Method for protecting security accounts manager (SAM) files within windows operating systems

1. A method for protecting a Security Accounts Manager (SAM) file within a Windows® operating system, said method comprising:

generating a SAM file encryption key by encrypting a SAM file via a syskey utility provided within said Windows® operating system;

storing said SAM file encryption key to a virtual floppy disk by selecting an option to store SAM file encryption key to a floppy disk under said syskey utility;

generating a blob based on said SAM file encryption key, wherein said blob is generated by performing a Trusted Platform Module (TPM) Seal command against said SAM file encryption key along with a value stored in a Performance Control Register and a TPM Storage Root Key; and

storing said blob in a non-volatile storage device of a computer;

retrieving said SAM file encryption key during Power On Self-Test by performing a TPM Unseal command on said blob against said value of stored in said Performance Control Register, wherein retrieving said SAM file encryption key includes tricking said Windows® operating system to read from said virtual floppy disk instead of a physical floppy disk by trapping a read request number to a floppy drive; and

providing said SAM file encryption key to said Windows® operating system during system boot up via interrupt handler.

2. The method of claim 1 , wherein said method further includes providing a TPM within said computer.

3. The method of claim 2 , wherein said method further includes providing a virtual floppy disk device driver within said computer.

4. The method of claim 1 , wherein said method further includes

generating a backup blob by encrypting said SAM file encryption key via an Advanced Encryption Standard key derived from an administrator password; and

storing said backup blob in a removable storage medium.

5. A non-transitory computer recordable medium having a computer program product for protecting Security Accounts Manager (SAM) files within a Windows® operating system, said computer recordable medium comprising:

program code for generating a SAM file encryption key by encrypting a SAM file via a syskey utility provided within said Windows® operating system;

program code for storing said SAM file encryption key to a virtual floppy disk by selecting an option to store SAM file encryption key to a floppy disk under said syskey utility;

program code for generating a blob based on said SAM file encryption key, wherein said blob is generated by performing a Trusted Platform Module (TPM) Seal command against said SAM file encryption key along with a value stored in a Performance Control Register and a TPM Storage Root Key; and

program code for storing said blob in a non-volatile storage device of a computer,

program code for retrieving said SAM file encryption key during Power On Self-Test by performing a TPM Unseal command on said blob against said value of stored in said Performance Control Register, wherein retrieving said SAM file encryption key includes tricking said Windows® operating system to read from said virtual floppy disk instead of a physical floppy disk by trapping a read request number to a floppy drive; and

program code for providing said SAM file encryption key to said Windows® operating system during system boot up via interrupt handler.

6. The computer recordable medium of claim 5 , wherein said computer recordable medium further includes program code for initiating said TPM Seal command within said computer.

7. The computer recordable medium of claim 6 , wherein said computer recordable medium further includes program code for providing a virtual floppy disk device driver within said computer.

8. The computer recordable medium of claim 5 , wherein said computer recordable medium further includes

program code for generating a backup blob by encrypting said SAM file encryption key via an Advanced Encryption Standard key derived from an administrator password; and

program code for storing said backup blob in a removable storage medium.

9. A computer system capable of protecting Security Accounts Manager (SAM) files within a Windows® operating systems, said computer system comprising:

a SAM file encryption key generated by encrypting a SAM file via a syskey utility provided within said Windows® operating system;

a volatile storage device having a virtual floppy disk for storing said SAM file encryption key by selecting an option to store SAM file encryption key to a floppy disk under said syskey utility; and

a non-volatile storage device for storing a blob generated based on said SAM file encryption key, wherein said blob is generated by performing a Trusted Platform Module (TPM) Seal command against said SAM file encryption key along with a value stored in a Performance Control Register and a TPM Storage Root Key;

a processor for retrieving said SAM file encryption key during Power On Self-Test by performing a TPM Unseal command on said blob against said value of stored in said Performance Control Register, wherein retrieving said SAM file encryption key includes tricking said Windows® operating system to read from said virtual floppy disk instead of a physical floppy disk by trapping a read request number to a floppy drive; and

an interrupt handler for providing said SAM file encryption key to said Windows® operating system during system boot.

10. The computer system of claim 9 , wherein said computer system further includes a TPM.

11. The computer system of claim 10 , wherein said computer system further includes virtual floppy disk device driver.

12. The computer system of claim 9 , wherein said computer system further includes

an Advanced Encryption Standard key derived from an administrator password for encrypting said SAM file encryption key to generate a backup blob; and

a removable storage medium for storing said backup blob.