Abstract:
Providing trusted time in a computing platform, while still supporting privacy, may be accomplished by having a trusted time device provide the trusted time to an application executing on the computing platform. The trusted time device may be reset by determining if a value in a trusted time random number register has been set, and if not, waiting a period of time, generating a new random number, and storing the new random number in the trusted time random number register. The trusted time random number register is set to zero whenever electrical power is first applied to the trusted time device upon power up of the computing platform, and whenever a battery powering the trusted time device is removed and reconnected. By keeping the size of the trusted time random number register relatively small, and waiting the specified period of time, attacks on the computing platform to determine the trusted time may be minimized, while deterring the computing platform from being uniquely identified.

Description:
BACKGROUND  
       [0001]     1. Field  
         [0002]     The present invention relates generally to computer security and, more specifically, to providing time in a computing platform that is trusted by executing applications.  
         [0003]     2. Description  
         [0004]     Obtaining a value for time that can be trusted in a computing platform is desirable. For example, trusted time may be used in conjunction with other processing to improve the robustness of content protection mechanisms to assure that premium content is available for the digital home. It may be used in a content protection environment to assure that the computing platform owner downloads a revocation list of compromised keys on a periodic basis. It may also be used to provide a secure way to enable content to be purchased for access during a temporary time window. However, if the time value can be modified by an unscrupulous user without detection by the computing platform, then computer security and content protection systems may be compromised.  
         [0005]     Existing solutions to providing trusted time require a battery contained in a tamper resistant hardware module that cannot be easily removed by the user (such as described in Trusted Platform Module (TPM) Main part 1 Design Principles, Specification Version 1.2, Revision 81, Nov. 23, 2004, pp. 93-98, available from the Trusted Computing Group). This may be problematic for continued operation of some computer systems as they age and the battery needs replacement. If the user can&#39;t change the battery without disrupting system operation, frustration with the system may ensue.  
         [0006]     Therefore, a better mechanism to provide a trusted time value in a computing platform would be useful.  
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0007]     The features and advantages of the present invention will become apparent from the following detailed description of the present invention in which:  
         [0008]      FIG. 1  is a diagram of a trusted time architecture according to an embodiment of the present invention;  
         [0009]      FIG. 2  is a flow diagram illustrating resetting a trusted time device according to an embodiment of the present invention;  
         [0010]      FIG. 3  is a flow diagram illustrating application initialization according to an embodiment of the present invention; and  
         [0011]      FIG. 4  is a flow diagram illustrating obtaining the current trusted time by an application according to an embodiment of the present invention. 
     
    
     DETAILED DESCRIPTION  
       [0012]     An embodiment of the present invention is a method and apparatus for providing trusted time in a computing platform. One security requirement is that the user must not be able to modify the trusted time. In one embodiment, a battery may be used that provides electrical power to a small group of trusted time circuits. An initial connection to a trusted time source may be used to initialize the trusted time. The property is achieved that as long as the trusted time circuits are powered up, trusted time will be provided in the computing platform. If power to the trusted time circuits is ever removed, then the absence of power will be detected, thus requiring a connection to the trusted time source to reinitialize the trusted time mechanism.  
         [0013]     Reference in the specification to “one embodiment” or “an embodiment” of the present invention means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, the appearances of the phrase “in one embodiment”appearing in various places throughout the specification are not necessarily all referring to the same embodiment.  
         [0014]      FIG. 1  is a diagram of a trusted time architecture according to an embodiment of the present invention. A computing platform  100  includes an executing application program  102  and trusted time device  104 . The computing platform may be any system having a processor for executing instructions, such as a personal computer, a server, a laptop or handheld computer, a personal digital assistant (PDA), a cell phone, a set-top box, and so on. Well known details of components of such a system have been omitted from  FIG. 1  for clarity. Application  102  may be any computer program for providing some functionality to a user of the computing platform that uses trusted time for some processing. The application wants to use trusted time and has functionality to store information securely so that the information cannot be easily modified by the user without detection.  
         [0015]     The application communicates with a trusted time source  106  for obtaining an initial trusted time. Trusted time source  106  comprises a source external to the computing platform that can provide a trusted time value. The trusted time source may be communicatively coupled with the application in any way (e.g., via a network such as the Internet, or an intranet).  
