- Does the clock in IoT and all computers really matter for security?
- ABSOLUTELY. There is a crucial interdependent relationship between security mechanisms and time synchronization.
PriVerify solves both secure time sync and Quantum Entropy Delivery with its proprietary, purpose-built ‘secfd’ client application which speaks our EDP (Entropy Distribution Protocol) with our diverse backend locations and servers.
Internet security technologies rely on a crucial interdependent relationship between security mechanisms and time synchronization.
For example, certificates, a key component of security solutions, are used to determine that numerous types of resources are identified securely and correctly. These solutions rely on accurate time of day to establish the validity of certificates.
There is a stereotypical “chicken and egg” problem where accurate time is needed to establish the security mechanism (the certificate). In turn, you need the security mechanism (the certificate) to be valid in order to establish that the information exchanged for time synchronization purposes has not been corrupted. As more security mechanisms are being deployed, we are increasingly relying on certificates and, in turn, secure time.
“Atomic Clocks”
At each of our backend facilities, we have an “ensemble” of clocks/oscillators with multiple diverse and resilient disciplining references, each traceable to UTC. We use “atomic clocks” similar to those in the GPS constellation of satellites. We also track every available GNSS satellite (this includes GPS (US Govt), Galileo (European Union Govt), GLONASS (Russian Govt)) simultaneously which is currently visible at that location to monitor the time transmitting from each of their atomic clocks.
Special hardware and software protects against attacks on the frequencies used by the various satellites as our own on-site primary reference clocks have “holdover” precision accurate enough to keep time highly accurate to UTC without GNSS satellites for a long period.
Our backend facilities connect to each other over a diversity of Internet routes and dedicated links. They establish a “Secure Consensus” timecode globally for our front end servers to then provide directly to each of our customer’s servers and their IoT and their end-user’s IoT.
Regulatory Requirements
Finance Sector:
- United States SEC Rule 613: requires certain financial institutions/exchanges to keep their Business Clocks synchronized to within 100 μs (1/10,000th of a second) to time maintained by NIST.
- European Union MiFID II: granularity 1 μs (1/1,000,000th of a second) for timestamps and a maximum difference of 100 μs (1/10,000th of a second) from UTC at all times.
Cost Survey for companies required to stay within 100 μs (1/10,000th of a second) of accuracy:
- Initial: $100,000 USD to $500,000 USD
- Annual maintenance: $20,000 USD to $75,000 USD