untitled

Size: px

Start display at page:

Download "untitled"

えりかおえづか
5 years ago
Views:

1 Vista PKI PKI IE7IE7 Kiyoshi Watanabe, CISSP Security Center of Excellence (SCOE) Microsoft Vista Windows 2008

2 Vista, IE7, PKI Enrollment Credential CNG Bit Locker NAP IE7 Vista 6

3 Vistaの開発 Engineering Excellence と SDL セキュリティトレイニング Security Advisorの設置 Threat Modelingの実施セキュリティツールの利用最終セキュリティレビューの実施その他 Vistaの開発 Security Development Lifecycle

4 IE7の開発 Engineering Excellence と SDL PKI PKI単体はソリューションではない PKIは要素技術アプリケーションを定義する必要あり

5 PKI PKI S/MIME VPN IPsec Network Access Protection EFS Encrypting File System SSL/TLS PKI Certificate Enrollment API UI

6 (crypt32.dll) WU WU XP SSL,SMIME, Active-X

7 ( ) (SSL )

8 Visibility K 20 4M 4M Microsoft Root Certificate Program Web Trust (Web Trust ) CA 3 CRL Distribution Point Public e/security/news/rootcert.mspx?mfr=true

9 XP IE PKI? PKI PKI SE VPN VPN

10 Wireless Network LAN LAN : LAN VPN RPC over HTTP Extranet Private network LAN OCSP CRL : VeriSign (RSA 2005)

11 IE3.02 IE Outlook 2000 S/MIME 90 URL 15 CRL CRL CDP Authenticate Code CRL CRL

12 OCSP CA CA HTTPS HTTPS Grace Period

13 Vista ( ) Vista It just works CA,

14 Vista OCSP TLS stapling HTTP 1.1 cache proxies Pre-fetch fetch CRL, OCSP OCSP (Windows2008) Vista TLS Stapling RFC 3546 section 3.6 TLS CA CA TLS OCSP Openssl? ng_in_openssl_and_a.html

15 Vista TLS Stapling OCSP Pre-Fetch ` Vista TLS Stapling OCSP TLS Stapling TLS `

16 Vista TLS Stapling CA CA CDP Vista CRL vs. OCSP Windows Stapled OCSP Response CRL CRL AIA OCSP URL CRL URL Network 1URL,15

17 Vista HTTP1.1 Proxy Etag, cache control:max-age age Expire, Last Modified(HTTP1.0) Etag: Max-age: age: Pre-fetch fetch Vista HTTPS 1.1 Proxy HTTP 1.1 Caching Proxy 1.6/7/2006, 8:00am CRL 2. Revocation HTTP response : HTTP/ OK Content-Length: 1653 Date: Wed, 07 Jun :00:00GMT Content-Type: application/pkix-crl Last-Modified: Wed, 07 Jun :00:00 GMT ETag: "39a0-28d-4029bce7 Expires: Tue, 13 Jun :59:59 GMT Cache-Control: Max-age = A B C

18 Vista HTTPS 1.1 Proxy A HTTP 1.1 Caching Proxy 3. HTTP Proxy CRL CRL A 4. B CRL 1 Proxy CRL 1 proxy B B C Vista HTTPS 1.1 Proxy A GET If-None-Match: "39a0-28d-4029bce7" HTTP 1.1 Caching Proxy 5. C 2 CRL 1 proxy proxy GET B C 6. CRL HTTP/ Not Modified Date: Fri, 09 Jun :00:00GMT ETag: "39a0-28d-4029bce7 Cache-Control: Max-age = 86400

19 Vista Pre-Fetch Fetch Vista Call for Action HTTP (LDAP ) KISS 1OCSP,1CRL Pre Pre- fetch Light-weight OCSP Stapling Stapling

