Method to securely initialize, protect and recover system date/time

• US 20070143462A1
• Filed: 12/20/2005
• Published: 06/21/2007
• Est. Priority Date: 12/20/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Daverman, Kurt, Xu, Zhangwei, Lopez-Barquilla, Ricardo, Ahdout, Isaac, Venkatachalam, Rajagopal
• Granted Patent: US 8,190,923 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/725 operating on a secure reference time value

Abstract

The claimed method and system monitors computer system timer(s) relative to other timers to detect discrepancies and/or may capture an offset to provide a method of more accurately determining a current time. The invention may also provide a method to detect power source tampering using a last known good time and may provide a means to securely initialize system time using an encrypted time stamp.

Claims

1. A method of protecting a timer on a computer system from being improperly adjusted comprising:

establishing a baseline value for at least one timer on the computer system;

monitoring the computer system for a timer anomaly that indicates a possible improper timer adjustment; and

imposing a sanction if a timer anomaly is detected.

2. The method of claim 1, wherein establishing a baseline value comprises determining a threshold frequency difference.

3. The method of claim 2, wherein monitoring the computer system for a timer anomaly comprises determining a set of timers in the computer system and measuring a set of frequency differences between the timers in the set of timers.

4. The method of claim 3, wherein a timer anomaly is detected when one of the frequency differences of the set of frequency differences is greater than the threshold.

5. The method of claim 4, wherein determining a set of timers comprises determining all timers in the computer that are capable of affecting a metering program.

6. The method of claim 4, wherein the threshold is periodically recalculated.

7. The method of claim 1, wherein monitoring the computer system for a timer anomaly comprises intercepting a clock adjustment signal that is being transmitted to a timer and wherein establishing a baseline value comprises determining a current clock value when the clock adjustment signal is intercepted.

8. The method of claim 7, further comprising storing an offset that is based on a difference between the current clock value and the clock adjustment signal and allowing the clock adjustment signal to be received by the real time clock when the offset is determined and stored.

9. The method of claim 8, further comprising determining a current actual time based on a current clock value and the stored offset.

10. The method of claim 8, wherein the offset is a cumulative offset that is updated each time a clock adjustment signal is intercepted and processed.

11. The method of claim 1, wherein monitoring the computer system for a timer anomaly comprises determining a last known good time value and storing the last known good time value, and periodically determining a difference between the last known good time value and a current system time value.

12. The method of claim 11, wherein a timer anomaly is detected when the last known good time value is determined to be less than the current time value by a threshold.

13. The method of claim 11, wherein restricting computer functionality comprises limiting computer functionality to inputting and processing an unlock code.

14. The method of claim 13, wherein the unlock code contains a time value for reinitializing a system time.

15. The method of claim 14, further comprising reinitializing the system time based on the time value and unrestricting computer functionality based on a successful validation of the unlock code and successful re-initialization of the system time.

16. The method of claim 11, wherein determining a last known good time comprises obtaining a time value from a secure time server.

17. The method of claim 16, wherein a last known good time value is received upon renewing a subscription.

18. A computer-readable medium having computer-executable instructions for performing operations comprising:

determining a set of timers in a computer;

measuring a set of frequency differences between the timers in the set of timers;

raising an alarm when one of the set of frequency differences is greater than a threshold.

19. A computer system comprising:

a hardware module coupled to a real time clock circuit and having a secure, non-volatile memory, wherein the hardware module provides a register for clock values;

a hardware component that intercepts a clock adjustment signal that is being transmitted to the hardware module, determines a current clock value when the clock adjustment signal is intercepted, and stores an offset in the secure, non-volatile memory, wherein the offset is based on a difference between the current clock value and the clock adjustment signal.

20. The computer system of claim 19, wherein the hardware component is part of the hardware module.