Client/server based secure timekeeping system

• US 5,444,780 A
• Filed: 07/22/1993
• Issued: 08/22/1995
• Est. Priority Date: 07/22/1993
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hartman, Robert C. Jr.
• Primary Examiner(s): Cangialosi, Salvatore
• Application Number:
  US08/096,132
• Time in Patent Office: 761 Days
• Field of Search: 375/1, 380/25, 380/30, 380/23
• US Class Current: 380/30
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A client/server-based secure timekeeping computer system is provided. A secure-time server which is located in a physically trusted environment, includes a highly accurate time-of-day (TOD) clock, along with a key storage area containing a table of public/private key pairs corresponding to clients in the client/server network. The server encrypts a current time value from its TOD clock using a private key corresponding to a selected client. The encrypted time value is then sent to the client over an open communications channel. Each client in the network is equipped with its own secure timekeeping facility housed within the secure boundaries of a single, tamper-proof VLSI chip. Upon receipt of a secure-time transmission, a client uses its own copy of its private key to decrypt the time value, then loads the decrypted time value into its TOD clock. The tamper-proof VLSI chip in each client also includes an authenticated-time indicator, which is set to TRUE to indicate that the TOD clock contains a trusted time. Programs that require secure time may clock the authenticated time indicator before executing and may cancel execution if a secure time is not available. Programs that do not require secure time are able to execute regardless. To maintain the ongoing accuracy of the client TOD clock once it is set with a trusted time value, the secure timekeeping facility in a client may further include calibration and clock stability adjustment mechanisms which receive client clock calibration adjustment values and accuracy duration values, and which apply these values at intervals to maintain the accuracy of the client TOD clock within acceptable limits and mark the clock as untrusted when it can no longer be maintained within acceptable limits.

Claims

1. A secure timekeeping facility for use in a computer system that includes a central processing unit and electronic storage located in a physically secure package, comprising:

a public key register for holding a public key for use in identifying a private key for encrypting and decrypting at least time and date transmissions;

a private key register for holding the private key;

an input for receiving (a) time and date information and (b) clock accuracy-enhancing operation data, encrypted using the private key;

data decryption means for decrypting (a) the received time and date information and (b) said clock accuracy-enhancing operation data, using the private key;

a time-of-day (TOD) clock including a time clock and a date calendar, having an input for receiving decrypted time and date information and an output for providing unencrypted time and date information, which is subject to modification by said clock accuracy-enhancing operation data.

2. The secure timekeeping facility as recited in claim 1, wherein the TOD clock is located in the same physically secure package as the central processing unit.

3. The secure timekeeping facility as recited in claim 1, wherein the public key corresponds with a system serial number for the computer system.

4. The secure timekeeping facility as recited in claim 1, wherein the public key is unique to the computer system and is accessible outside the physically secure package.

5. The secure timekeeping facility as recited in claim 1, wherein the private key is unique to the computer system and is inaccessible outside the physically secure package.

6. The secure timekeeping facility as recited in claim 1, further comprising secure-time request means for requesting from a time server any of current time and date information encrypted using the private key.

7. The secure timekeeping facility as recited in claim 6, wherein a request initiated by the secure-time request means includes the present value of the TOD clock.

8. The secure timekeeping facility as recited in claim 1, further comprising client clock calibration means for receiving any of a time and date calibration value and for applying the calibration value to the TOD clock.

9. The secure timekeeping facility as recited in claim 8, wherein the calibration value is encrypted using the private key.

10. A secure time server for use in a computer network, comprising:

a server time-of-day (TOD) clock including a time clock and a date calendar;

an input for receiving a secure time request including a public key;

processor means for identifying a private key corresponding to the public key;

data encryption means for encrypting time and date information from the TOD clock using the private key;

an output for sending the encrypted time and date information to the secure time requestor; and

means for passing clock operation data between said secure time server and said secure time requestor.

11. The secure time server as recited in claim 10, wherein said means for passing includes:

calibration adjustment means for computing a client clock calibration value based on any of the value of the server TOD clock, time, date, and calibration history information received from the client, and a calibration history accumulated from prior client clock calibration computations.

12. The secure time server as recited in claim 10, wherein said means for passing includes:

client stability monitoring means for computing a client clock stability value based on any of the value of the server TOD clock, time, date and stability history information received from the client, and a stability history accumulated from prior client clock stability computations.

13. The secure time server as recited in claim 11, wherein the client clock calibration value is further computed from the amount of drift accumulated in the client TOD clock since the last setting of the client TOD clock.

14. The secure time server as recited in claim 11, wherein the calibration value is encrypted using the private key.

15. A secure time server for use in a computer network, comprising:

a server time-of-day (TOD) clock including a time clock and a date calendar;

processor means for identifying a public key and a private key for which to generate a secure time transmission;

date encryption means for encrypting time and date information from the TOD clock using the private key; and

an output for broadcasting the public key and the encrypted time, date information and clock operation data.

16. The secure time server as recited in claim 15, further comprising:

calibration adjustment means for computing a client clock calibration value., which is broadcast as clock operation data based on any of the value of the server TOD clock, time, date, and calibration history information received from the client, and a calibration history accumulated from prior client clock calibration computations.

17. The secure time server as recited in claim 15, further comprising:

client stability monitoring means for computing a client clock stability value, which is broadcast as clock operation data based on any of the value of the server TOD clock, time, date, and stability history information received from the client, and a stability history accumulated from prior client clock stability computations.

18. The secure time server as recited in claim 16, wherein the client clock calibration value is further computed from the amount of drift accumulated in the client TOD clock since the last setting of the client TOD clock.

19. The secure lime server as recited in claim 15 wherein the calibration value is encrypted using the private key.