Time anomaly detection device, time anomaly detection method, and timestamp server

Abstract

This enables the detection of unauthorized time manipulation or unintended time changes to the system time that may occur between periodic time synchronization and health check intervals. [Solution] The system includes a system time acquisition unit 11 that repeatedly acquires the system time, which is the current time managed by the OS, and records it in the main memory 102, and an anomaly determination unit 12 that determines an anomaly in the current system time by utilizing the relationship between the most recently acquired current system time and past system times acquired in the past and recorded in the main memory 102. By determining an anomaly in the current system time by utilizing the relationship between system times that are sequentially updated at time intervals shorter than the time intervals for periodic time synchronization and health checks by the timestamp server 1, it is possible to detect unauthorized time manipulation or unintended time changes to the system time that may occur between time synchronization and health check time intervals.

Description

[Technical Field]

[0001] The present invention relates to a time anomaly detection device, a time anomaly detection method, and a timestamp server, and more particularly to a technology for detecting system time anomalies. [Background technology]

[0002] Timestamp services that issue timestamps upon user request utilize an internal clock (system clock) of the timestamp server, synchronized with a specific, reliable time source, to prove the time of existence of documents and data. To ensure the reliability of this internal clock's time (system time), the following measures are typically taken: (1) Time synchronization by upstream NTP (Network Time Protocol) servers Timestamp servers operated by time stamping authorities (TSAs) periodically synchronize their system time with a time source provided by a higher-level NTP server. The time that the NTP server distributes to the timestamp server is synchronized to UTC (Coordinated Universal Time) provided by the National Institute of Information and Communications Technology (e.g., NICT) with an accuracy of ±1 second. (2) Time monitoring (health check) The timestamp server compares the system time with the monitoring time of a time server that synchronizes with a time source different from UTC (e.g., GPS) at a predetermined frequency. If an anomaly is found in the comparison, the server stops issuing timestamps and issues an alert.

[0003] In timestamp services, maintaining accurate time and preventing unauthorized time manipulation are paramount requirements. Traditional systems have ensured time reliability by combining time synchronization via NTP servers and time monitoring via time servers, but significant challenges existed in this regard.

[0004] In other words, in conventional systems, periodic time synchronization and health checks are typically performed at intervals of several minutes to several tens of minutes. Therefore, there was a problem in that unauthorized time manipulation or unintended time changes occurring during this time interval could not be detected immediately. For example, in a system that performs health checks every 10 minutes, if the time is tampered with immediately after the check, the anomaly in that time cannot be detected for up to 10 minutes. This time lag poses a risk of inaccurate timestamps being issued.

[0005] Unauthorized time manipulation or unintended time changes can occur, for example, when a system administrator manually changes the time, when malware intentionally tampers with the time, or when hardware malfunctions cause the time management function to malfunction. A particularly serious problem is malicious system time rollback. Unauthorized time manipulation that reverts the system time to a past date poses a significant threat to timestamp services. This time manipulation makes it possible to falsely prove that a document existed at a date and time earlier than the actual time.

[0006] Furthermore, time management devices are known that aim to reduce opportunities for intentional time tampering by third parties (see, for example, Patent Document 1). The time management device described in Patent Document 1 includes an external time acquisition means that acquires an external time (time from a radio-controlled clock) within a predetermined time range, a local clock means that outputs the self-propelled time of a built-in local clock, and a time difference determination means. The time difference determination means calculates the difference between the external time and the self-propelled time, and sets the external time to the local clock means if the difference is less than a predetermined value, while not setting the external time to the local clock means if the difference is greater than or equal to the predetermined value. This reduces the opportunity for a third party to tamper with the self-propelled time of the local clock using a fake radio-controlled clock transmitter.

