Clock roll forward detection

摘要

Method and apparatus to detect clock roll-forward attacks in a computing device or similar system. This protects against hackers who tamper with the system clock of, for instance, a digital media playback device in order to access a content item which has been rented for a limited time. By detecting clock roll-forward tampering, the present method and system prevent such hackers from accessing the content item outside its authorized rental time period.

主权项

1. A method for detecting tampering with timing in a system before allowing access to a piece of protected content, wherein the time is maintained by a clock associated with the system, the method comprising:
storing, for each of a plurality of files stored by the system, (i) a time stamp that indicates a most recent time that the file was modified, and (ii) a content identification value that is based on content of the file, such that if the content of the file has been modified, the content identification value of the file is different, wherein the plurality of files comprises a group of files that does not include the piece of protected content: receiving a request to access the piece of protected content; in response to receiving the request, for each file of a set of the plurality of files:
determining a relationship between the stored time stamp of the file and a current time stamp of the file; andwhen the stored time stamp of the file and the current time stamp of the file are the same, determining whether the stored content identification value is the same as a current content identification value; and enabling the system to access the piece of protected content when (i) no stored time stamp for any particular file is more recent than the current time stamp for the particular file, and (ii) for all files for which the stored time stamp is the same as the current time stamp, the stored content identification value is the same as the current content identification value.