HP Compaq dx5150 SFF Manual

HP ProtectTools Embedded
Security Guide
HP Business Desktops
dx5150 model
Document Part Number: 376352-001
December 2004
This guide provides instructions for using the software that allows
you to configure settings for the HP ProtectTools Embedded Security
chip.

© Copyright 2004 Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
Microsoft and Windows are trademarks of Microsoft Corporation in the U.S.
and other countries.
The only warranties for HP products and services are set forth in the express
warranty statements accompanying such products and services. Nothing herein
should be construed as constituting an additional warranty. HP shall not be liable
for technical or editorial errors or omissions contained herein.
This document contains proprietary information that is protected by copyright.
No part of this document may be photocopied, reproduced, or translated to
another language without the prior written consent of Hewlett-Packard
Company.
ÅWARNING: Text set off in this manner indicates that failure to follow
directions could result in bodily harm or loss of life.
ÄCAUTION: Text set off in this manner indicates that failure to follow
directions could result in damage to equipment or loss of information.
HP ProtectTools Embedded Security Guide
First Edition (December 2004)
Document Part Number: 376352-001

HP ProtectTools Embedded Security Guide www.hp.com iii
Contents
HP ProtectTools Embedded Security
Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Basic ProtectTools Embedded Security Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
HP ProtectTools Embedded Security Chip. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Personal Secure Drive. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Email. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Enhanced Encrypted File System (EFS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Users and Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Digital Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Public Key and Private Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Emergency Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Setup Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Enabling the Chip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Initializing the Embedded Security Chip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Setting Up a User Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Commonly Performed Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
User Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Administrator Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

HP ProtectTools Embedded Security Guide www.hp.com 1
HP ProtectTools Embedded Security
The HP ProtectTools Security Manager is the software that allows
you to configure settings for the HP ProtectTools Embedded Security.
The Manager is an interface (shell) that points to the various options
available in the Embedded Security software. HP ProtectTools
Embedded Security is the software suite that includes the Personal
Secure Drive (PSD), encryption/TPM chip interface, security
migration, archive creation, and password control.
Requirements
In order to use the security features, the following tools are required:
■HP ProtectTools Embedded Security software
■HP ProtectTools Security Manager software
■HP ProtectTools Embedded Security chip installed on the
computer
For information on setting up the Embedded Security solution, see
“Setup Procedures” on page 8.

2 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
Basic ProtectTools Embedded Security Concepts
This section contains high-level information on concepts you should
understand in order to use HP ProtectTools Embedded Security and
HP ProtectTools Security Manager.
HP ProtectTools Embedded Security Chip
The Embedded Security chip is a hardware component that offers
security and encryption features and provides a tamper-proof storage
area for protecting public and private keys. The chip is
factory-installed and should not be accessed or removed except by
HP authorized service providers.
Personal Secure Drive
One feature of Embedded Security is the Personal Secure Drive
(PSD). The PSD is a virtual drive that is created on the hard drive
during the HP ProtectTools Embedded Security User initialization
process. It provides a protected storage area for sensitive data. The
PSD allows you to create and access files and folders, just like other
drives.
Access to the PSD requires both physical access to the computer on
which the PSD resides and the PSD password. When you enter your
PSD password, the PSD becomes visible and the files become
available for use. The files remain accessible until you log off, at
which time the PSD automatically hides its presence. PSDs cannot be
accessed from a network.
Encrypted data is stored on the PSD. The keys used to encrypt the
files are stored on the HP ProtectTools Embedded Security chip,
ensuring the data is protected from unauthorized users and is
“locked” to the computer. This means that the protected data can only
be accessed on the target computer.

HP ProtectTools Embedded Security Guide www.hp.com 3
HP ProtectTools Embedded Security
Email
Secure email is another significant feature of Embedded Security. It
allows users to share information confidentially and to be certain that
the authenticity of the information is maintained during transfer.
Secure email allows you to:
■Select a public key certificate issued by a Certification Authority
(CA).
■Digitally sign messages.
■Encrypt messages.
HP ProtectTools Embedded Security and HP ProtectTools Security
Manager enhance secure email functionality by providing additional
protection for the key used to encrypt, decrypt, and digitally sign
messages. They enhance the security of email when the following
email clients are used:
■Microsoft Outlook Express (version 4 or higher)
■Microsoft Outlook 2000
■Microsoft Outlook 2002
■Netscape Messenger 4.79
■Netscape Messenger 7.0
For instructions on using email clients, refer to the HP ProtectTools
Embedded Security Email Integration Help.

