Presentation is loading. Please wait.

Presentation is loading. Please wait.

File System and Full Volume Encryption Sachin Patel CSE 590TU 3/9/2006.

Similar presentations

Presentation on theme: "File System and Full Volume Encryption Sachin Patel CSE 590TU 3/9/2006."— Presentation transcript:

1 File System and Full Volume Encryption Sachin Patel CSE 590TU 3/9/2006

2 Encrypting File System Protects sensitive data on computers and laptops from physical theft. Encryption at a lower level that all applications can use. EFS introduced in Windows 2000 Tied to the NTFS file system Encrypt individual files or folders

3 Encrypting File System Data encrypted with symmetric file encryption key (FEK)  DESX, 3DES, AES  Cipher block chaining FEK encrypted with user’s public key (RSA) Multiple users Recovery Agent in case user private key lost Header Version Checksum Data Decryption Field DDF Key Entry 1 … DDF Key Entry n Data Recovery Field DRF Key Entry 1 … DRF Key Entry n User SID Container Name Provider Name EFS Certificate Hash Encrypted FEK Key Entry:

4 EFS Security Issues On standalone system, all keys that protect the private key potentially on hard disk  EFS Private key  Master key  Password key  Syskey  Recommend removing syskey from system with floppy or password  Smartcard support planned for Vista Can’t encrypt system files, registry, file name, or page file  Allows attacker to boot system  File names can reveal information  Page file might accidentally store sensitive data

5 Full Volume Encryption Encryption at the block driver level underneath file system. Everything in the volume is encrypted. BitLocker in Vista BitLocker takes advantage of Trusted Platform Module (TPM)  Top level root key sealed in TPM  Root key encrypts disk encryption key, which encrypts sector data

6 BitLocker Secure Startup  Ensures boot integrity of the Windows volume before unsealing root key.  Verifies none of the boot code or critical system files have been tampered with offline.  Taking measurements of critical information at each step of the boot process.  Compare hash of measurements to hash of known secure system.  Recovery mechanism – removable storage or password BitLocker and EFS not mutually exclusive  BitLocker can protect system volume and root keys.  EFS can provide file granularity and multiple user control.

7 Questions?

Download ppt "File System and Full Volume Encryption Sachin Patel CSE 590TU 3/9/2006."

Similar presentations

Ads by Google