Nguyn tc bo mt c bn: Identification (Xc nh) Authencation (Chng thc) Authorizaton and access control (y quyn v kim sot truy nhp) Confidentiality -Intergrity (Ton vn) Nonrepudiation (Khng chi t) Trust (Tin cy) Audit entries (Mc kim tra)Kin trc an ninh: Cng ngh ng nhp v xc thc Cng ngh y quyn v kim sot truy nhp Cng ngh bo mt d liu Cng ngh chnh sch nhm Cng ngh tin cy C s h tng kha cng khai

1. ng nhp v xc thc: C ch xc thc xc minh danh tnh ca ngi dng khi ngi dng ng nhp truy cp ti nguyn trn mng, xc minh xem c ng l ngi c thm quyn truy cp thng tin, thng c thc hin bng cch m ha d liu vi mt kha duy nht m ngi dng bit. Pha server s so snh d liu bng mt kha mt m dng xc thc. Cc kha ny c lu tr mt v tr an ton, l Local Security Authority ca my tnh client hoc mt Active Directory. Windows 2003 thc hin mt s giao thc xc thc, bao gm Kerberos v5, NTLM, knh an ton, Passport, Digest: NTML: c a ra ci tin cc im yu v bo mt ca LM Authentication. NTMLv1 s dng tp k t lm password c y cc k t Unicode (k t hoa, thng, c bit...), s dng thut ton bng bm Message Digest MD4. NTMLv2 khc phc nhng im yu ca NTMLv1 bng cch a ra mt khu di hn, s dng thut ton m ha hm bm MD5. Quy trnh x l logon t xa ca NTML:

Kerberos l giao thc xc thc hot ng trn ng tuyn khng an ton, chng li vic nghe ln v bo v ton vn d liu. Kerberos s dng mt bn th ba tham gia vo qu trnh nhn thc l trung tm phn phi kha Key Distribution Center (KDC). KDC bao gm hai chc nng l my ch xc thc (authentication server- AS) v my ch cung cp v (ticket granting server- TGS). Khi mt user mun tham gia vo mt mng ca kerbhttps://www.gmail.com/intl/vi/mail/help/about.html#inboxeros th thay v user phi xc thc vi KDC th phi xc thc vi AS.

C ch hot ng ca kerberos: Ngi s dng xc thc mnh vi my ch xc thc AS, sau chng minh vi my ch cung cp v TGS rng mnh c xc thc nhn v, cui cng l chng minh vi my ch dch v SS (Service Server) rng mnh c chp thun s dng dch v:1. Ngi dng nhp tn (ID) v mt khu ti my tnh ca mnh (my khch).2. Phn mm trn my khch thc hin hm bng mt chiu trn mt khu nhn c. Kt qu s c dng lm kha b mt ca ngi s dng.3. Phn mm my khch gi mt gi tin khng c m ha ti my ch AS yu cu dch v, kha b mt m mt khu khng c gi ti AS.4. AS kim tra v gi li 2 gi tin cho ngi dng:Gi tin A: Kha phin TGS/my khch c mt m ha vi kha b mt ca ngi s dng.Gi tin B: V chp nhn bao gm nh danh(ID), a ch mng ca ngi s dng, thi hn ca v v kha phin TGS/my khch , c mt m ha vi kha b mt ca TGS.5. Khi nhn c 2 gi tin trn th my khch s gii m gi tin A c kha phin vi TGS. Ti thi im ny, ngi dng c th xc thc vi TGS.6. Khi yu cu dch v, ngi dng s dng 2 gi tin ti TGS:Gi tin C: Bao gm v chp thun t gi tin B v ch danh (ID) ca yu cu dch v.Gi tin D: Phn nhn thc, bao gm ch danh ca ngi dng v thi im yu cu, mt m ha vi Kha phin TGS/my khch.7. Khi nhn c 2 gi tin C v D, TGS gii m D ri gi 2 gi tin sau ti ngi s dng:Gi tin E: V bao gm ch danh, a ch mng ca ngi s dng, thi gian s dng v Kha phin my ch/my khch mt m ha vi kha b mt ca my ch cung cp dch v.Gi tin F: Kha phin my ch/my khch mt m ha vi kha phin TGS/my khch.8. Khi nhn c 2 gi tin E v F, ngi dng c thng tin nhn thc vi my ch cung cp dch v SS. My khch s gi ti SS 2 gi tin:Gi tin E thu c t trc.Gi tin G: phn nhn thc mi, bao gm ch danh ngi s dng, thi im yu cu v c mt m vi Kha phin my ch/my khch.9. SS gii m v bng kha b mt ca mnh v gi gi tin sau ti ngi s dng xc nhn nh danh ca mnh v khng nh s ng cung cp dch vGi tin H: thi im trong gi tin yu cu dch v cng thm 1, mt m ha vi kho phin my ch/my khch.10. My khch gii m gi tin xc nhn v kim tra thi gian gi tin c c cp nht chnh xc. Nu ng th ngi s dng c th tin tng vo my ch SS v bt u yu cu s dng dch v.11. My ch cung cp dch v cho ngi s dng.u im: L giao thc mt m dng xc thc trong cc mng my tnh hot ng trn nhng dng truyn khng an ton, l giao thc mc inh trong cc h iu nh Window, Mac OS, Unix... c nh gi l giao thc an ton. Mt khu khng c truyn trc tip trn ng truyn mng, hn ch ti a tn cng. Giao thc c m ha theo cc chun m ha cao cp nh Triple DES, RC4, AES nn rt an ton. Theo c ch Single-Sign-on, ng nhp mt ln, hn ch vic tn cng mt d liu. V b nh cp rt kh ti s dng. Thay v gi thng tin gc v mt khu trn mng, Kerberos s dng v m ha chng minh danh tnh ca c ngi s dng v my ch, h thng xc thc ngi dng v ngi dng xc thc li server.Nhc im: Ton b h thng lm vic da trn s an ton ca h thng KDC, nu h thng b tn cng th ton b cc thnh phn trong h thng b t lit, KDC l him ha chnh ca s tn cng. i hi cc my tnh trong h thng phi ng b v thi gian (khng chnh lch vi nhau qu 5 pht). Vi c ch dng nhp mt ln trn mt my tnh, nu my tnh ri vo tay ca k tn cng th ton b d liu ca ngi dng s b nh cp, v gy nguy c cho ton b h thng.Kin trc h thng an ninh: H iu hnh Windows Server 2003 bao gm mt tp hp cc thnh phn bo mt, to nn m hnh bo mt ca Windows. Cc thnh phn ny m bo rng cc ng dng khng th truy cp vo ti nguyn m khng c xc thc v y quyn. The Local Authority (LSA) l mt h thng bo v c xc nhn v ng nhp ngi dng trn my tnh cc b. Ngoi ra, LSA duy tr thng tin v tt c cc kha cnh ca an ninh trn mt my tnh ( c gi chung l cc chnh sch an ninh a phng) v n cung cp cc dch v khc nhau gia tn v nh danh bo mt (SID). Cc h thng an ninh con thoe di cc chnh sch an ninh v cc ti khon c hiu lc trn mt h thng my tnh. Trong trng hp l mt Domain Controller, cc chnh sch v cc ti khon l nhng th c hiu lc i vi cc lnh vc m domain controller nm gi, c lu tr trong Active Directory. Kin trc LSA:

