A Review of User-IdentityBased Security

for RuBoard

A Review of User -Identity “Based Security

The computer security systems you will most likely be familiar with are based on user identity. This means that authentication takes place for particular user identities; authorization then maps user credentials to specific resource access rights based on the user credentials gleaned from authentication. Finally, the enforcement system protects resources on a per-user basis. One of the most obvious examples for such a security system is the Windows security system.

When you log on to your Windows NT, 2000, or XP machine, you are authenticating yourself to Windows. Windows asks you to prove that you are the user you claim, typically by requiring you to type in a password.

After your user identity has been established, Windows will authorize access to operating system resources, such as files or the registry, based on the administrator-defined access control settings to those resources. Finally, Windows has built-in mechanisms to maintain user isolation (data stored in your user profile directory is off limits for other nonadministrator or nonpower users) and takes care that no resources can be accessed without proper authorization.

NOTE

See Chapter 17, "Introduction: .NET Framework Security and Operating System Security," for an overview of the Windows Security system and its interplay with the .NET Framework security infrastructure.

Windows is a prime example of a user-identity “based security system. Security is enforced on a per-user identity basis. All user code (except for some service code) in Windows is run in a specific user context, and it is the user context in which code is running that determines the resources the code can access. However, this also means that all code run on behalf of a specific user will run with the same rights to access-protected resources. In the next section, you'll see that there are security issues that cannot be addressed with a user-identity “based model, and it will also be shown how code-identity “based security can help mitigate these problems.

for RuBoard