[0007] Furthermore, a system is known that detects and notifies of frequency deviations in a device (see, for example, Patent Document 2). The frequency deviation detection device of the system described in Patent Document 2 includes a storage means for storing the current time from a server means, a counting means for calculating a count value based on a clock signal generated at a predetermined period based on an output signal from an oscillator, a first determination means for determining whether the difference between the current time calculated based on the elapsed time calculated from the first current time and count value of the storage means and the second current time of the storage means is greater than or equal to a first predetermined threshold, a second determination means for determining that a frequency deviation has occurred when the difference is determined to be greater than or equal to the first predetermined threshold, and the elapsed time since the first current time was received from the server means is less than or equal to a second predetermined threshold, and a notification means for notifying a monitoring device when the second determination means determines that a frequency deviation has occurred. [Prior art documents] [Patent Documents]

[0008] [Patent Document 1] WO04 / 107064 publication [Patent Document 2] Japanese Patent Publication No. 2014-127982 [Overview of the Initiative] [Problems that the invention aims to solve]

[0009] The technology described in Patent Document 1 above can prevent the tampering of local time by manipulating the external time of a radio-controlled clock, but it cannot detect unauthorized time manipulation or unintended time changes to the system time that are unrelated to the external time. The technology described in Patent Document 2 above detects frequency deviations due to aging of the oscillator, and cannot detect unauthorized time manipulation or unintended time changes to the system time.

[0010] The present invention has been made to solve such problems, and an object thereof is to be able to detect unauthorized time operations or unintended time changes to the system time that may occur during the time intervals of regular time synchronization and health checks executed in a timestamp server.

Means for Solving the Problems

[0011] In order to solve the above-described problems, in the present invention, the system time, which is the current time managed by the operating system installed in an information processing apparatus, is repeatedly acquired and recorded in a storage medium, and the relationship between the currently acquired current system time and the past system time acquired in the past and recorded in the storage medium is used to determine an abnormality in the current system time.

Effects of the Invention

[0012] According to the present invention configured as described above, an abnormality in the current system time is determined by using the relationship between system times that are sequentially updated at time intervals shorter than the time intervals of regular time synchronization and health checks by a timestamp server as an information processing apparatus. Therefore, it is possible to detect unauthorized time operations or unintended time changes to the system time that may occur during the time intervals of time synchronization and health checks.

Brief Description of the Drawings

[0013] [Figure 1] It is a diagram showing an example of the overall configuration of a timestamp issuing system to which a timestamp server according to the present embodiment is applied. [Figure 2] It is a diagram showing an example of the hardware configuration of a timestamp server according to the present embodiment. [Figure 3] It is a diagram showing an example of the functional configuration of a timestamp server according to the first embodiment. [Figure 4A] It is a diagram for explaining the abnormality determination process (when there is no abnormality) by an abnormality determination unit according to the first embodiment. [Figure 4B]It is a diagram for explaining the abnormality determination process (when there is an abnormality) by the abnormality determination unit according to the first embodiment. [Figure 5] It is a diagram showing a functional configuration example of a time stamp server according to the second embodiment. [Figure 6A] It is a diagram for explaining the abnormality determination process (when there is no abnormality) by the abnormality determination unit according to the second embodiment. [Figure 6B] It is a diagram for explaining the abnormality determination process (when there is an abnormality) by the abnormality determination unit according to the second embodiment.

Mode for Carrying Out the Invention

[0014] Hereinafter, an embodiment of the present invention will be described based on the drawings. FIG. 1 is a diagram showing an overall configuration example of a time stamp issuing system to which a time stamp server 1 according to the present embodiment is applied. As shown in FIG. 1, the time stamp issuing system of the present embodiment includes a time stamp server 1 as an information processing device, a synchronization NTP server 2, a monitoring NTP server 3, and a user terminal 4.

[0015] The time stamp server 1 and the user terminal 4 are communicably connected via a communication network 5. The communication network 5 is, for example, the Internet, and is constructed including a public communication line network, a mobile phone line network, and the like. A part of the communication network 5 may include a wireless communication path, a LAN (Local Area Network), or the like. The time stamp server 1 issues a time stamp based on the system time measured by an internal clock (system clock) in response to a request from the user terminal 4.

[0016] The time stamp server 1 is, for example, a general-purpose computer such as a workstation or a personal computer, or a device logically realized by cloud computing. The time stamp server 1 may be configured by one device, or may be configured by a combination of a plurality of devices. This also applies to the synchronization NTP server 2 and the monitoring NTP server 3.

