Windows 2000 Security
Architecture
Peter Brundrett
Program Manager
Windows 2000 Security
Microsoft Corporation
Topics
Single Sign-on
Kerberos v5 integration
Active Directory security
Delegation of authentication
Public key infrastructure
Encrypting file system
Network security
Security policy
Secure Windows
Platform Security
Requirements
Single enterprise logon
Strong authentication
Authorization
Secure communications
Mandatory policy
Auditing
Interoperability
Extensible architecture
Goal: Deliver Windows 2000 as
the most secure high volume OS
Windows 2000
Single Sign On
Single account
store in Active Key Distribution
Directory Center (KDC)
Integrated Kerberos
v5 logon
Protected store for
public key
credentials
Kerberos,
Industry standard SSL/TLS,
network security others
protocols
Smart Card Logon
1. Insert smart card to reader,
activate card with PIN
2. Private key and certificate
TGT
on card authenticates user
to KDC
3. KDC returns TGT Windows 2000
response protected Active Directory
by User’s public
key certificate
Key Distribution
4. Account control option Center (KDC)
requiring smart card
logon per user
Windows 2000 Domain Controller
Kerberos V5 Integration
Client Server Service ticket
Kerberos SSPI provider authorization
manages credentials data supports
and security contexts NT access
control model
Windows 2000
Active Directory
KDC relies on the
Active Directory as
Key Distribution
the store for Center (KDC)
security principals
and policy
Windows 2000 Domain Controller
Kerberos Authentication
Mutual Authentication
Application Server (target)
4. Present service ticket
at connection setup 1. Publish Service
Connection
Target Point and SPN
2. Lookup Service,
Compose SPN Windows 2000
TGT Active Directory
3. Request service
ticket for <spn>
Key Distribution
5. Mutual auth using Center (KDC)
unique session
key
Windows 2000 domain controller
Secure Distributed
Services Model
Client request Secure
Distributed
Authenticate Client
Service
Private Data
Impersonate Client Store
Get client’s Get object’s
access token security
descriptor
Kernel access check
Return response
Remote File Access
Check
Client
File Token
\\infosrv\share
application
SMB protocol
Server
Rdr
SSPI
Token
Ticket Kerberos
Kerberos SSP
SSP NTFS Access
check
SD
File
KDC
Windows 2000 Integration
Kerberos Authentication Use
LDAP to Active Directory
CIFS/SMB remote file access
Secure dynamic DNS update
System management tools
Host-host IP security using IKE
Secure Intranet web services in IIS
Authenticate certificate request to
Enterprise CA
COM+/RPC security provider
Cross-platform
Interoperability
Based on Kerberos V5 Protocol
RFC 1510 and RFC 1964 token format
Testing with MIT Kerb V5
Windows 2000 hosts the KDC
UNIX clients to Unix Servers
UNIX clients to Windows Servers
NT clients to UNIX Servers
Cross-realm authentication
UNIX realm to Windows domain
Architecture For Multiple
Authentication Services
Internet Explorer, Directory Mail,
Remote COM+ Internet Information enabled apps Chat,
file application Server using ADSI News
CIFS/SMB Secure RPC HTTP LDAP POP3, NNTP
SSPI
NTLM/
Kerberos SChannel
NTLMv2 SSL/TLS
MSV1_0/
KDC/DS
SAM
Windows 2000 Active
Directory
Domain hierarchy: domain tree
Organizational Unit (OU)
hierarchy within a domain
Users, groups, machines
Domain configuration
OU
OU
Users
Active Directory
Authentication and Access Control
LDAP v3 is core directory access
protocol
Authenticate using SASL and Kerberos
protocol
LDAP with SSL/TLS support Security
Descriptor
Bind Request OU
Every object has a OU
unique ACL Users
Like NTFS folders and
files
Active Directory
Security administration
Delegation of administration
Grant permissions at organizational
unit (OU) level
Who creates OUs, users, groups, etc.
