computer-readable medium of claim 17, wherein identifying the untrusted executable comprises determining that a reputation rating for the untrusted executable provided by a reputation system falls below a predetermined threshold for trustworthiness.