[0017] User terminal 4 is a computer used by the user, and can consist of, for example, a smartphone, tablet, or personal computer. User terminal 4 can connect to timestamp server 1 via the communication network 5 through applications or web browsers running on user terminal 4, and receive timestamps issued by timestamp server 1.

[0018] Timestamp server 1 manages the system time, which is measured by an internal clock, in order to issue timestamps based on accurate time. Regarding this system time management, timestamp server 1 performs periodic time synchronization with the higher-level synchronization NTP server 2, and also performs periodic time monitoring (health check) with the monitoring NTP server 3.

[0019] In other words, timestamp server 1 periodically obtains time information distributed by synchronization NTP server 2 and synchronizes its system time to this obtained time. The time distributed by synchronization NTP server 2 to timestamp server 1 is based on UTC (Coordinated Universal Time) provided by the National Institute of Information and Communications Technology (e.g., NICT), and is synchronized to this time source with an accuracy of ±1 second or less. This time synchronization process is performed at time intervals of several minutes to several tens of minutes.

[0020] Furthermore, timestamp server 1 refers to the monitoring time measured by monitoring NTP server 3 and compares it with the system time. If there is an abnormality in the comparison result, it stops issuing timestamps and issues an alert. The monitoring time measured by monitoring NTP server 3 is, for example, based on GPS (Global Positioning System) or GNSS (Global Navigation Satellite System) as the time source, and is synchronized to this time source with an accuracy of ±1 second or less. This health check is performed at time intervals of several minutes to several tens of minutes.

[0021] The timestamp server 1 includes a time anomaly detection device according to this embodiment. The time anomaly detection device performs an anomaly detection process different from the time synchronization process and health check described above, and detects anomalies in the system time. This anomaly detection process is repeatedly executed at time intervals shorter than the time intervals at which the time synchronization process and health check are performed (for example, at 1-second intervals). Details of the anomaly detection process by this time anomaly detection device will be described later.

[0022] Figure 2 shows an example of the hardware configuration of the timestamp server 1. As shown in Figure 2, the timestamp server 1 has a hardware configuration that includes a processor 101, main memory 102, auxiliary storage 103, hardware clock 104, and communication interface 105.

[0023] The processor 101 consists of a microcomputer equipped with a CPU, RAM, ROM, etc. The main memory 102 includes, for example, volatile memory such as DRAM or SRAM, non-volatile memory such as flash memory, or other semiconductor memory. The auxiliary storage device 103 is, for example, a hard disk drive or a solid-state drive. The auxiliary storage device 103 stores the operating system (OS) and various application programs.

[0024] The hardware clock 104 is comprised of, for example, an RTC (Real Time Clock) mounted on an IC on the motherboard of the timestamp server 1 (hereinafter sometimes referred to as RTC104), and measures the so-called hardware time. The RTC104 continues to tick the hardware time even when the power to the timestamp server 1 is turned off. When the timestamp server 1 is first started up, the hardware time of the RTC104 is set as the system time, and thereafter the system time is periodically updated based on the management of the OS.

[0025] The communication interface 105 is a module for communicating with the synchronization NTP server 2, the monitoring NTP server 3, and the user terminal 4, and includes, for example, a modem for connecting to a public communication network or a public telephone network. In addition, it may include at least one of the following: an adapter for connecting to a LAN, a wireless communication device for wireless communication, and a USB (Universal Serial Bus) connector or RS232C connector for serial communication. (First embodiment) The functions of the timestamp server 1 will be described below in a first embodiment based on the drawings. Figure 3 is a diagram showing an example of the functional configuration of the timestamp server 1 according to the first embodiment. As shown in Figure 3, the timestamp server 1 according to the first embodiment has a system time acquisition unit 11, an anomaly determination unit 12, and a timestamp issuance unit 13 as its functional configuration. Of these, the system time acquisition unit 11 and the anomaly determination unit 12 constitute the functional configuration of the time anomaly detection device 10.

[0026] The above-mentioned functional blocks 11 to 13 execute the processes described below through the cooperation of hardware and software. For example, the processes of functional blocks 11 to 13 are executed by the operation of the OS and application programs stored in the auxiliary storage device 103, under the control of the processor 101 shown in Figure 2.

