System Time change detection on linux

Question

Hi,

I was reading about the licensing of software and one question that came to my mind is that "how software detect the change in system time and block themselves if someone changes system time?". Since there is no other reference available(provided we don't have internet connection, otherwise we can use time servers as reference), how such software manages to do it? Are there standard algorithms or any standard libraries(C/C++) available for implementing the same. Please suggest.

Thanks in advance, Ravi Gupta

Answer 1

You can set up a timer that checks every n ticks (one tick = one (multitude of) cpu clock tick) if the system time difference is positive... Should be enough to check every second or even once a minute. Usually a timer shouldn't use up that much resources. You must make sure though that the timer uses the ticks, not the system clock...

Answer 2

Your software can regularly ask for system time (using boost::posix_time::second_clock::local_time()) and compare it with the last stored value. If you observe a significant negative difference, someone probably changed the system time.

Beware that time can be changed on a system for legitimate reasons : the computer can be moved to another timezone, the system can be using NTP and the computer clock is ticking too fast so NTP very often sets time to an earlier value or when daylight saving time change occurs.

Keep also in mind that those kind of "protection" aren't really effective in practice. If you have to store the last system date somewhere, you take the risk that someone will find where and change it to something in a far future to grant himself new licensing rights.

As far as I know, there is no elegant and reliable solution to this problem.

Answer 3

clock_gettime(CLOCK_MONOTONIC, &ts) gives you a timespec independent of the system time. You can use it to calc an offset between CLOCK_REALTIME and if that changes, your systemtime has changed

Answer 4

Generally you can't detect such things consistently, since people may just reboot the machine in question.

In an ancient place I was working once an admin changed the clock because he had forgotten to renew the license for a compiler. Not really a brilliant idea. Basically the machine soon became completely unusable: NFS was messed up, make didn't work, a lot of trouble.

So my guess is that your problem is more of theoretical nature. In real life, nobody sane will probably do that.

Answer 5

You could always set the timestamp on a file to the current system time every time your application starts.

Check the time first before setting it - if it's in the future, then the clock has gone backwards since you last set it.

Answer 6

You cannot assume that because the clock goes backwards, it is caused by someone trying to circumvent your licensing.

Consider, for example, the situation where someone accidentally sets the clock way into the future, then resets it to the correct time?

Crippling your software by attempting to time-restrict it is not the right thing to do. Consider making decent software instead.

Answer 7

One strategy I have read about in the past is to create, update and check a file in a folder. You can update the date as it changes and if it goes backwards you leave it alone and can get suspicious.

However there is no 100% method of proving time shifting, in my limited experience any piracy feature usually hurts the helpdesk and your customers more than it hurts the pirates.

It is a far better strategy to get to know your trial users than to criminalise them.