Fine-grain access control
Grant or deny permissions on per-
property level, or a group of properties
Read property
Write property
Per-property auditing
Secure Applications
Connection Authentication
Establish Credentials
Mutual authentication of client and server
Secure Communication
Message privacy and integrity
Impersonation and Delegation
Assuming client’s identity
Authorization and Auditing
Using security descriptors
Example: Delegation in
Action
1. 401 Access Denied 4. IIS impersonates client,
WWW-Authenticate: Negotiate invokes ISAPI extension
IIS
3. WWW-Authenticate:ISAPI SQL
Negotiate <blob> Server
2. Ticket Server-A
request
to KDC Server-B
5. ASP uses ADO to
6. SQL Server
query SQL,
impersonates
integrated security
original client,
requests ticket
then data access
Interoperability
Cross Platform Secure 3-Tier App
Windows 2000 Windows 2000 Solaris
Professional Server UNIX Server
Smart Card Logon Web Server Oracle DB Application
IIS App
IE5 HTTP ISAPI
TCP Service
Extension
SSPI/Krb SSPI/Krb GSS/Krb
Public Key Components
For servers
Key and certificate
management
For clients Secure channel with
User key and Client authentication
certificate mgmt Auto enrollment
Secure channel
Windows 2000
Secure storage
Active Directory
CA enrollment
Enterprise Certificate
Certificate Server
services
Trust policy
SSL Client Authentication
ACL
Server Server
Client certificate
resources
SChannel SSP
Access token
Domain
Œ Ž
Authentication Org (OU)
Certificate Store service
of Trusted CAs
Users
1. Verify user certificate based on trusted CA, CRL
2. Locate user object in directory by subject name
3. Build NT access token based on group membership
4. Impersonate client, object access verification
Crypto API Architecture
Application
Secure channel
Certificate management services
Crypto API 1.0
Certificate
store RSA base Fortezza SmartCard
CSP CSP CSP
Cryptographic
Key Service Providers
database
Encrypting File System
Privacy of data that goes beyond
access control
Protect confidential data on laptops
Configurable approach to data recovery
Integrated with core operating
system components
Windows NT File System - NTFS
Crypto API key management
LSA security policy
Transparent and very high
performance
EFS Architecture
Applications
Win32 layer EFS
Crypto API service
User mode
Kernel mode I/O manager
LPC communication
for all key
management support
NTFS EFS
Encrypted on-disk data storage
File Encryption
A quick File encryption *#$fjda^j
brown fox (DESX) u539!3t
jumped... t389E *&
Data decryption
DDF
field generation
(RSA)
User’s
public key Data recovery
field generation DRF
Randomly- (RSA)
generated
file encryption key
Recovery agent’s
RNG public key
in recovery policy
File Decryption
*#$fjda^j File decryption A quick
u539!3t (DESX) brown fox
t389E *& jumped...
User’s private File encryption
key key
DDF extraction DDF is decrypted
(e.g., RSA) using the private
key to get to the file
DDF contains file encryption key
encryption key
encrypted under
DDF
user’s public key
Secure Networking
Internet Protocol Security (IPSec)
Extended Authentication Protocol/PPP
Token and SmartCard support
Remote Authentication Dial In User
Service (RADIUS)
Kerberos security package
Public key (SSL/TLS) security package
Windows 2000 IPSec
Target Scenarios
Remote Access User to Corporate
Network
Dial Up from Laptop or Home
Using existing network connectivity to Internet
IP Tunnel Corporate Network
Laptop or Home PC
A C
Host Host
Internet Router or
Tunnel Server
Service
Internet
B Provider
Host Modems
Windows 2000 IPSec
Target Scenarios
LAN Edge Gateway to Edge Gateway
of Another LAN
Across Internet or private network with Windows 2000 <->
Windows 2000 routers using
IP tunnels
IPSec Tunnel Mode
L2TP/IPSec integrated tunneling
Corporate Net in LA IP Tunnel Corporate Net in DC
A B
Router C Router D
Host
Host
Internet
IP Security
Host-to-host IP Security
authentication and Policy
encryption
Network layer
IP security policy
with domain policy
Negotiation policies,
IP filters PA PA
Policy Agent Source: 157.55.00.00
Downloads IPSEC Dest: 147.20.00.00
Any protocol
policy
IP Security Association
using Kerberos Authentication
Used for Windows NT
KDC Directory Server
SMB data
encryption
157.55.20.100 147.20.10.200
SA SA
IKE IKE
TCP TCP
IP IP
Managing Security Policy
Security settings in local or
group policy
Local computer policy
Audit policy, rights, security options
Group Policy in the directory
Common computer policies
Domain level policies
Account policies
Public key trust policies
Hierarchical Policy Settings
1 Domain level policy
2 OU level policy
3 OU level policy
Applied policy for a computer
combines multiple policy objects
Enterprise Framework
Integrated with Group Policy
management
Security settings in group policy
Settings applied as part of policy
enforcement on each computer
Secure Windows
Goals
Secure out-of-the-box
Definition of secure system settings
Backward compatible user experience
Clean install of Windows 2000
Upgrade can apply security
configuration
Who can do what?
Administrators, Power Users, Users
Group membership defines access
Administrators vs.
Users
Administrators
Full control of the operating system
Install system components, drivers
Upgrade or repair the system
Users
Cannot compromise system integrity
Read-only access to system resources
Interactive and network logon rights
Can shutdown desktop system
Legacy application issues
Security Features Summary
Single sign on with standard protocols
Kerberos V5 and X.509 V3 certificates
Public key certificate management
Enterprise services for PKI rollout
Distributed security for applications
Authentication, authorization, auditing
Active Directory integration
Scalable, extensible user account directory
For More Information
White papers
http://www.microsoft.com/windows2000/library
Active Directory
Security Services
Windows 2000 Resource Kit
Deployment Guide
Detail technical material
Microsoft Security Advisor
http://www.microsoft.com/security