[0027] The system time acquisition unit 11 repeatedly acquires the system time, which is the current time of the internal clock managed by the OS and stored in the auxiliary storage device 103, and records the acquired system time in the main storage device 102 (for example, a storage medium such as semiconductor memory). The acquisition of the system time is performed using, for example, the LocalDateTime.now() method included in the java.time package (JAVA is a registered trademark; the same applies hereinafter). LocalDateTime.now() is a method provided to acquire the current time displayed in date and time format (year-month-day-hour-minute-second) (hereinafter referred to as the current time acquisition method).

[0028] The system time acquisition unit 11 repeatedly acquires the system time at one-second intervals, for example by repeatedly executing the current time acquisition method at one-second intervals, and sequentially records the acquired system time in the main memory 102. Here, it is sufficient to store at least the latest system time in the main memory 102 until the next system time is acquired one second later. In other words, the system time acquisition unit 11 may overwrite the system time from one second ago stored in the main memory 102 with the latest system time.

[0029] The abnormality determination unit 12 determines an abnormality in the current system time by utilizing the relationship between the most recently acquired system time (hereinafter referred to as the current system time) by the system time acquisition unit 11 and the system time previously acquired by the system time acquisition unit 11 and recorded in the main memory device 102 (hereinafter referred to as the past system time). In this embodiment, the past system time is the time one second before the current system time.

[0030] Here, the anomaly detection unit 12 detects that an anomaly (system time rollback) has occurred in the current system time if the current system time is earlier than the past system time. In other words, based on the principle that physical time is always moving forward, the anomaly detection unit 12 detects this as an anomaly (rollback) if the current system time is earlier than the past system time.

[0031] The anomaly detection unit 12 performs anomaly detection of the system time at the same time interval as the system time acquisition unit 11 (1 second interval in this embodiment). The anomaly detection unit 12 performs this anomaly detection in the background using a Java thread.

[0032] Figures 4A and 4B are diagrams illustrating the abnormality detection process performed by the abnormality detection unit 12. Figure 4A shows a normal state where there is no rollback of the system time, and Figure 4B shows an abnormal state where a rollback of the system time has occurred.

[0033] In Figure 4A, (a) shows the current system time acquired at 1-second intervals by the system time acquisition unit 11, and (b) shows past system times stored in the main memory 102. Which time T m ,T m+1 Even in this case, the current system time is one second after the past system time. In this case, the anomaly detection unit 12 does not detect an anomaly in the system time.

[0034] On the other hand, in Figure 4B, (a) shows the current system time acquired at 1-second intervals by the system time acquisition unit 11, and (b) shows past system times stored in the main memory 102. Figure 4B(a) shows time T m+2 and time T m+3 During the timing between these two events, a rollback of the system time occurs, and the system time acquisition unit 11 retrieves the rolled-back system time to time T m+3 This shows the current system time obtained at time T. m+2 This indicates that the normal past system time up to time T is stored in the main memory 102. In this case, the abnormality determination unit 12 determines that time T m+3 At the monitoring timing, the system detects an anomaly in the system time based on the relationship that the current system time acquired by the system time acquisition unit 11 is earlier than the past system time stored in the main memory 102.

[0035] The timestamp issuing unit 13 issues a timestamp using the system time of the internal clock, which is measured by the OS of the timestamp server 1, in response to a request from the user terminal 4. However, if the abnormality detection unit 12 detects an abnormality in the current system time, the timestamp issuing unit 13 stops issuing timestamps until the abnormality is resolved.

[0036] For example, the anomaly detection unit 12 outputs an alert when it detects an anomaly. The alert can be generated by, for example, displaying a predetermined message or outputting a predetermined sound. The timestamp issuing unit 13 stops issuing timestamps in response to the output of the alert. Subsequently, if the system time is restored to a normal time, for example, by an operator manually restarting the timestamp server 1, the timestamp issuing unit 13 resumes issuing timestamps. In this way, it is possible to reliably prevent the provision of timestamp services when the reliability of the system time is compromised.

