Lecture 11 Security xlanchen04292005 xlanchen04292005 Understanding the Inside

Lecture 11 Security xlanchen@04/29/2005 计算机系 • 信息处理实验室 xlanchen@04/29/2005 Understanding the Inside of Windows 2000

Why security? Multi-user system must preventing unauthorized access Providing Security configuration mechanism Obvious security mechanisms Accounts/passwords/file protection Others mechanisms protecting OS from corruption preventing less privileged users from performing privileged actions not allowing user programs to adversely affect the programs of other users or OS xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 2 信息处理实验室

Contents Security Ratings Security System Components Protecting Objects Security Auditing Logon xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 3 信息处理实验室

Security Ratings TCSEC C 2 security rating A secure logon facility Discretionary access control Security auditing Object reuse protection B-level security Trusted path functionality Trusted facility management xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 4 信息处理实验室

Security System Components xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 5 信息处理实验室

Lsass Local security authority subsystem xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 6 信息处理实验室

Protecting Objects the essence of discretionary access control and auditing The objects that can be protected on 2 K include files, devices, mailslots, pipes (named anonymous), jobs, processes, threads, events, mutexes, semaphores, shared memory sections, I/O completion ports, LPC ports, waitable timers, access tokens, window stations, desktops, network shares, services, registry keys, and printers xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 7 信息处理实验室

Access Checks xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 8 信息处理实验室

Security Identifiers xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 9 信息处理实验室

Tokens xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 10 信息处理实验室

Impersonation xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 11 信息处理实验室

Restricted Tokens xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 12 信息处理实验室

Security Descriptors & Access Control ACL Assignment Determining Access xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 13 信息处理实验室

Discretionary access-control list (DACL) xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 14 信息处理实验室

ACL Assignment xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 15 信息处理实验室

Determining Access xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 16 信息处理实验室

Access validation example xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 17 信息处理实验室

Security Auditing Flow of security audit records xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 18 信息处理实验室

Process and thread security structures xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 19 信息处理实验室

Logon Components involved in logon xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 20 信息处理实验室

Winlogon Initialization WindowsWin. Sta 0 three desktops an LPC connection a window class data structure Registers the SAS Registers the window User Logon Steps xlanchen@04/29/2005 Understanding the Inside of Windows 2000 计算机系 21 信息处理实验室