Introducing Trusted Platforms

Both Microsoft Windows XP and Windows Vista include the Encrypting File System (EFS) for encrypting files and folders. Using EFS, you can protect your sensitive data so that it can be accessed only by using your public key infrastructure (PKI) certificate. Encryption certificates are stored as part of the data in your user profile. As long as you have access to your profile and the encryption key it contains, you can access your files.

While EFS offers excellent protection for you data, it doesn’t safeguard the computer from attack by someone who has access to the console. In a situation where you’ve lost your computer, your computer has been stolen, or an attacker is logging on to your computer, EFS might not protect you, because the unauthorized user might be able to gain access to the computer before it starts up. He could then access the computer from another operating system and change your computer’s configuration. He might then be able to hack into your account so that he can log on as you or configure the computer so that he can log on as a local administrator. Either way, the unauthorized user could eventually gain full access to your computer and your data.

To seal a computer from physical attack and wrap it in an additional layer of protection, Windows Vista includes the Trusted Platform Module Services architecture. Using Trusted Platform Module Services architecture, you can create a trusted platform with enhanced security and within which your computer’s data is protected even when the operating system is offline. How the Trusted Platform Module Services architecture does this and how you can use Trusted Platform Module Services architecture is what this section is all about.

In Windows Vista, Trusted Platform Module Services provide the infrastructure necessary to take advantage of Trusted Platform Module (TPM) Security Hardware. Trusted Platform Module Services protect a computer by using a dedicated hardware component called a TPM. A TPM is a microchip that is usually installed on the motherboard of a computer, where it communicates with the rest of the system by using a hardware bus. Computers running Windows Vista can use a TPM to provide enhanced protection for data, to ensure early validation of the boot file’s integrity, and to guarantee that a disk has not been tampered with while the operating system was offline.

A TPM has the ability to create cryptographic keys and encrypt them so that they can be decrypted only by the TPM. This process, which is referred to as wrapping or binding, protects the key from disclosure. A TPM has a master wrapping key called the Storage Root Key (SRK), which is stored within the TPM itself to ensure that the private portion of the key is secure.

Increasingly, new business computers have TPMs installed. Computers that have a TPM can create a key that has not only been wrapped but also sealed. The process of sealing the key ensures that the key is tied to specific platform measurements and can be unwrapped only when those platform measurements have the same values that they had when the key was created, and this is what gives TPM-equipped computers increased resistance to attack.

The TPM can also be used to seal and unseal data that is generated outside of the TPM, and this is where the true power of the TPM lies. In Windows Vista, the feature that accesses the TPM and uses it to seal your computer is called BitLocker Drive Encryption.

When you use BitLocker Drive Encryption and a TPM to seal the boot manager and boot files of a computer, the boot manager and boot files can be unsealed only if they are unchanged since they were last sealed. This means that you can use the TPM to validate a computer’s boot files in the pre-operating system environment. When you seal a hard disk by using the TPM, the hard disk can be unsealed only if the data on the disk is unchanged since it was last sealed. This guarantees that a disk has not been tampered with while the operating system was offline.

From the experts: Should you use BitLocker?

BitLocker makes your data more secure in the event an attacker is able to bypass operating system security and directly access your data. In other words, BitLocker can safeguard your computer if an attacker has physical access to your computer. That’s very important to business travelers because confidential data can be leaked when someone loses a laptop.

However, BitLocker is not without its drawbacks. First, you need a way to manage the encryption key because, if you lose the key, you can’t start your computer or access your files. While enterprises that use domains can centrally manage BitLocker keys using Active Directory, no similar solution is available for using BitLocker in workgroup environments. Second, recovering a computer is more difficult when BitLocker is enabled. Normally, if a hard disk is starting to fail or you’ve removed a hard disk from a computer, you can connect the hard disk to a different computer to copy and recover the data. With BitLocker, you can’t do this easily, and you must first unlock the drive. Because of this, regular backups are a must (which can be a challenge for traveling users). Finally, BitLocker only protects your computer when it is off. That means BitLocker won’t protect your computer from malicious software or attackers on the Internet.

With those factors in mind, you should use BitLocker in enterprise environments where the risk of data theft is greater than the cost of managing the encryption keys.

Tony Northrup

Author, MCSE, and MVP—For more information, see http://www.northrup.org.