4 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
Enhanced Encrypted File System (EFS)
EFS is the file encryption service offered by Microsoft Windows
2000 and Windows XP Professional. EFS provides data privacy by
offering the following functionality:
■Encryption of files by the user when stored on a disk
■Quick and easy access to encrypted files
■Automatic (and transparent) encryption of data
■Ability for the system administrator to recover data encrypted by
another user
HP ProtectTools Embedded Security and HP ProtectTools Security
Manager enhance the EFS by providing additional protection for the
key used to encrypt and decrypt data.
For more information on EFS, refer to the operating system online
Help.
Users and Administrators
Users
Users have basic access to Embedded Security and may:
■send and receive encrypted email
■encrypt files and folders
■initialize personal Basic User key
■create, delete, or modify personal user account within the
embedded security
■configure, create, use, and delete individual PSD

HP ProtectTools Embedded Security Guide www.hp.com 5
HP ProtectTools Embedded Security
Administrators
Administrators initialize the Embedded Security solution on a
computer and may:
■configure the local machine and user policies of Embedded
Security
■prepare user keys and certificates for migration
■change the Embedded Security owner password
■disable and enable Embedded Security
■authorize destination computers for user key and certificate
migration
■recover data that was stored and encrypted using Embedded
Security
For more information on Embedded Security users and
administrators, refer to the operating system online Help. For more
information on Embedded Security owners, refer to the HP
ProtectTools Embedded Security Help.
Digital Certificates
Digital certificates are a form of electronic “keys” that confirm the
identity of an individual or company. Keys are numbers or strings of
characters known only to the sender and/or recipient. A digital
certificate authenticates the digital certificate owner by providing a
digital signature that attaches to email sent by the owner of the digital
certificate.
A digital certificate is issued by a Certification Authority (CA) and
contains the following information:
■Owner's public key
■Owner's name
■Expiration date of the digital certificate
■Serial number of the digital certificate
■Name of the CA that issued the digital certificate
■Digital signature of the CA that issued the digital certificate

6 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
Digital Signature
A digital signature displays the name of the CA issuing the digital
certificate. It is used to:
■verify the identity of the sender of a digital document.
■certify that the contents were not modified after the sender
digitally signed the document.
For more information on digital signatures, refer to the operating
system online Help.
Public Key and Private Key
Asymmetric cryptography, which is a method used by Embedded
Security to encrypt information, requires the use of 2 keys, a public
key and a private key.
A public key can be freely distributed to many users, whereas a
private key is held by only one user.
For example, to send encrypted email, User A would use the public
key (freely available) from User B to encrypt the contents of the
email sent to User B. Since User B has sole possession of his private
key, he is the only one that can decrypt the contents of the email sent
from User A.
Public key-enabled technology allows you to transmit private
information over public networks, use digital signatures to ensure the
authenticity of your email, and provides authentication between a
server and a client.

HP ProtectTools Embedded Security Guide www.hp.com 7
HP ProtectTools Embedded Security
Emergency Recovery
The Emergency Recovery Archive, created by the administrator
during Embedded Security setup, is a file that stores sensitive
information about the computer, its users, and the private keys used to
protect encrypted or private data. In the case of a system failure, this
sensitive information is required to restore access to protected data.
An Emergency Recovery Token, also created by the administrator
during Embedded Security setup, is a file that stores the keys used to
protect the data in the Emergency Recovery Archive. The token is
required to access the archive. The access to the Emergency Recovery
Token is protected by a password. This password is required in case
the Embedded Security system needs to be restored.
Policies
Policies are rules that govern the behavior of a computer or software.
The system administrator generally specifies security policies to
ensure consistent use of Embedded Security within an organization.
The two types of security policies are machine policies and user
policies.
Machine Policies
Machine policies are rules governing the overall behavior of
Embedded Security as it relates to a specific computer.
User Policies
User policies are rules governing the rights of the user of Embedded
Security.
For more information on machine and user security policies, refer to
the HP ProtectTools Embedded Security Help.

