System Clock Attack Detection via NTP Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information Handling Systems (IHS) are vulnerable to malicious attacks, particularly those exploiting weaknesses in system clock settings, which can be altered by users or malicious actors to hide event times or force premature processing.
Innovation Solution
Implementing a system clock detecting and reporting system that compares the system clock time with a network time protocol (NTP) server time, generating an Indicator of Attack (IoA) report if the times do not match, and resetting the attack chain vector when the times match.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If system clock time is allowed to be freely set by users, then ease of operation is improved, but security is worsened due to vulnerability to malicious attacks
Solution Approach 1:
The system continuously monitors system clock events and compares them against expected time sequences, providing feedback when discrepancies are detected. This feedback mechanism enables automatic detection of unauthorized clock modifications while preserving user ability to set clock time, thus resolving the contradiction between ease of operation and security.
2Reliability
If system clock events are monitored and compared against NTP server, then security is improved, but device complexity is worsened
Solution Approach 1:
The system uses an intermediary NTP (Network Time Protocol) server to provide a trusted time reference. Instead of implementing complex internal time validation logic, the system leverages the NTP server as an external authority to verify system clock accuracy, thereby improving security without significantly increasing device complexity.
3Measurement precision
If IoA report is generated on time mismatch, then detection precision is improved, but loss of time is worsened due to additional processing
Solution Approach 1:
The system performs preliminary actions by continuously monitoring system clock events and maintaining a chain vector in readiness. When a time mismatch occurs, the detection mechanism is already primed to immediately generate an IoA report without requiring additional processing time, thus achieving high detection precision without significant time loss.
Data Source
AI summary
According to one embodiment, an Information Handling System (IHS) includes a memory to store a secure event log associated with one or more attributes of the IHS, and computer-executable code to obtain a system time from a system clock of the IHS, obtain a network time from a network time protocol (NTP) server, and compare the system time against the network time. When the obtained system time does not match the obtained network time, set a system clock attack chain vector in the secure event log and generate an Indicator of Attack (IoA) report based at least in part, on the system clock attack chain vector.