         [0016]     In embodiments of the present invention, the application wants to trust the time available on the computing platform, even if the user is an adversary. Further, the mechanism for providing trusted time should be privacy-friendly. That is, the trusted time mechanism should not uniquely identify the computing platform, which might raise privacy concerns. In the present invention, trusted time device  104  provides trusted time unless power is removed. If power is removed, the application can detect this event.  
         [0017]     Trusted time device  104  comprises a hardware computing device which contains trusted battery well  110  powered by trusted time battery  108 , and other circuits (not shown) that are not powered by the trusted time battery. In one embodiment, the trusted time device may be integrated into the Input/Output (I/O) Controller Hub (ICH) of a computer system&#39;s chipset. Trusted time device  104  includes battery  108 , which comprises a conventional replaceable power source to provide small amounts of electrical power for a very long time. In one embodiment, the battery is the same as the Real Time Clock battery existing in many computing platforms. Trusted time battery well  110  comprises a small set of circuits that are powered by battery  108 , and remain powered up as long as the trusted time battery  108  is operational and not removed.  
         [0018]     The trusted time battery well includes at least three other components. Crystal  112  comprises a circuit that produces a clock pulse at a constant and known frequency. In one embodiment, the crystal may be outside of the trusted time batter well. Trusted time (TT) Random (Rand) register  114  comprises a register to store a random number. TT Counter register  116  comprises a register that, in one embodiment, increments by one with a fixed frequency. The frequency may be once for each tick of crystal  112 , or once per second. In one embodiment, the size of the TT Counter may be set such that the computing platform could operate for 20 years, for example, before rolling over the counter. For the TT Rand and TT Counter registers, when power is first provided to these registers, they are set to all zeros. If power is ever removed and then restored, the registers are set to all zeros.  
         [0019]     Trusted time device  104  also includes a random number generator (RNG)  118 . RNG comprises a circuit that provides a random number as needed.  
         [0020]     Computing platform  100  also includes secure storage  120 . Secure storage is a component used to store data in a secure manner that is not easily tampered with by the user or any other party. In one embodiment, secure storage  120  comprises a trusted platform module (TPM) as described by specifications available from the Trusted Computing Group. In another embodiment, secure storage may be provided using known tamper resistant software techniques. Application  102  has the ability to securely store at least two values: Application Random value (Rand)  122 , and Application Offset  124 .  
         [0021]      FIG. 2  is a flow diagram illustrating resetting  200  a trusted time device according to an embodiment of the present invention. Resetting may be performed whenever power is applied to the computing platform (i.e., at power on of the system). At block  202 , the computing platform checks TT Rand  114  to determine if the value currently stored in the TT Rand register is zero. If TT Rand is not zero, this means that the battery has continually powered the trusted time device since the last time the battery was replaced, and the computing platform may proceed with initialization processing at block  208 . If TT Rand is zero, this means that battery  108  has been disconnected and reconnected. The computing platform then waits a period of time at block  204 . In one embodiment, this period of time is a fixed amount of one minute. In other embodiments, the period of time may be a different fixed amount of time, such as 30 seconds, two minutes, three minutes, and so on. In still further embodiments, the period of time may be variable over successive resets. At block  206 , a new TT Rand may be generated using random number generator (RNG)  108  and stored in TT Rand  114  before continuing with initialization processing at block  208 .  
         [0022]     Because the value of TT Rand is a random number, there is a potential concern that it could be used to identify the computing platform. In an embodiment of the present invention, this is solved by carefully picking the size of TT Rand, and by modifying the behavior of the population of TT Rand. First, the size of TT Rand may be chosen small enough such that it will not be a unique identifier of the computing platform. Second, the only time that TT Rand will be populated anew upon a system reset is after the power has been removed to the Trusted Time Battery Well  110  (i.e., the battery has been disconnected). The time delay prior to repopulating the TT Rand register will only occur when the battery has been disconnected, and not during typical resets of the computing platform. Thus, a substantial time delay between reset and the time that TT Rand is populated with a new random value during reset of the trusted time device may be used for the case when TT Rand is all zeros.  
         [0023]     Taking these requirements into account, in one embodiment, the TT Rand register comprises a 16 bit register. If a one minute time delay is used at block  204 , then it would take an expected number of 2 16  trials (taking approximately 45 days) of continual attempts in a brute force attack before the value of TT Rand matches the value of App Rand  122  stored in secure storage  120 . But since there are hundreds of millions of computing platforms in service worldwide, 2 16  (65,536) is a small enough number so that it would not be construed as a unique identifier of the computing platform, thereby supporting user privacy. Other sizes for the TT Rand register (e.g., 20 bits) and the time delay may be used depending on system implementation requirements without departing from the present invention.  
