Hardening system clock for retention lock compliance enabled systems
A system clock is protected by limiting clock changes, change frequency, and calculating skew. System and secure clocks are initialized to a same time. First and second thresholds are set. The first threshold corresponds to an alert and the second threshold corresponds to an action. At a time interval at which the secure clock is to be updated, a skew is calculated between the system and secure clocks, and a cumulative skew is calculated. Upon a determination that the cumulative skew has reached the first threshold, but not the second threshold, the alert is triggered while deletions of files having retention locks that have expired according to the system clock are allowed to continue. Upon a determination that the cumulative skew has reached the second threshold, the action is triggered. The action includes blocking the deletions of files having retention locks that have expired according to the system clock.
1. A method of ensuring retention lock compliance for files in a filesystem comprising:
initializing a system clock and a secure clock to a same time;
setting a first threshold at which a clock-violation alert is triggered;
setting a second threshold, greater than the first threshold, at which one or more clock-violation actions are triggered;
scheduling a time interval at which the secure clock is to be updated;
upon arrival of each time interval, updating the secure clock based on the time interval and calculating a skew between the system clock and the secure clock;
maintaining a cumulative skew between the system clock and the secure clock;
determining that the cumulative skew has reached the first threshold but not the second threshold;
upon the determination that the cumulative skew has reached the first threshold but not the second threshold,
triggering the clock-violation alert; and
continuing to allow deletions of files having retention locks that have expired according to the system clock because the cumulative skew has not reached the second threshold;
determining that the cumulative skew has now reached the second threshold; and
upon the determination that the cumulative skew has now reached the second threshold, triggering a first clock-violation action comprising blocking the deletions of files having retention locks that have expired according to the system clock.
2. The method of claim 1 further comprising:
intercepting an operation to delete a file having a retention lock that has expired according to the system clock, the interception being before a next time interval at which the secure clock is scheduled to be updated;
calculating a latest skew between the system clock and the secure clock;
adding the latest skew to the cumulative skew to calculate a new cumulative skew;
if the new cumulative skew has not reached the second threshold, allowing the operation to delete the file having the retention lock that has expired according to the system clock; and
if the new cumulative skew has reached the second threshold, blocking the operation to delete the file having the retention lock that has expired according to the system clock.
3. The method of claim 1 further comprising:
upon the determination that the cumulative skew has reached the second threshold, trigging one or more other clock-violation actions, the one or more other clock-violation actions comprising at least one of disabling the filesystem, making the filesystem read-only, updating effective expiration dates of files in the filesystem by adding the cumulative skew to recorded expiration dates of the files, or disabling deletion operations for all files in the filesystem.
4. The method of claim 1 further comprising:
storing data of the secure clock in a binary format that is proprietary to the filesystem.
5. The method of claim 1 further comprising:
restricting access to data of the secure clock to a cryptographically protected system shell.
6. The method of claim 1 further comprising:
during an initial configuration of the filesystem, prompting an administrator user to provide one or more of a plurality of configuration values, the plurality of configuration values comprising:
the first threshold corresponding to the clock-violation alert,
the second threshold corresponding to the one or more clock-violation actions,
a selection of the one or more clock-violation actions to be triggered when the second threshold is reached,
a maximum amount of time that the system clock can be changed, and
a maximum change frequency for the system clock.
7. A system for ensuring retention lock compliance for files in a filesystem, the system comprising: a processor; and memory configured to store one or more sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
initializing a system clock and a secure clock to a same time;
setting a first threshold at which a clock-violation alert is triggered;
setting a second threshold, greater than the first threshold, at which one or more clock-violation actions are triggered;
scheduling a time interval at which the secure clock is to be updated;
upon arrival of each time interval, updating the secure clock based on the time interval and calculating a skew between the system clock and the secure clock;
maintaining a cumulative skew between the system clock and the secure clock;
determining that the cumulative skew has reached the first threshold but not the second threshold;
upon the determination that the cumulative skew has reached the first threshold but not the second threshold,
triggering the clock-violation alert; and
continuing to allow deletions of files having retention locks that have expired according to the system clock because the cumulative skew has not reached the second threshold;
determining that the cumulative skew has now reached the second threshold; and
upon the determination that the cumulative skew has now reached the second threshold, triggering a first clock-violation action comprising blocking the deletions of files having retention locks that have expired according to the system clock.
