Windows 2000 Security Architecture

Peter Brundrett Program Manager Windows 2000 Security

Microsoft Corporation

Topics

Single Sign-on Kerberos v5 integration Active Directory security Delegation of authentication Public key infrastructure Encrypting file system Network security Security policy Secure Windows

Platform Security Requirements

Single enterprise logon Strong authentication Authorization Secure communications Mandatory policy Auditing Interoperability Extensible architecture

Goal: Deliver Windows 2000 as the most secure high volume OS

Windows 2000
Single Sign On

Single account store in Active Directory Integrated Kerberos v5 logon Protected store for public key credentials Industry standard network security protocols

Key Distribution Center (KDC)

Kerberos, SSL/TLS, others

Smart Card Logon

1. Insert smart card to reader, activate card with PIN 2. Private key and certificate on card authenticates user to KDC Windows 2000 Active Directory

TGT

3. KDC returns TGT response protected by Users public key certificate

4. Account control option requiring smart card logon per user

Key Distribution Center (KDC)

Windows 2000 Domain Controller

Kerberos V5 Integration
Client Server

Kerberos SSPI provider manages credentials and security contexts

Service ticket authorization data supports NT access control model

KDC relies on the Active Directory as the store for security principals and policy

Windows 2000 Active Directory Key Distribution Center (KDC)

Windows 2000 Domain Controller

Kerberos Authentication
Mutual Authentication
Application Server (target)
4. Present service ticket at connection setup Target 1. Publish Service Connection Point and SPN

2. Lookup Service, Compose SPN

TGT

Windows 2000 Active Directory

3. Request service ticket for <spn> 5. Mutual auth using unique session key

Key Distribution Center (KDC)

Windows 2000 domain controller

Secure Distributed Services Model

Client request
Authenticate Client

Secure Distributed Service Impersonate Client

Private Data Store

Get clients access token

Get objects security descriptor

Kernel access check

Return response

Remote File Access Check

Client File application Rdr SSPI Kerberos SSP
Ticket
Token

\\infosrv\share Server Kerberos SSP NTFS

SD

SMB protocol

Token

Access check

File

KDC

Windows 2000 Integration

Kerberos Authentication Use

LDAP to Active Directory CIFS/SMB remote file access Secure dynamic DNS update System management tools Host-host IP security using IKE Secure Intranet web services in IIS Authenticate certificate request to Enterprise CA COM+/RPC security provider

Cross-platform Interoperability

Based on Kerberos V5 Protocol

RFC 1510 and RFC 1964 token format Testing with MIT Kerb V5 UNIX clients to Unix Servers UNIX clients to Windows Servers NT clients to UNIX Servers UNIX realm to Windows domain

Windows 2000 hosts the KDC

Cross-realm authentication

Architecture For Multiple Authentication Services

Remote file CIFS/SMB COM+ application Secure RPC Internet Explorer, Internet Information Server HTTP Directory enabled apps using ADSI Mail, Chat, News

LDAP

POP3, NNTP

SSPI
NTLM/ NTLMv2 Kerberos

SChannel SSL/TLS

MSV1_0/ SAM

KDC/DS

Windows 2000 Active Directory

Domain hierarchy: domain tree

Organizational Unit (OU) hierarchy within a domain Users, groups, machines Domain configuration
OU OU Users

Active Directory
Authentication and Access Control

LDAP v3 is core directory access protocol

Authenticate using SASL and Kerberos protocol LDAP with SSL/TLS support Security
Descriptor

Bind Request

OU OU Users

Every object has a unique ACL

Like NTFS folders and files

Active Directory
Security administration

Delegation of administration

Grant permissions at organizational unit (OU) level Who creates OUs, users, groups, etc.
Grant or deny permissions on perproperty level, or a group of properties Read property Write property

Fine-grain access control

Per-property auditing

Secure Applications

Connection Authentication

Establish Credentials Mutual authentication of client and server

Message privacy and integrity

Secure Communication

Impersonation and Delegation

Assuming clients identity

Using security descriptors

Authorization and Auditing

Example: Delegation in Action

1. 401 Access Denied WWW-Authenticate: Negotiate 4. IIS impersonates client, invokes ISAPI extension

IIS
3. WWW-Authenticate: ISAPI Negotiate <blob>
2. Ticket request to KDC

SQL Server

Server-A
Server-B 5. ASP uses ADO to 6. SQL Server query SQL, impersonates integrated security original client, requests ticket then data access

Interoperability
Cross Platform Secure 3-Tier App
Windows 2000 Professional Smart Card Logon