[0037] As explained in detail above, according to the first embodiment, since abnormalities in the current system time are determined by utilizing the relationship between system times that are sequentially updated at time intervals shorter than the time intervals for periodic time synchronization and health checks by the timestamp server 1, it is possible to detect unauthorized time manipulation or unintended time changes to the system time that may occur between time synchronization and health check time intervals.

[0038] In particular, in the first embodiment, the anomaly detection unit 12 performs anomaly detection at one-second intervals. This high-frequency monitoring makes it possible to detect system time anomalies that occur in a short period of time without affecting other processes in the system. This significantly improves the reliability of the timestamp service. (Second embodiment) A second embodiment of the functions of the timestamp server 1 will be described below with reference to the drawings. Figure 5 is a diagram showing an example of the functional configuration of the timestamp server 1 according to the second embodiment. In Figure 5, components with the same reference numerals as those shown in Figure 3 have the same functions, so redundant explanations will be omitted here.

[0039] As shown in Figure 5, the timestamp server 1 according to the second embodiment has a functional configuration that includes a system time acquisition unit 11, an anomaly determination unit 12', a timestamp issuance unit 13, and an elapsed time acquisition unit 14. Of these, the system time acquisition unit 11, the anomaly determination unit 12', and the elapsed time acquisition unit 14 constitute the functional configuration of the time anomaly detection device 10'.

[0040] The above-mentioned functional blocks 11, 12', 13, and 14 perform the processes described below through the cooperation of hardware and software. For example, the processes of the above-mentioned functional blocks 11, 12', 13, and 14 are executed by the operation of the OS and application programs stored in the auxiliary storage device 103, under the control of the processor 101 shown in Figure 2.

[0041] The elapsed time acquisition unit 14 repeatedly acquires the elapsed time counted from a predetermined reference point using a monotonically increasing timer based on the RTC 104 (hardware clock), and sequentially records the acquired elapsed time in the main memory 102. Here, the elapsed time acquisition unit 14 repeatedly acquires the elapsed time at the same acquisition interval as the system time acquisition interval by the system time acquisition unit 11. The acquisition of elapsed time is performed using, for example, the System.nanoTime() method included in the java.time package. System.nanoTime() is a method provided for acquiring the elapsed time in nanoseconds from a fixed reference point (for example, the startup time of the Java Virtual Machine) (hereinafter referred to as the elapsed time acquisition method).

[0042] The elapsed time acquisition unit 14 repeatedly acquires the elapsed time at 1-second intervals, for example, by repeatedly executing the elapsed time acquisition method at 1-second intervals, and sequentially records the acquired elapsed time in the main memory 102. Here, it is sufficient to store at least the most recent elapsed time in the main memory 102 until the next elapsed time is acquired 1 second later. In other words, the elapsed time acquisition unit 14 may overwrite the elapsed time from 1 second ago stored in the main memory 102 with the most recent elapsed time.

[0043] In the second embodiment as well, the abnormality determination unit 12' determines an abnormality in the current system time by utilizing the relationship between the current system time most recently acquired by the system time acquisition unit 11 and past system times previously acquired by the system time acquisition unit 11 and recorded in the main memory 102. However, the relationship of interest in the second embodiment is not the chronological relationship between the current system time and the past system time, but the time difference between the current system time and the past system time.

[0044] In other words, the abnormality detection unit 12' detects an abnormality in the current system time based on the comparison result between the difference time between the current system time and the past system time (hereinafter referred to as the system clock difference time) and the difference time between the elapsed time most recently acquired by the elapsed time acquisition unit 14 (hereinafter referred to as the current elapsed time) and the elapsed time acquired in the past and recorded in the main memory 102 (hereinafter referred to as the past elapsed time) (hereinafter referred to as the hardware clock difference time).

[0045] Here, the anomaly detection unit 12' detects that an anomaly has occurred in the current system time if the difference between the system clock difference time and the hardware clock difference time is greater than a threshold. For example, if the threshold is set to 5 minutes, the anomaly detection unit 12' detects that an anomaly has occurred due to a sudden time change if the difference between the system clock difference time and the hardware clock difference time is greater than 5 minutes. Normally, time correction by synchronization processing for the time distributed from the synchronization NTP server 2 is performed gradually, and such a large time difference does not occur. Therefore, if a time difference of more than 5 minutes occurs, the unit detects an anomaly as it may be due to unauthorized time manipulation or an unintended time change.

