Windows SAM File Protection via Virtual Floppy and TPM Seal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for protecting Security Accounts Manager (SAM) files in Windows operating systems, such as using the syskey utility, are inconvenient and prone to loss when the encryption key is stored on a floppy disk, and lack a reliable recovery mechanism for TPM-based encryption.
Innovation Solution
A SAM file encryption key is generated using the syskey utility and stored in a virtual floppy disk, with a blob created by a TPM Seal command and stored in non-volatile memory, and a backup encrypted using an Advanced Encryption Standard (AES) key derived from the administrator password for recovery purposes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the encryption key is stored on a floppy disk, then the security protection of SAM files is improved, but the convenience of system access deteriorates and the risk of key loss increases
Solution Approach 1:
The patent replaces the mechanical floppy disk storage system with a virtual floppy disk implemented in software within the Windows operating system. This substitution eliminates the need for physical media while maintaining the security functionality, allowing the encryption key to be accessed conveniently without physical disk insertion or removal.
Solution Approach 2:
The patent introduces a virtual floppy disk as an intermediary between the physical hard drive and the encryption key requirements. This virtual medium provides the same security interface as a physical floppy disk but stores data in a convenient, always-accessible location within the operating system memory, resolving the contradiction between security and convenience.
2Reliability
If multiple copies of floppy disks are created for backup, then the reliability of key access is improved, but the risk of key loss increases
Solution Approach 1:
The patent creates multiple virtual copies of the encryption key within the virtual floppy disk system. These copies are stored in protected memory locations and can be retrieved without the risks associated with physical floppy disks, such as loss, damage, or incompatibility. The virtual copying mechanism ensures reliable access while eliminating physical loss risks.
3Reliability
If the syskey utility is used to encrypt SAM files, then the security protection is improved, but the device complexity increases
Solution Approach 1:
The patent integrates the virtual floppy disk functionality directly into the Windows operating system, making it a universal solution that works across different Windows versions (95, 98, NT, 2000, XP). This multi-functional approach consolidates security features within the existing OS architecture rather than requiring separate external systems, reducing overall complexity while maintaining security.
Data Source
AI summary
A method for protecting Security Accounts Manager (SAM) files within a Windows® operating system is disclosed. A SAM file encryption key is generated by encrypting a SAM file via a syskey utility provided within the Windows® operating system. The SAM file encryption key is then stored in a virtual floppy disk by selecting an option to store SAM file encryption key to a floppy disk under the syskey utility. A blob is generated by performing a Trusted Platform Module (TPM) Seal command against the SAM file encryption key along with a value stored in a Performance Control Register and a TPM Storage Root Key. The blob is stored in a non-volatile storage area of a computer.