Windows 2000 Server

Web Server

Solaris UNIX Server Oracle DB Application

IE5 SSPI/Krb

IIS
HTTP

ISAPI Extension

TCP

App Service GSS/Krb

SSPI/Krb

Public Key Components

For servers Key and certificate management Secure channel with Client authentication Auto enrollment
Windows 2000 Active Directory

For clients User key and certificate mgmt Secure channel Secure storage CA enrollment Enterprise Certificate services Trust policy

Certificate Server

SSL Client Authentication

Server
Client certificate SChannel SSP Access token ACL

Server resources

Certificate Store of Trusted CAs

Authentication service

Domain Org (OU)

Users

1. Verify user certificate based on trusted CA, CRL 2. Locate user object in directory by subject name 3. Build NT access token based on group membership 4. Impersonate client, object access verification

Crypto API Architecture

Application
Secure channel

Certificate management services Crypto API 1.0

Certificate store

RSA base CSP

Fortezza SmartCard CSP CSP

Key database

Cryptographic Service Providers

Encrypting File System

Privacy of data that goes beyond access control

Protect confidential data on laptops Configurable approach to data recovery

Integrated with core operating system components

Windows NT File System - NTFS Crypto API key management LSA security policy

Transparent and very high performance

EFS Architecture
Applications Win32 layer
Crypto API User mode Kernel mode I/O manager

EFS service

LPC communication for all key management support

NTFS

EFS

Encrypted on-disk data storage

File Encryption
A quick brown fox jumped...

File encryption (DESX)

Data decryption field generation (RSA) Data recovery field generation (RSA)

*#$fjda^j u539!3t t389E *&

DDF

Users public key

DRF

Randomlygenerated file encryption key

RNG

Recovery agents public key in recovery policy

File Decryption
*#$fjda^j u539!3t t389E *& Users private key

File decryption (DESX)

File encryption key

A quick brown fox jumped...

DDF extraction (e.g., RSA)

DDF contains file encryption key encrypted under users public key

DDF is decrypted using the private key to get to the file encryption key

DDF

Secure Networking

Internet Protocol Security (IPSec) Extended Authentication Protocol/PPP Token and SmartCard support Remote Authentication Dial In User Service (RADIUS) Kerberos security package Public key (SSL/TLS) security package

Windows 2000 IPSec

Target Scenarios

Remote Access User to Corporate Network

Dial Up from Laptop or Home Using existing network connectivity to Internet

IP Tunnel
Corporate Network

Laptop or Home PC

A
Host

C
Internet Service Provider
Router or Tunnel Server Internet

Host

B
Host

Modems

Windows 2000 IPSec

Target Scenarios

LAN Edge Gateway to Edge Gateway of Another LAN

Across Internet or private network with Windows 2000 <> Windows 2000 routers using IP tunnels IPSec Tunnel Mode L2TP/IPSec integrated tunneling

Corporate Net in LA

IP Tunnel

Corporate Net in DC

A
Host
Router C

Router D

B
Host

Internet

IP Security

Host-to-host authentication and encryption

IP Security Policy

Network layer

IP security policy with domain policy

Negotiation policies, IP filters

PA

PA

Policy Agent
Downloads

IPSEC

policy

Source: 157.55.00.00 Dest: 147.20.00.00 Any protocol

IP Security Association
using Kerberos Authentication
Used for SMB data encryption KDC
Windows NT Directory Server

157.55.20.100 IKE TCP IP SA SA

147.20.10.200

IKE
TCP IP

Managing Security Policy

Security settings in local or group policy Local computer policy

Audit policy, rights, security options Common computer policies

Group Policy in the directory

Domain level policies

Account policies Public key trust policies

Hierarchical Policy Settings

1 2 3

Domain level policy OU level policy OU level policy

Applied policy for a computer combines multiple policy objects

Enterprise Framework

Integrated with Group Policy management

Security settings in group policy Settings applied as part of policy enforcement on each computer

Secure Windows

Goals

Secure out-of-the-box Definition of secure system settings Backward compatible user experience
Upgrade can apply security configuration Administrators, Power Users, Users Group membership defines access

Clean install of Windows 2000

Who can do what?

Administrators vs. Users

Administrators

Full control of the operating system Install system components, drivers Upgrade or repair the system Cannot compromise system integrity Read-only access to system resources Interactive and network logon rights Can shutdown desktop system Legacy application issues

Users

Security Features Summary

Single sign on with standard protocols

Kerberos V5 and X.509 V3 certificates

Enterprise services for PKI rollout Authentication, authorization, auditing Scalable, extensible user account directory

Public key certificate management

Distributed security for applications

Active Directory integration

For More Information

White papers

http://www.microsoft.com/windows2000/library Active Directory Security Services

Deployment Guide Detail technical material http://www.microsoft.com/security

Windows 2000 Resource Kit

Microsoft Security Advisor