[0046] Note that the value of 5 minutes is just an example and it is needless to say that it is not limited to this. The threshold value may be set as long as it exceeds the range of normal time correction by general time synchronization processing for the time source provided by the synchronization NTP server 2 and is the minimum time that can affect the reliability of the time stamp. This threshold value may be adjustable according to the requirements of the system. However, if the threshold value is too short, normal time correction using the time source of the synchronization NTP server 2 will be detected as abnormal. On the other hand, if the threshold value is too long, there is a possibility of overlooking illegal operations. Therefore, it is necessary to set a value with an appropriate balance.

[0047] FIGS. 6A and 6B are diagrams for explaining the abnormality determination process by the abnormality determination unit 12'. FIG. 6A shows a normal state without abnormality in the system time, and FIG. 6B shows an abnormal state in which an abnormality has occurred in the system time.

[0048] In FIG. 6A, (a) shows the current system time acquired at 1-second intervals by the system time acquisition unit 11, and (b) shows the past system time stored in the main storage device 102. At any time T m , T m+1 , ···, it is shown that the system clock difference time (the difference time between the past system time and the current system time) is 1 second.

[0049] In FIG. 6A, (c) shows the current elapsed time from the reference time acquired at 1-second intervals by the elapsed time acquisition unit 14, and (d) shows the past elapsed time stored in the main storage device 102. At any time T m , T m+1 , ···, it is shown that the hardware clock difference time (the difference time between the past elapsed time and the current elapsed time) is 1 second. Here, for simplicity of explanation, the elapsed time is shown in seconds instead of nanoseconds.

[0050] In the case of the situation shown in FIG. 6A, at any time T m , T m+1Even in this case, there is no difference between the system clock difference time (1 second) and the hardware clock difference time (1 second), and it is below the threshold, so the abnormality detection unit 12' does not detect an abnormality in the system time.

[0051] On the other hand, in Figure 6B, (a) shows the current system time acquired at 1-second intervals by the system time acquisition unit 11, and (b) shows past system times stored in the main memory 102. Figure 6B(a) shows time T m+2 and time T m+3 A significant change in the system time occurs between these two points, and the system time acquisition unit 11 acquires the changed system time at time T m+3 This shows the current system time obtained at time T. m+2 This indicates that the normal past system time up to time T is stored in the main memory 102. m+2 Up until time T, the system clock difference time was 1 second, whereas at time T m+3 At that point, the system clock difference time is 10 minutes.

[0052] In Figure 6B, (c) shows the current elapsed time from a reference point, acquired at 1-second intervals by the elapsed time acquisition unit 14, and (d) shows the past elapsed time stored in the main memory 102. Which time T m ,T m+1 In this case as well, the hardware clock difference time (the difference between past elapsed time and present elapsed time) is shown to be 1 second.

[0053] In the situation shown in Figure 6B, time T m+3 At the monitoring timing, the difference between the system clock difference time (10 minutes) and the hardware clock difference time (1 second) is greater than the threshold of 5 minutes, so the anomaly detection unit 12' detects an anomaly in the system time.

[0054] As explained in detail above, in the second embodiment as well, abnormalities in the current system time are determined by utilizing the relationship between the time differences between system times that are sequentially updated at time intervals shorter than the time intervals for periodic time synchronization and health checks by the timestamp server 1. Therefore, it is possible to detect unauthorized time manipulation or unintended time changes to the system time that may occur between time synchronization and health check time intervals. According to the second embodiment, if the time fluctuation is greater than the threshold, it is possible to detect not only time manipulation that advances the system time ahead of the original normal time, but also rollback of the system time as described in the first embodiment.

[0055] In particular, in the second embodiment, in addition to the system time managed by the OS, the system time anomaly detection is performed using elapsed time counted by a monotonically increasing timer based on the hardware clock 104. Because the hardware clock 104 is difficult to manipulate, it becomes a highly reliable reference time against time tampering. Therefore, by using the hardware clock 104 to determine system time anomalies, the reliability of the timestamp service can be greatly improved. Furthermore, by using two independent time measurement methods, the risk of false positives can be minimized, enabling more reliable anomaly detection.