8. The system of claim 7 wherein the processor further carries out the steps of:
intercepting an operation to delete a file having a retention lock that has expired according to the system clock, the interception being before a next time interval at which the secure clock is scheduled to be updated;
calculating a latest skew between the system clock and the secure clock;
adding the latest skew to the cumulative skew to calculate a new cumulative skew;
if the new cumulative skew has not reached the second threshold, allowing the operation to delete the file having the retention lock that has expired according to the system clock; and
if the new cumulative skew has reached the second threshold, blocking the operation to delete the file having the retention lock that has expired according to the system clock.
9. The system of claim 7 wherein the processor further carries out the steps of:
upon the determination that the cumulative skew has reached the second threshold, trigging one or more other clock-violation actions, the one or more other clock-violation actions comprising at least one of disabling the filesystem, making the filesystem read-only, updating effective expiration dates of files in the filesystem by adding the cumulative skew to recorded expiration dates of the files, or disabling deletion operations for all files in the filesystem.
10. The system of claim 7 wherein the processor further carries out the steps of:
storing data of the secure clock in a binary format that is proprietary to the filesystem.
11. The system of claim 7 wherein the processor further carries out the steps of:
restricting access to data of the secure clock to a cryptographically protected system shell.
12. The system of claim 7 wherein the processor further carries out the steps of:
during an initial configuration of the filesystem, prompting an administrator user to provide one or more of a plurality of configuration values, the plurality of configuration values comprising:
the first threshold corresponding to the clock-violation alert,
the second threshold corresponding to the one or more clock-violation actions,
a selection of the one or more clock-violation actions to be triggered when the second threshold is reached,
a maximum amount of time that the system clock can be changed, and
a maximum change frequency for the system clock.
13. A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to implement a method for ensuring retention lock compliance for files in a filesystem, the method comprising:
initializing a system clock and a secure clock to a same time;
setting a first threshold at which a clock-violation alert is triggered;
setting a second threshold, greater than the first threshold, at which one or more clock-violation actions are triggered;
scheduling a time interval at which the secure clock is to be updated;
upon arrival of each time interval, updating the secure clock based on the time interval and calculating a skew between the system clock and the secure clock;
maintaining a cumulative skew between the system clock and the secure clock;
determining that the cumulative skew has reached the first threshold but not the second threshold;
upon the determination that the cumulative skew has reached the first threshold but not the second threshold,
triggering the clock-violation alert; and
continuing to allow deletions of files having retention locks that have expired according to the system clock because the cumulative skew has not reached the second threshold;
determining that the cumulative skew has now reached the second threshold; and
upon the determination that the cumulative skew has now reached the second threshold, triggering a first clock-violation action comprising blocking the deletions of files having retention locks that have expired according to the system clock.
14. The computer program product of claim 13 wherein the method further comprises:
intercepting an operation to delete a file having a retention lock that has expired according to the system clock, the interception being before a next time interval at which the secure clock is scheduled to be updated;
calculating a latest skew between the system clock and the secure clock;
adding the latest skew to the cumulative skew to calculate a new cumulative skew;
if the new cumulative skew has not reached the second threshold, allowing the operation to delete the file having the retention lock that has expired according to the system clock; and
if the new cumulative skew has reached the second threshold, blocking the operation to delete the file having the retention lock that has expired according to the system clock.
15. The computer program product of claim 13 wherein the method further comprises:
upon the determination that the cumulative skew has reached the second threshold, trigging one or more other clock-violation actions, the one or more other clock-violation actions comprising at least one of disabling the filesystem, making the filesystem read-only, updating effective expiration dates of files in the filesystem by adding the cumulative skew to recorded expiration dates of the files, or disabling deletion operations for all files in the filesystem.
16. The computer program product of claim 13 wherein the method further comprises:
storing data of the secure clock in a binary format that is proprietary to the filesystem.
17. The computer program product of claim 13 wherein the method further comprises:
restricting access to data of the secure clock to a cryptographically protected system shell.
18. The computer program product of claim 13 wherein the method further comprises:
during an initial configuration of the filesystem, prompting an administrator user to provide one or more of a plurality of configuration values, the plurality of configuration values comprising:
the first threshold corresponding to the clock-violation alert,
the second threshold corresponding to the one or more clock-violation actions,
a selection of the one or more clock-violation actions to be triggered when the second threshold is reached,
a maximum amount of time that the system clock can be changed, and
a maximum change frequency for the system clock.