8 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
Setup Procedures
Follow these steps to enable and initialize the Embedded Security
chip through the Computer Setup utility in the system BIOS:
ÄCAUTION: To prevent a security risk, HP recommends that a person
authorized by your organization immediately initialize the Embedded
Security chip (see step 4). Failure to initialize the Embedded Security chip
could result in an unauthorized user, a computer worm, or a virus taking
ownership of the system.
✎The BIOS supervisor password must be established in Computer
Setup before the chip configurations can be accessed. For more
information, see the Computer Setup (F10) Utility Guide on the
Documentation CD that shipped with the computer.
Enabling the Chip
1. Turn on or restart the computer. If you are in Microsoft Windows,
click Start > Shut Down > Restart.
2. As soon as the computer is turned on, press and hold F10 until
you enter Computer Setup.
✎If you do not press F10 at the appropriate time, you must restart the
computer and press and hold F10 to access the utility.
3. Use the arrow keys to select Set Supervisor Password and press
Enter.
4. Type a supervisor password and press Enter.
5. Restart the computer. If you are in Microsoft Windows, click
Start > Shut Down > Restart.
6. As soon as the command prompt Press any key to enter TPM
Configuration appears, press a key.
7. Enter the supervisor password and press Enter.
8. Press Eto enable the TPM chip.
The chip is now enabled.

HP ProtectTools Embedded Security Guide www.hp.com 9
HP ProtectTools Embedded Security
Initializing the Embedded Security Chip
✎In most cases, the IT System Administrator initializes the Embedded
Security chip.
1. Right-click the HP ProtectTools icon in the system tray, then
left-click Embedded Security Initialization.
The HP ProtectTools Embedded Security Initialization
Wizard appears.
2. Click Next.
3. Type and confirm a Take Ownership password, then click Next.
✎Type carefully; for security reasons, the characters typed do not
appear on the screen.
4. Click Next to accept the default Recovery archive location.
5. Type and confirm an Emergency Recovery Token password, then
click Next.
6. Click Browse and select the appropriate destination.
ÄCAUTION: The Emergency Recovery Token Key is used to recover
encrypted data in the event of a computer or embedded security chip
failure. The data cannot be recovered without the key. (The data still
cannot be accessed without the Basic User password.) Store this Key in a
safe place.
7. Click Save to accept the location and the default file name, then
click Next.
8. Click Next to confirm settings before the Security Platform is
initialized.
ÄCAUTION: A message may be displayed to say that the Embedded
Security features are not initialized. Do not click in the message; this is
addressed later in the procedure and the message will close after a few
seconds.

10 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
9. If the user account is to be set up now, make sure the Start
Embedded Security User Initialization Wizard check box is
selected. Click Finish.
Setting Up a User Account
Setting up a user account:
■produces a Basic User key that protects encrypted data
■sets up a PSD for storing encrypted files and folders
ÄCAUTION: Safeguard the Basic User password. Encrypted data cannot
be accessed or recovered without this password.
To set up a Basic User account and enable the user security features:
1. If the Embedded Security User initialization Wizard is not
open, right-click the HP ProtectTools icon in the system tray,
then left-click Embedded Security User Initialization.
The Embedded Security User initialization Wizard appears.
2. Click Next.
3. Type and confirm a Basic User Key password, then click Next.
✎Type carefully; for security reasons, the characters typed do not
appear on the screen.
4. Click Next to confirm settings.
5. Select the appropriate Security Features and click Next.
6. Click Next to skip Help files.
7. If more than one Encryption Certificate exists, click the
appropriate certificate.
Click Next to apply the Encryption Certificate.
8. Configure the PSD with appropriate settings and click Next.
9. Configure the PSD again with appropriate settings and click
Next.

HP ProtectTools Embedded Security Guide www.hp.com 11
HP ProtectTools Embedded Security
✎The minimum size of the PSD is 50 MB; the maximum size is
2,000 MB.
10. Click Next to confirm settings.
✎Depending on the size of the PSD, the computer could take a few
minutes to process the confirmation.
11. Click Finish.
12. Click Ye s to restart the computer.
Commonly Performed Tasks
This section discusses basic tasks that are most often performed by a
user and an owner.
User Tasks
Basic user tasks include setting up the PSD, encrypting files and
folders, and sending and receiving email by encryption and/or digital
signatures.
Using the PSD
To use the PSD, enter your PSD password. The PSD becomes visible
and the files are decrypted. The PSD may be used like any other
drive.
When you are finished using the PSD, log off properly. The PSD
automatically hides its presence.

12 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
Encrypt Files and Folders
When working with EFS in Windows 2000 and Windows XP
Professional, consider the following:
■Only files and folders on NTFS partitions can be encrypted.
(Files and folders on FAT partitions cannot be encrypted.)
■System files and compressed files cannot be encrypted, and
encrypted files cannot be compressed.
■Temporary folders should be encrypted, as temporary files are
potentially of interest to attackers.
■A recovery policy is automatically set up when users encrypt a
file or folder for the first time. This ensures that users who lose
their certificates and private keys are able to use a recovery agent
to decrypt their data.
To encrypt files and folders:
1. Select the file or folder you want to encrypt.
2. Right-click the mouse or Touchpad.
3. Click Encrypt.
4. Click either Apply changes to this folder only or Apply
changes to this folder, subfolder and files.
5. Click OK.

