Trusted real time clock

• US 20040128528A1
• Filed: 12/31/2002
• Published: 07/01/2004
• Est. Priority Date: 12/31/2002
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Poisner, David I.
• Application Number:
  US10/334,267
• Publication Number:
  US 20040128528A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 1/14 Time supervision arrangements, e.g. real time clock
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/725 operating on a secure reference time value

Abstract

Methods, apparatus and computer readable medium are described that attempt increase trust in a wall time provided by a real time clock. In some embodiments, a detector detects activities that may be associated with attacks against the real time clock. Based upon whether the detector detects a possible attack against the real time clock, the computing device may determine whether or not to trust the wall time provided by the real time clock.

Claims

1. For use with a real time clock that keeps a wall time, a method comprising

detecting a possible attack against the real time clock, and

updating a status store to indicate a possible attack against the real time clock.

2. The method claim 1 further comprising detecting a possible attack against the real time clock in response to determining that one or more electrical characteristics of power received from a battery associated with the real time clock has a predetermined relationship to one or more predetermined electrical characteristics.

3. The method of claim 1 further comprising detecting a possible attack against the real time clock in response to detecting one or more accesses to an interface of the real time clock that may alter the wall time kept by the real time clock.

4. The method of claim 1 further comprising detecting a possible attack against the real time clock in response to detecting a frequency of an oscillator associated with the real time clock has a predetermined relationship to a predetermined range.

5. The method of claim 1 further comprising

activating a bit of the status store in response to detecting a possible attack against the real time clock, and

preventing untrusted code from deactivating the bit of the status store.

6. The method of claim 1 further comprising

updating a count of a counter of the status store in response to detecting a possible attack against the real time clock, and

preventing untrusted code from altering the count of the counter.

7. The method of claim 1 further comprising determining that a possible attack has not occurred in response to determining that an adjustment of the wall time has a predetermined relationship to a predetermined range.

8. The method of claim 1 further comprising determining that a possible attack has occurred in response to determining that more than a predetermined number of adjustments have been made to the wall time.

9. The method of claim 1 further comprising determining that a possible attack has occurred in response to determining that an adjustment to the wall time of the real time clock changed a date of the wall time.

10. A chipset comprising

a real time clock to keep a wall time,

a status store to indicate whether a possible attack against the real time clock was detected, and

a detector to detect a possible attack against the real time clock and to update the status store based upon whether a possible attack against real time clock was detected.

11. The chipset of claim 10 wherein the detector detects a possible attack against the real time clock in response to determining that one or more electrical characteristics of power received from a battery associated with the real time clock has a predetermined relationship to one or more predetermined electrical characteristics.

12. The chipset of claim 10 wherein

the real time clock comprises an interface to program the wall time, and

the detector detects a possible attack against the real time clock in response to detecting one or more programming accesses to the interface of the real time clock.

13. The chipset of claim 10 wherein

the real time clock keeps the wall time based upon an oscillating signal received from an external oscillator, and

the detector detects a possible attack against the real time clock in response to detecting a frequency of the oscillating signal has a predetermined relationship to a predetermined range.

14. The chipset of claim 10 wherein

the status store comprises a sticky bit that retains its value during a system reset and a system power down and that after being activated may only be deactivated by a trusted code of a security enhanced environment, and

the detector activates the sticky bit of the status store in response to detecting a possible attack against the real time clock.

15. The chipset of claim 10 wherein

the status store comprises a counter comprising a plurality of sticky bits that retain their value during a system reset and a system power down and that may only be updated by the detector and trusted code of a security enhanced environment, and

the detector updates the counter of the status store in response to detecting a possible attack against the real time clock.

16. A computing device comprising

memory to store a plurality of instructions,

a real time clock to provide a wall time,

a processor to obtain the wall time from the real time clock in response to processing the plurality of instructions, and

a detector to indicate to the processor whether a possible attack against the real time clock has been detected.

17. The computing device of claim 16 further comprising a status store to indicate whether a possible attack against the real time clock was detected, wherein the detector updates the status store to indicate a possible attack against the real time clock.

18. The computing device of claim 16 further comprising a sticky bit to indicate whether a possible attack against the real time clock was detected, wherein the detector activates the sticky bit to indicate a possible attack against the real time clock.

19. The computing device of claim 18 wherein the sticky bit is located in a security enhanced space that prevents untrusted code from deactivating the sticky bit.

20. The computing device of claim 16 further comprising an external oscillator to provide the real time clock with an oscillating signal, wherein

the real time clock keeps the wall time based upon the oscillating signal of the external oscillator, and

the detector indicates a possible attack against the real time clock in response to determining that a frequency of the oscillating signal has a predetermined relationship to a predetermined range.

21. A machine-readable medium comprising a plurality of instructions that in response to being executed result in a computing device

determining that an attack against a real time clock of the computing device has been detected, and

responding to the attack against the real time clock.

22. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device responding to the attack by requesting an interested party to confirm that a wall time of the real time clock is correct.

23. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device responding to the attack by preventing access to time-sensitive data.

24. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device responding to the attack by preventing time-sensitive operations.

25. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device determining that an attack has been detected based upon whether a status bit associated with the real time clock has been activated.

26. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device determining that an attack has been detected based upon whether a counter associated with the real time clock has an expected count value.

27. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device determining that an attack has been detected based upon a status store associated with the real time clock and a trust policy.

28. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device determining that an attack has not been detected in response to determining that an adjustment of the wall time of the real time clock has a predetermined relationship to a predetermined range.

29. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device determining that an attack has been detected in response to determining that more than a predetermined number of adjustments have been made to the wall time of the real time clock.

30. The machine-readable medium of claim 21 wherein the plurality of instructions further result in the computing device determining that an attack has been detected in response to determining that an adjustment to the wall time of the real time clock changed a date of the wall time.