[0056] Furthermore, according to the second embodiment, even if the system time is changed for a legitimate reason (for example, time correction by time synchronization processing using the time distributed from the synchronization NTP server 2), it is possible to determine whether the change is within an acceptable range in relation to the hardware clock 104. This makes it possible to reliably detect only illegal time manipulations while allowing necessary time corrections.

[0057] In the first and second embodiments described above, examples were given in which the abnormality determination units 12 and 12' perform abnormality determination of the system time at the same time interval as the system time acquisition interval of the system time acquisition unit 11, but the system is not limited to this. For example, if the time interval is shorter than the time interval for periodic time synchronization or health checks by the timestamp server 1, the abnormality determination units 12 and 12' may perform abnormality determination of the system time at a time interval longer than the system time acquisition interval of the system time acquisition unit 11.

[0058] Furthermore, while the first and second embodiments described above illustrate how to obtain the system time by executing LocalDateTime.now() included in the java.time package, the method is not limited to this. In other words, any method with similar functionality can be used.

[0059] Furthermore, while the second embodiment described above explains an example of obtaining the elapsed time from a reference point by executing System.nanoTime() included in the java.time package, it is not limited to this. In other words, any method with similar functionality can be used.

[0060] Furthermore, while the first embodiment described above illustrates an example of detecting an anomaly in system time rollback using the chronological relationship between the current system time and past system time, the system is not limited to this. For example, an anomaly in time manipulation where the system time is advanced ahead of the normal time may be detected based on whether the time difference between the current system time and past system time is greater than a threshold.

[0061] Furthermore, although the first and second embodiments have been described separately above, the first and second embodiments may also be applied in combination.

[0062] Furthermore, while the first and second embodiments described above illustrate the application of the time anomaly detection devices 10, 10' of this embodiment to the timestamp server 1, it is also possible to apply them to the synchronization NTP server 2 or the monitoring NTP server 3.

[0063] The functions or processes described above can be combined and applied as appropriate. Examples of configurations that can be applied to this embodiment are summarized below.

[0064] [Configuration 1] A system time acquisition unit repeatedly acquires the system time, which is the current time managed by the operating system installed in the information processing device, and records the acquired system time on a storage medium. The system includes an anomaly determination unit that determines an anomaly in the current system time by utilizing the relationship between the current system time most recently acquired by the system time acquisition unit and past system times previously acquired by the system time acquisition unit and recorded on the storage medium. A time anomaly detection device characterized by the following features.

[0065] [Configuration 2] The time anomaly detection device according to configuration 1, characterized in that the anomaly determination unit detects the occurrence of an anomaly in the current system time when the current system time is earlier than the past system time.

[0066] [Configuration 3] The time anomaly detection device according to configuration 1, characterized in that the anomaly determination unit detects the occurrence of an anomaly in the current system time when the difference between the current system time and the past system time is greater than a threshold.

[0067] [Structure 4] The system further includes an elapsed time acquisition unit that repeatedly acquires the elapsed time counted from a predetermined reference point by a monotonically increasing timer based on a hardware clock, at the same acquisition interval as the system time acquisition interval, and records the acquired elapsed time on a storage medium. The abnormality detection unit detects an abnormality in the current system time based on the comparison result between the system clock difference time, which is the difference between the current system time and the past system time, and the hardware clock difference time, which is the difference between the current elapsed time most recently acquired by the elapsed time acquisition unit and the past elapsed time acquired in the past and recorded on the storage medium. A time anomaly detection device according to any one of configurations 1 to 3, characterized by the above.

[0068] [Composition 5] The time anomaly detection device according to configuration 4, characterized in that the anomaly determination unit detects the occurrence of an anomaly in the current system time when the difference between the system clock difference time and the hardware clock difference time is greater than a threshold.

[0069] [Composition 6] The time anomaly detection device according to any one of configurations 1 to 5, characterized in that the anomaly determination unit performs an anomaly determination of the system time at the same time interval as the acquisition interval of the system time.