HP ProtectTools Embedded Security Guide www.hp.com 13
HP ProtectTools Embedded Security
Send and Receive Email by Encryption and/or Digital Signatures
For instructions on digitally signing and encrypting email, refer to the
email client online Help.
✎To use secure email, you must first configure the email client to use a
digital certificate that is created with Embedded Security. If a digital
certificate is not available, you must obtain one from a Certification
Authority. For instructions on configuring your email and obtaining a
digital certificate, refer to the email client online Help.
To send an encrypted email message, you will need a copy of the
recipient's public key or encryption certificate. (The certificate
contains a copy of the recipient's public key.)
Microsoft Outlook uses the recipient's public key to encrypt your
email; therefore you are not requested to insert your private key.
However, you do need your private key to read an encrypted email
because the decryption requires the private key that corresponds to
the public key used to encrypt the email.
Administrator Tasks
The administrator can perform a number of tasks, some of which are
described below. For more information, refer to the HP ProtectTools
Embedded Security Help.
Migrate Keys through the Computer Security Migration Wizard
Migration is an advanced administrator task that allows the
management, restoration, and transfer of keys and certificates.
The first step of migration is the authorization, setup, and
management of the migration process. Once authorization is
complete, the user exports and imports keys and certificates from the
source computer to the destination computer.
For details on migration, refer to the HP ProtectTools Embedded
Security Help.

14 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
Recover Information
In the event of chip failure or reset:
■The Emergency Restore Wizard can be used to recover data from
the PSD.
■The PSD also supports recovery by using a recovery agent, which
is a mechanism similar to Encryption File Systems (EFS).
To determine if you have a registered recovery agent on the
computer, click Start > All Programs > Administrator Tools >
Local Security Policy > Public Key Policies > Encrypted Data
Recovery Agents.
For more information, refer to the operating system online Help.
✎Windows XP Professional does not automatically create a registered
recovery agent. Follow the operating system instructions for setting
up the registered recovery agent.
To recover data, the registered recovery agent must have the digital
certificate and the keys. You should export the data recovery
certificate and private key to disc, store them in a safe place, and
delete the data recovery private key from the computer. The only
person who can recover data is the person who has physical access to
the data recovery private key.

HP ProtectTools Embedded Security Guide www.hp.com 15
HP ProtectTools Embedded Security
Restore the Embedded Security Chip to the original factory
settings through Computer Setup
ÄCAUTION: This task releases ownership of the Embedded Security chip.
Once ownership is released, anyone can initialize the Embedded
Security chip.
Restoring the Embedded Security chip to its original factory settings may
result in data loss if you have encrypted files.
To return the Embedded Security chip to its original factory settings:
1. Turn on or restart the computer. If you are in Microsoft Windows,
click Start > Shut Down > Restart.
2. As soon as the command prompt Press any key to enter TPM
Configuration appears, press a key.
3. Enter the supervisor password and press Enter.
4. Press Cto clear the TPM chip.
5. Press Yto confirm.
The chip is now cleared.
Best Practices
HP recommends following these guidelines when using Embedded
Security.
■An IT security administrator should set up the BIOS supervisor
password in Computer Setup and initialize the Embedded
Security chip before distributing the computer to users.
■An IT security administrator should set up the Emergency
Recovery Archive during the process of setting up the Embedded
Security solution and encourage users to save and backup data
regularly. In case of system failure, this is the only way to recover
encrypted data. The Emergency Recovery Archive and
Emergency Recovery Token should be stored separately.
■Encrypt folders instead of individual files so that temporary files
that are created during editing are encrypted as well.

16 www.hp.com HP ProtectTools Embedded Security Guide
HP ProtectTools Embedded Security
■Encrypt sensitive data on computers that are members of a
domain. This protects against compromise of data through offline
cryptographic attacks.
■Regularly back up the entire server that stores server-based
encrypted data. This ensures that in the event of data recovery,
the profiles that include decryption keys can also be restored.
■If you are encrypting file types that are monitored by System
Restore, put the files on a volume that is not monitored by System
Restore.
■The system does not support multiple levels of encryption. For
example, a user should not store an EFS encrypted file in the
PSD, nor try to encrypt a file already stored in the PSD.