Systems and methods for altering time data
AssigneeCA, Inc.
InventorWilliam E. Sobel
Life of this patent
Estimating the term…
Abstract
The disclosed computer-implemented method for altering time data may include (i) identifying an untrusted executable that is capable of making queries to an operating system of the computing device, (ii) intercepting a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time, (iii) calculating an offset value for the current time that is within a predetermined margin of the current time, and (iv) providing, in response to the request, the untrusted executable with the offset value for the current time instead of the current time. Various other methods, systems, and computer-readable media are also disclosed.
Claims20
A computer-implemented method for altering time data, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
- identifying an untrusted executable that is capable of making queries to an operating system of the computing device;
- intercepting a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time;
- calculating an offset value for the current time that is within a predetermined margin of the current time;
- providing, in response to the request, the untrusted executable with the offset value for the current time instead of the current time;
- storing the offset value for the current time;
- intercepting, at a later time, an additional request by the untrusted executable to query the system clock of the operating system of the computing device for the later time;
- calculating, based at least in part on the stored offset value, a new offset value for the later time that is within a predetermined margin of the later time and that comprises an interval between the new offset value and the later time that is not equal to a previous interval that was used to calculate the stored offset value;
- and
- providing, in response to the additional request, the untrusted executable with the new offset value for the later time instead of the later time, thereby preventing the untrusted executable from obtaining accurate system clock information.
A system for altering time data, wherein:
- the system comprises:
- an identification module, stored in memory, that identifies an untrusted executable that is capable of making queries to an operating system of a computing device;
- an interception module, stored in memory, that intercepts a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time;
- a calculation module, stored in memory, that calculates an offset value for the current time that is within a predetermined margin of the current time;
- a providing module, stored in memory, that provides, in response to the request, the untrusted executable with the offset value for the current time instead of the current time;
- and
- at least one physical processor configured to execute the identification module, the interception module, the calculation module, and the providing module;
- and
- wherein:
- the calculation module calculates the offset value for the current time by storing the offset value for the current time;
- the interception module intercepts, at a later time, an additional request by the untrusted executable to query the system clock of the operating system of the computing device for the later time;
- the calculation module calculates, based at least in part on the stored offset value, a new offset value for the later time that is within a predetermined margin of the later time and that comprises an interval between the new offset value and the later time that is not equal to a previous interval that was used to calculate the stored offset value;
- and
- the providing module provides, in response to the additional request, the untrusted executable with the new offset value for the later time instead of the later time, thereby preventing the untrusted executable from obtaining accurate system clock information.
A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- identify an untrusted executable that is capable of making queries to an operating system of the computing device;
- intercept a request by the untrusted executable to query a system clock of the operating system of the computing device for a current time;
- calculate an offset value for the current time that is within a predetermined margin of the current time;
- provide, in response to the request, the untrusted executable with the offset value for the current time instead of the current time;
- store the offset value for the current time;
- intercept, at a later time, an additional request by the untrusted executable to query the system clock of the operating system of the computing device for the later time;
- calculate, based at least in part on the stored offset value, a new offset value for the later time that is within a predetermined margin of the later time and that comprises an interval between the new offset value and the later time that is not equal to a previous interval that was used to calculate the stored offset value;
- and
- provide, in response to the additional request, the untrusted executable with the new offset value for the later time instead of the later time, thereby preventing the untrusted executable from obtaining accurate system clock information.
Dependencies are inferred from the claim text.