Cc h thng bo mt LSA con cung cp dch v xc nhn quyn truy cp vo cc i tng, kim tra quyn s dng, to ra cc thng ip kim ton. LSA thc hin cc chc nng sau: Qun l chnh sch an ninh cc b Cung cp dch v xc thc ngi dng To th truy cp Qun l cc chnh sch kim ton v ci t. Cc thnh phn LSA ca mt h thng:

Winlogon.exeCc tp tin thc thi qun l tng tc ngi dng. Winlogon khi to qu trnh ng nhp cho Windows Server 2003.

Msgina.dllTh vin lin kt ng mc nh hot ng trong bi cnh an ninh ca Winlogon. Cc nhn dng ha v xc thc c trach nhim x l chui secure attention sequence(SAS), thng l Control-Alt-Delete v tng tc vi ngi dng khi trnh t ny nhn c

Netlogon.dllL mt qu trnh Windows Server xc thc ngi dng v cc dch v khc trong mt min. Nu Netlogon b dng li, ngi dng khng th ng nhp c ti khon ca mnh.

Msv1_0.dllCc giao thc xc thc NTLM. Dng cho client khng s dng giao thc xc thc Kerberos

Schanel.dllS dng cc gioa thc xc thc Secure Sockets Layer (SSL) v Transport Layer Security (TLS). Cung cp chng thc trn mt knh c m ha.

Kerberos.dllS dng giao thc xc thc Kerberos.

Wdigest.dllChy giao thc xc thc Digest m ha hm bm MD5, an ton hn so vi xc thc c bn

Lsasrv.dllCc dch v LSA Server, bao gm c thc thi cc chnh sch bo mt v hot ng qun l bo mt cho LSA.

Samsrv.dllSecurity Accounts Manager (SAM) lu tr cc ti khon an ninh cc b, thc thi cc chnh sch c luu tr cc b, h tr cc API

Secur32.dllCh yu cha cc nh cung cp dch v an ton giao din (Secure Service Provider Interface, SSPI.)

Security Support Provider Interface (SSPI) l mt API thc hin cc hot ng an ninh lin quan n chng thc. Cc SSPI trong Windows Server 2003 cung cp mt c ch xc thc th xc thc thng qua giao thc hin c, do loi b s cn thit giao tip gia cc bn xc nh mt giao thc mng s dng trong qu trnh xc thc. Khi hai bn cn phi c xc thc c th giao tip,cc yu cu c chuyn n SSPI. Nhm hon tt qu trnh xc thc, khng ph thuc vo giao thc mng ang s dng. Kin trc SSPI