Method to securely initialize, protect and recover system date/time

• US 8,190,923 B2
• Filed: 12/20/2005
• Issued: 05/29/2012
• Est. Priority Date: 12/20/2005
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Daverman, Kurt, Xu, Zhangwei, Ahdout, Isaac P., Lopez-Barquilla, Ricardo, Venkatachalam, Rajagopal K.
• Primary Examiner(s): Moazzami, Nasser
• Assistant Examiner(s): McNally, Michael S
• Application Number:
  US11/312,021
• Publication Number:
  US 20070143462A1
• Time in Patent Office: 2,352 Days
• Field of Search: 713/194
• US Class Current: 713/194
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/725 operating on a secure reference time value

Abstract

The claimed method and system monitors computer system timer(s) relative to other timers to detect discrepancies and/or may capture an offset to provide a method of more accurately determining a current time. The invention may also provide a method to detect power source tampering using a last known good time and may provide a means to securely initialize system time using an encrypted time stamp.

Claims

1. A method of protecting a timer on a pay for use computer system from being improperly adjusted, the method comprising:

establishing a baseline value for at least one timer on the pay for use computer system wherein a user pays for a time period of use of the computer system;

determining threshold frequency differences;

monitoring the pay for use computer system for a timer anomaly that indicates a possible improper timer adjustment by;

determining a set of timers in the computer system;

including the at least one timer;

periodically obtaining current operating frequencies of each of the timers, respectively;

repeatedly computing a current set of frequency differences by computing a difference between each of the current operating frequencies of the respective timers such that the current set of frequency differences includes a frequency difference between each timer and every other timer;

detecting a timer anomaly by repeatedly comparing the frequency differences in the current set of frequency differences against the threshold frequency differences, respectively, and determining that a timer anomaly has occurred when one of the threshold frequency differences is exceeded by a corresponding current frequency difference;

imposing a sanction if the timer anomaly is detected wherein the sanction comprises limiting functionality of the computer system and leaving the computer system in a reduced functioning operating state.

2. The method of claim 1, wherein determining a set of timers comprises determining all timers in the computer that are capable of affecting a metering program.

3. The method of claim 1, wherein the threshold is periodically recalculated.

4. The method of claim 1, wherein monitoring the computer system for a timer anomaly comprises intercepting a clock adjustment signal that is being transmitted to a timer and wherein establishing a baseline value comprises determining a current clock value when the clock adjustment signal is intercepted.

5. The method of claim 4, further comprising storing an offset that is based on a difference between the current clock value and the clock adjustment signal and allowing the clock adjustment signal to be received by the real time clock when the offset is determined and stored.

6. The method of claim 5, further comprising determining a current actual time based on a current clock value and the stored offset.

7. The method of claim 5, wherein the offset is a cumulative offset that is updated each time a clock adjustment signal is intercepted and processed.

8. The method of claim 1, wherein monitoring the computer system for a timer anomaly comprises determining a last known good time value and storing the last known good time value, and periodically determining a difference between the last known good time value and a current system time value.

9. The method of claim 8, wherein a timer anomaly is detected when the last known good time value is determined to be less than the current time value by a threshold.

10. The method of claim 8, wherein determining a last known good time comprises obtaining a time value from a secure time server.

11. The method of claim 10, wherein a last known good time value is received upon renewing a subscription.

12. The method of claim 1, wherein the sanction further comprises limiting computer functionality to inputting and processing an unlock code.

13. The method of claim 12, wherein the unlock code contains a time value for reinitializing a system time.

14. The method of claim 13, further comprising reinitializing the system time based on the time value and unrestricting computer functionality based on a successful validation of the unlock code and successful re-initialization of the system time.

15. A computer-readable storage medium, wherein the computer-readable storage medium is not a signal, physically configured to store computer-executable instructions for performing operations comprising:

determining a set of timers in a computer system;

establishing a baseline value for at least one timer on the computer system comprising determining a threshold frequency difference;

monitoring the computer system for a timer anomaly that indicates a possible improper timer adjustment, the monitoring comprising;

repeatedly measuring a set of frequency differences between the timers in the set of timers by obtaining operating frequencies of the timers and subtracting the operating frequencies, the operating frequencies comprising clock frequencies of the timers;

repeatedly comparing the frequency differences against the threshold frequency difference to detect when the threshold frequency difference has been exceeded, and when so detected determining that a timer anomaly has occurred;

issuing signal responsive to the determining that a timer anomaly has occurred;

in response to the signal, operating the computer system in a reduced functioning state wherein the computer system is still operable by a user but with reduced functionality.