[0070] [Composition 7] The information processing device's system time acquisition unit repeatedly acquires the system time, which is the current time managed by the operating system, and records the acquired system time on a storage medium. The abnormality detection unit of the above-mentioned information processing device includes the step of detecting an abnormality in the current system time by utilizing the relationship between the current system time most recently acquired by the system time acquisition unit and past system times previously acquired by the system time acquisition unit and recorded on the storage medium. A method for detecting time anomalies, characterized by the following features.

[0071] [Structure 8] A time anomaly detection device described in any one of Configurations 1 to 6, A timestamp server characterized by comprising a timestamp issuing unit that issues timestamps using the above-mentioned system time.

[0072] [Composition 9] The timestamp server according to configuration 8, characterized in that the timestamp issuing unit stops issuing the timestamp when the abnormality detection unit detects an abnormality in the current system time, until the abnormality is resolved.

[0073] Furthermore, the above embodiments are merely examples of how the present invention may be implemented, and the technical scope of the invention should not be interpreted as being limited by them. In other words, the present invention can be implemented in various ways without departing from its gist or its main features. [Explanation of Symbols]

[0074] 1. Timestamp Server 10,10' Time Anomaly Detection Device 11 System Time Acquisition Unit 12,12' Abnormality judgment part 13 Timestamp Issuing Department 14. Elapsed time acquisition unit 101 Processors 102 Main storage device (storage medium) 103 Auxiliary storage device (storage medium) 104 Hardware Clock (RTC)

Claims

1. A system time acquisition unit repeatedly acquires the system time, which is the current time managed by the operating system installed in the information processing device, and records the acquired system time on a storage medium. An elapsed time acquisition unit repeatedly acquires the elapsed time counted from a predetermined reference point by a monotonically increasing timer based on the hardware clock, at the same acquisition interval as the system time acquisition interval, and records the acquired elapsed time on a storage medium. The system includes an anomaly determination unit that determines an anomaly in the current system time by utilizing the relationship between the current system time most recently acquired by the system time acquisition unit and past system times previously acquired by the system time acquisition unit and recorded on the storage medium. The abnormality detection unit detects an abnormality in the current system time based on the comparison result between the system clock difference time, which is the difference between the current system time and the past system time, and the hardware clock difference time, which is the difference between the current elapsed time most recently acquired by the elapsed time acquisition unit and the past elapsed time acquired in the past and recorded on the storage medium. A time anomaly detection device characterized by the following features.

2. The time anomaly detection device according to claim 1, characterized in that the anomaly determination unit detects the occurrence of an anomaly in the current system time when the difference between the system clock difference time and the hardware clock difference time is greater than a threshold.

3. The time anomaly detection device according to claim 1 or 2, characterized in that the anomaly determination unit performs an anomaly determination of the system time at the same time interval as the acquisition interval of the system time.

4. The information processing device's system time acquisition unit repeatedly acquires the system time, which is the current time managed by the operating system, and records the acquired system time on a storage medium. The elapsed time acquisition unit of the above-mentioned information processing device repeatedly acquires the elapsed time, which is counted from a predetermined reference point by a timer that increases monotonically based on the hardware clock, at the same acquisition interval as the acquisition interval for the system time, and records the acquired elapsed time on a storage medium. The abnormality detection unit of the above-mentioned information processing device includes the step of detecting an abnormality in the current system time by utilizing the relationship between the current system time most recently acquired by the system time acquisition unit and past system times previously acquired by the system time acquisition unit and recorded on the storage medium. The abnormality detection unit detects an abnormality in the current system time based on the comparison result between the system clock difference time, which is the difference between the current system time and the past system time, and the hardware clock difference time, which is the difference between the current elapsed time most recently acquired by the elapsed time acquisition unit and the past elapsed time acquired in the past and recorded on the storage medium. A method for detecting time anomalies, characterized by the following features.

5. A time anomaly detection device according to either claim 1 or 2, A timestamp server characterized by comprising a timestamp issuing unit that issues timestamps using the above-mentioned system time.

6. The timestamp server according to claim 5, characterized in that the timestamp issuing unit stops issuing the timestamp until the abnormality is resolved if the abnormality detection unit detects an abnormality in the current system time.

Images