Windows 10 Secure Storage

Question

In Windows 10, is there a secure storage mechanism analogous to the Android TrustZone?

Where the data is encrypted and stored in a location separate from regular user file space?

I'm looking to store data from an application that doesn't need to be accessed by any other user or application, and I don't really want to just encrypt it and store it on the disk.

Any thoughts?

Answer 1

With Windows being an open platform (unlike non-rooted Android - I am talking about the user point of view now) there's no simple way to store anything on the disk (or elsewhere for this matter) and have it protected from user's access. The user is essentially the owner of everything in his PC and on its disk.

The best you can do is use CryptProtectData / CryptUnprotectData WinAPI functions to "bind" the data to the user account. These APIs don't store the data, but just encrypt it with the key, derived from the user credentials. You then can store this encrypted data in user's profile directory.