         [0024]      FIG. 3  is a flow diagram illustrating application initialization  300  according to an embodiment of the present invention. At block  302 , the application contacts a trusted time source  106  to obtain the current trusted time. In one embodiment, this may be accomplished in a secure manner by the application sending a nonce to the trusted time source, the trusted time source digitally signing the current trusted time and the nonce with its private key, and the trusted time source sending the signed current trusted time and nonce to the application. If the application has the public key of the trusted time source, the application can decrypt the signed current trusted time and nonce, and check to make sure the received nonce matches the nonce sent to the trusted time source. At block  304 , the application obtains values for TT Rand and TT Counter from the appropriate registers  114 ,  116  in the battery well of the trusted time device  104 . Next, at block  306 , the application optionally converts the TT Counter obtained from the trusted time device and current trusted time obtained from the trusted time source to application time units, if necessary. At block  308 , the application sets the application offset to the current trusted time minus TT Counter. This acts as a baseline value for later measurement of elapsed time since initialization. At block  310 , the application sets the application random value to TT Rand  114 . At block  312 , the application securely stores the modified application offset  124  and application random value  122  in secure storage  120 .  
         [0025]      FIG. 4  is a flow diagram illustrating obtaining the current trusted time by an application  400  according to an embodiment of the present invention. These actions may be performed when an executing application needs to locally access the current trusted time during application processing subsequent to initialization. At block  402 , the application obtains application random value  122  and application offset  124  from secure storage  120 . At block  404 , the application obtains TT Rand  114  and TT Counter  116  from the battery well of the trusted time device  104 . At block  406 , if TT Rand does not match the application random value, then an error may be reported at block  408 , and application initialization may be performed again as represented in  FIG. 4  at block  410 . If TT Rand does match the application random value, then the application optionally converts TT Counter to application time units (if necessary) at block  412 , and sets the current trusted time to the application offset+TT Counter at block  414 . The current trusted time may then be used by the application for further processing.  
         [0026]     Although the operations detailed herein may be described as a sequential process, some of the operations may in fact be performed in parallel or concurrently. In addition, in some embodiments the order of the operations may be rearranged.  
         [0027]     The techniques described herein are not limited to any particular hardware or software configuration; they may find applicability in any computing or processing environment. The techniques may be implemented in hardware, software, or a combination of the two. The techniques may be implemented in programs executing on programmable machines such as mobile or stationary computers, personal digital assistants, set top boxes, cellular telephones and pagers, and other electronic devices, that each include a processor, a storage medium readable by the processor (including volatile and non-volatile memory and/or storage elements), at least one input device, and one or more output devices. Program code is applied to the data entered using the input device to perform the functions described and to generate output information. The output information may be applied to one or more output devices. One of ordinary skill in the art may appreciate that the invention can be practiced with various computer system configurations, including multiprocessor systems, minicomputers, mainframe computers, and the like. The invention can also be practiced in distributed computing environments where tasks may be performed by remote processing devices that are linked through a communications network.  
         [0028]     Each program may be implemented in a high level procedural or object oriented programming language to communicate with a processing system. However, programs may be implemented in assembly or machine language, if desired. In any case, the language may be compiled or interpreted.  
         [0029]     Program instructions may be used to cause a general-purpose or special-purpose processing system that is programmed with the instructions to perform the operations described herein. Alternatively, the operations may be performed by specific hardware components that contain hardwired logic for performing the operations, or by any combination of programmed computer components and custom hardware components. The methods described herein may be provided as a computer program product that may include a machine accessible medium having stored thereon instructions that may be used to program a processing system or other electronic device to perform the methods. The term “machine accessible medium” used herein shall include any medium that is capable of storing or encoding a sequence of instructions for execution by a machine and that cause the machine to perform any one of the methods described herein. The term “machine accessible medium”shall accordingly include, but not be limited to, solid-state memories, optical and magnetic disks, and a carrier wave that encodes a data signal. Furthermore, it is common in the art to speak of software, in one form or another (e.g., program, procedure, process, application, module, logic, and so on) as taking an action or causing a result. Such expressions are merely a shorthand way of stating the execution of the software by a processing system cause the processor to perform an action of produce a result.