20 Enrollment Advanced Enrollment Xenroll Scrdenrl

21 Advanced Enrollment Request Classes Crypto Classes Attribute Classes IDispatch IX509CertificateRequest IX509CertificateRequestPkcs10 IX509CertificateRequestCertificate IX509CertificateRequestPkcs7 Enrollment Classes IDispatch IX509Enrollment IX509Enrollments IX509CertificateRequestCmc IDispatch ICspAlgorithm ICspAlgorithms ICspInformation ICspInformations IcspStatus ICspStatuses IX509PublicKey IX509PrivateKey IDispatch IX509Attribute IX509Extension IX509Attributes IX509AttributeExtensions ICryptAttribute IX509ExtensionKeyUsage IX509ExtensionEnhancedKeyUsage IX509ExtensionTemplateName IX509ExtensionTemplate IX509EnrollmentStatus ICryptAttributes Credential

22 Credential PKI User Profile Credential Credential (AD) (AD) S/MIME XP, W2K3 ance/cryptographyetc/client-credential credential- roaming/terminology-assumptions.mspx assumptions.mspx

23 SCEP MOM (2005 Management pack) Events Perfmon Counters MOM scripts UI

24 CNG CryptoNextGen CAPI AES ECC SHA2 CNG FIPS Common Criteria Requirements (Strong Isolation Auditing)

25 Bit Locker Full Volume Encryption dowsvista/security/bitlockr.mspx BitLocker -> SYSKEY ( ( Windows Key) TMP1.2 ( ) Full-Volume Volume

26 BitLocker TPMk (StorageRootKey) TPM TPM VMk (Volume Master Key) TPM TPM TMPk Seal/Unseal FVEk (Full Volume Encryption Key) VMk VMk FVEk Full Volume BitLocker PIN SHA256 TPM VMK VMK Unseal USB Start Start-up Key

27 BitLocker IE7 SSL2.0 HTTPS HTTP SSL ABA Geotrust, Verisign, Identrus, Comodo, Cybertrust, Go Daddy and X-RampX Ramp

28 IE7 EV certificate high-assurance SSL certificate EV certificate IE7 EV certificate CA/Browser Forum Browser Microsoft Corporation KDE Mozilla Foundation Opera Software ASA CA

29 NAP lutions/network/nap/naparch.mspx NAP PKI Heath Certificate ( ) IPsec

30 ① ネットワーク接続時システム状態を提出 ④正常性が OK の時のみ正常性証明書を発行 ③ポリシーを確認 ② 問合せ ④ NG 正常性登録機関下位CA 下位CA Windows Server 2008 ネットワークポリシーサーバー Windows server 2008 エンタープライズルート CA ⑤修復サーバーへは通常の通信 Windows Server 修復サーバー (WSUS (WSUS Web サイト等) サイト等) 制限ゾーン境界ゾーンセキュアゾーンセキュアゾーンのサーバーには IPSec ゾーンのサーバーには IPSec ポリシーにて正常性証明書による相互認証を送信受信ともに必須とし予め証明書を配布しておく証明書+IPSec を使った NAP の構成例複数台のネットワークポリシーサーバーエンタープライズルート CA RADIUS プロキシにより RADIUS サーバーグループにプロキシ Active Directory 正常性登録機関 (Web サイト) サイト) + スタンドアロン下位 CA マシンの認証認証局の信頼 CRL の公開 IPSec ポリシーの適用 Windows Server 2008 ポリシーのインポート/ ポリシーのインポート/エクスポート Windows Server 2008 NAP 構成時に正常性登録機関の URL を設定( を設定(複数可) 複数可)

31 owsvista/default.aspx ad/4/a/b/4abb4432-5b51 5b51-4de2-a0e5- f69b1f250c51/sec305.ppt Q&A

Enhancements In Certificate Service

Enhancements In Certificate Service Windows Server 2008 の PKI 機能渡辺清 CISSP Security Architect and Senior Consultant Security Center of Excellence, Microsoft アジェンダ PKI 概要 Windows Server 2008 PKI 機能暗号 (Cryptography) 登録 (Enrollment) 管理 (Manageability)