SSL PKI EFS STPP

Transcription

1 .NET

2 SSL PKI EFS STPP

3 Windows NTLM (KDC) SSL/TLS, NTLM, SSL/TLS,

4 Active Active Directory Directory PKI PKI CRL CRL ( NTLM, NTLM,, PKI, PKI, ) DNS DNS Windows Windows ACL ACL

5

6 Active Directory (AD)

7 AD GUI LDAP

8 OU OU

9

10 AD PKI CA ACL CRL CTL

11

12 NTLM Kerberos Version 5

13 COM+ ADSI,,, IIS CIFS/SMB Secure RPC NTLM HTTP LDAP SChannel SSL/TLS POP3, NNTP SSPI MSV1_0/ SAM KDC/DS

14 SSPI( Security Support Provider Interface ) SSPI SSPI SSP

15

16

17 3. 4. KDC 1. KDC Windows 2000 Active Directory Key Distribution Center (KDC) 2. KDC Windows 2000

18 Windows 2000 (Authentication) KDC Active Directory Ticket (Authorization) Request Windows 2000 Domain Controller Ticket ACL Files Devices ACL Application ACL 4. Resource Client Machine Windows 2000 Server(s)

19 Server 1 Server 2 Windows NT Directory Server Key Distribution Center (KDC) Windows NT domain controller

20 Windows company.com est.company.com east.company.com KDC TGT 2 TGT 3 KDC TGT 1 TICKET 4 srv1.east.company.com Windows 2000 Professional Windows 2000 Server

21 Windows 2000 Unix KDC OMPANY.REALM nt.company.com Unix KDC TGT 2 Windows 2K KDC TGT 1 TICKET 3 Name Mapping to 2K account Unix Workstation With 2K Auth Data Windows 2K Server

22

23 CryptoAPI Authenticode CryptoAPI API Reader SSPI (PKCS) Crypto CSP CSP

24 Applications GetOpenCardName Common UI SCard* COM SCSP CryptoAPI SCCP Service Providers S D K System Services Device Drivers Driver Driver Driver D D K Hardware

25 Windows 2000 Reader Reader SC 1 Card insertion causes Winlogon to display GINA 4 LSA accesses smart card and retrieves cert from card 2 User inputs PIN 8 Smart card decrypts the TGT using private key allowing LSA to log user on 3 GINA passes PIN to LSA LSA Kerberos 5 Kerberos sends certificate in a PKINIT login request to the KDC 7 KDC returns TGT, encrypted with a session key which is in turn encrypted using user s public key Kerberos 6 KDC verifies certificate then looks up principal in DS KDC

26 Windows

27 API Windows

28 SSL

29 IIS Windows DS [ ] UPN CA 1 1

30 DS Web Cert SSL/TLS Active Directory

31 PKI

32 PKI

33 PKI

34 Windows 2000 PKI PKI PKI

35 Windows 2000 PKI MMC IE MMC CRL

36 Windows 2000 PKI CryptoAPI 1.0 CryptoAPI 2.0 SSPI

37 Cert Reader SC Windows 2000 PKI Root CA Client Certificate Request and Authentication Active Directory Subordinate CA Publish Certificate?

38 Reader Cert SC Client Windows 2000 PKI SSL Secure Web Server HTTP with SSL/TLS Certificate Enrollment Subject Lookup Certification Authority Active Directory

39 Windows 2000 PKI (S/MIME) Active Directory Outlook Express Retrieve user s certificate (LDAP) Internet S/MIME Cert Reader SC Outlook Exchange

40 Windows 2000 PKI E (SSL ) HTTP with SSL/TLS Secure Web Server Client Trust Relationship Certification Authority Certificate Enrollment

41 Windows 2000 PKI (Authenticode) HTTP Web Server User Code Signing Process Code Signing Cert Reader SC Code Publishing Developer

42 EFS

43 NTFS EFS

44 Launch key for nuclear missile RedHeat is... User s public key (in certificate) Randomly- generated file encryption key (FEK) File encryption (e.g., DES) RNG Data Decryption Field generation (e.g., RSA) Data Recovery Field generation (e.g., RSA) *#$fjda^j u539!3t t389e 5e%32 ^kd DDF DRF Recovery agent s public key (in certificate) in recovery policy

45 *#$fjda^j u539!3t t389e 5e%32 ^kd User s private key DDF contains file encryption key (FEK) encrypted under user s public key File decryption (e.g., DES) DDF extraction (e.g., RSA) DDF File encryption key (FEK) Launch key for nuclear missile RedHeat is... DDF is decrypted using the private key to get to the file encryption key (FEK)

46 *#$fjda^j u539!3t t389e 5e%32 ^kd Recovery agent s private key DRF contains file encryption key (FEK) encrypted under recovery agent s public key File decryption (e.g., DES) DRF extraction (e.g., RSA) DRF File encryption key (FEK) Launch key for nuclear missile RedHeat is... DRF is decrypted using the private key of recovery agent to get to the file encryption key (FEK)

47 CA PKI

48 JP [ ] [ ] EFS ( )

49 JP CA [ ] [ ] ( ) ( )

50 SSL PKI EFS STPP

51 STPP Strategic Technology Protection Program Get Secure. Stay Secure.

52 STPP MCS Rating System Microsoft Security Tool Kit

53 Secure Windows Initiative SWI

54 Security Tool Kit Guide Windows Windows 2000, Windows NT 4.0, Windows NT 4.0 TSE, Step by Step Guide Software Updates Service Pack Windows 2000 Service Pack 2, Windows NT 4.0 SRP Deployment and Management Tools Windows HFNetChk,, IIS Lockdown Wizard Online Resources TechNet

55 Security Tool Kit Software Update IIS Lockdown Tool HFNetChk Tool Rating System Security Rollup Patches

56 Windows Update- - Service Pack Security Rollup Internet Windows Update Corporate Edition Microsoft Windows Update Site

57 Windows Update Windows 3 rd

58 ( 9:30-12:00,13:00 12:00,13:00-19:00) 19:00) Security Tool Kit

59 japan/security Microsoft Security Tool Kit SWI MCS

60

61 Windows, VS.NET CD 9000 Windows,ISA,.NET Windows, ISA,.NET

62 初期設定におけるセキュリティ対策 Office.exeの受取 scriptへ のアクセス無効 XP インターネット接続にファ イアウォールを設定 Windows.NET Server 初期設定でIIS6を無効化 ウィザードによる 不要なサービスの無効化

63 Get Secure. Stay Secure. STPP MSRC Windows 2000 Security Rollup Package Windows 2000 SP3 VS.NET Windows Update

64 TRUSTe BBBOnline Deloitte Price Waterhouse Foundstone 1997 GLB MSN XP Kids Passport pre-coppa COPPA.NET My Services

65 IT IT

66 Get Secure. Stay Secure.