Inventors:
Ivan Davtchev - Seattle WA, US
Karan Dhillon - Renton WA, US
Nir Zvi - Redmond WA, US
Aaron Goldsmid - Seattle WA, US
Ping Xie - Bellevue WA, US
Yifat Sagiv - Redmond WA, US
Assignee:
Microsoft Corporation - Redmond WA
International Classification:
H04L 9/00
Abstract:
A security flag stored in a trusted store is utilized to determine if the trusted store has been subjected to tampering. The security flag is indicative of a globally unique identifier (GUID), the version of the trusted store, and a counter. The security flag is created when the trusted store is created. Each time a critical event occurs, the security flag is updated to indicate the occurrence thereof. The security flag also is stored in a write-once portion of the system registry. At appropriate times, the security flag stored in the trusted store is compared with the corresponding security flag stored in the write-once registry. If the security flags match within a predetermined tolerance, it is determined that the trusted store has not been subjected to tampering. If the security flags do not match, or if a security flag is missing, it is determined that the trusted store has been subjected to tampering.