Windows Authorization Models

Introduction to Windows Authorization

Authorization, often referred to as access control, is a fundamental security mechanism that determines what actions authenticated users or processes are permitted to perform on system resources. In the Windows operating system, authorization is a complex yet robust system designed to protect sensitive data and prevent unauthorized modifications or access. This article delves into the core concepts and models that govern authorization in Windows.

The Role of Security Identifiers (SIDs)

At the heart of Windows security is the Security Identifier (SID). A SID is a unique value of variable length that identifies a user, group, or other security principal. Every user account, local or domain, is assigned a unique SID. Similarly, groups and even certain system services have their own SIDs. When a user logs in, their security token is created, which contains the SIDs of the user and all the groups they belong to. This token is then used by the system to check permissions for every resource access attempt.

Access Control Lists (ACLs)

Resources in Windows, such as files, folders, registry keys, and even running processes, can have associated Access Control Lists (ACLs). An ACL is a data structure that contains a collection of Access Control Entries (ACEs). Each ACE specifies a trustee (a SID) and the permissions that trustee is granted or denied for that resource. There are two main types of ACEs:

• Discretionary Access Control Entry (DACE): These entries grant or deny specific permissions. For example, a DACE can grant a user read access to a file, or deny them write access.
• System Access Control Entry (SACE): These entries are used for system auditing purposes, logging access attempts to a resource.

The Discretionary Access Control (DAC) Model

Windows primarily employs the Discretionary Access Control (DAC) model. In this model, the owner of a securable object has the discretion to grant or deny access to that object. The owner can delegate this authority to others, allowing for flexible access management. The DAC model is enforced through ACLs attached to each object.

Permissions Hierarchy

Permissions in Windows are granular and hierarchical. They can be categorized into:

• Read: Allows viewing of file contents or folder listings.
• Write: Allows modifying file contents or creating new files/folders.
• Execute: Allows running executable files.
• Delete: Allows removing files or folders.
• Change Permissions: Allows modifying the ACL of an object.
• Take Ownership: Allows changing the owner of an object.

These permissions can be inherited from parent objects (e.g., a folder's permissions can be inherited by its subfolders and files) or explicitly set on individual objects.

Mandatory Access Control (MAC) - An Advanced Concept

While DAC is the predominant model, Windows also supports elements of Mandatory Access Control (MAC), particularly in more advanced security scenarios like Windows Trusted Computing Base (TCB) and specific server roles. In a MAC system, the system itself enforces access control policies, overriding the owner's discretion. This is typically based on security labels assigned to subjects (users/processes) and objects (resources). Access is granted only if the security label of the subject meets or exceeds the security label of the object, according to predefined rules. This provides a more rigid, system-wide security framework.

Role-Based Access Control (RBAC)

Although not a distinct model in the same vein as DAC or MAC, Role-Based Access Control (RBAC) is a widely adopted strategy for managing permissions in Windows environments. RBAC simplifies administration by grouping users into roles (often mapped to Windows groups) and assigning permissions to these roles rather than to individual users. This makes it easier to manage access for large numbers of users and ensures consistency in permissions across the organization.

Key Components and Concepts

• Security Principals: Users, groups, computer accounts.
• Security Descriptors: Data structure containing owner, group, DACL, and SACL.
• DACL (Discretionary Access Control List): The list of ACEs that grant or deny access.
• SACL (System Access Control List): The list of ACEs that define auditing.
• Access Token: Contains SIDs of user and groups, used for access validation.
• Object Manager: The subsystem responsible for managing securable objects and their ACLs.

Example: Accessing a File

When a user attempts to open a file:

1. The user's process presents its access token to the operating system.
2. The operating system retrieves the file's ACL.
3. The system iterates through the ACL's ACEs.
4. For each ACE, it checks if the user's SIDs in the access token match the trustee SID in the ACE.
5. If a matching ACE is found, the permissions specified (granted or denied) are applied. Deny permissions always override allow permissions.
6. If no ACE explicitly grants or denies the requested access, and inheritance doesn't provide a rule, access is denied.

// Conceptual C++ snippet demonstrating access check (simplified)
HANDLE hFile = CreateFile(...); // Attempt to open a file
if (hFile != INVALID_HANDLE_VALUE) {
    // Access granted during CreateFile call based on ACL
    // ... perform operations ...
    CloseHandle(hFile);
} else {
    // Access denied or error occurred
    DWORD error = GetLastError();
    // Handle error, e.g., ERROR_ACCESS_DENIED
}