The license heartbeat and clock-tampering protection
This article explains the license heartbeat in MobilityManager and how it protects against clock tampering, so you understand why the system tracks time and what it detects.
Why the heartbeat exists
Because the platform validates licenses offline (air-gapped) and enforces an expiry date, it needs a trustworthy sense of elapsed time. The heartbeat provides that: it periodically records when the system was last running, which lets the platform notice if the clock is later set backward to dodge expiry.
How the heartbeat works
- A background service updates the license "last seen" timestamp on a fixed schedule — roughly once per hour — after a short delay when the application starts.
- The timestamp is monotonic: it only ever moves forward. If the wall clock is behind the stored value, the heartbeat does not overwrite it with the earlier time.
- If no license is configured yet (for example, during onboarding), the heartbeat simply does nothing until a license exists.
Note: The monotonic rule is deliberate. If a backward clock could overwrite the last-seen time with an earlier value, it would erase the very evidence used to detect a rollback. Only moving forward preserves that evidence.
How clock tampering is detected
Tampering is flagged when the current time is more than 24 hours before the last-seen timestamp. A 24-hour grace window is allowed so ordinary time-zone differences and legitimate clock corrections do not trigger a false alarm.
| Situation | Result |
|---|---|
| Clock moves forward normally | No issue; last-seen advances. |
| Small backward adjustment (within 24 hours) | Tolerated by the grace window. |
| Clock set back more than 24 hours before last-seen | Reported as clock tampering. |
Checking clock status
Any signed-in user can query whether clock tampering has been detected; the check returns a simple "clock is valid" or "clock tampering detected" result. The background integrity monitor performs the same comparison and, if it finds a rollback, records a persistent warning event for administrators to review.
What tampering does and does not do
- Detection is recorded as tamper evidence and surfaced to administrators; it is a warning, not a lockout.
- It does not, by itself, delete data or disable the product. It exists so that rolling the clock back cannot quietly extend an expired license without leaving a trace.
- Clearing the last-seen or first-activation timestamps on an already-activated license is itself treated as a possible attempt to defeat this check and is flagged.
Tip: Keep the host's clock synchronized (for example, via NTP). Accurate time avoids spurious tamper warnings and keeps expiry enforcement correct.
Related
- License expiry and renewal
- License integrity self-healing for administrators
- Viewing current license status and usage
- Updating or replacing a license
