science

Security Support Provider Interface

Security Support Provider Interface is a science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Security Support Provider Interface rather than just read about it. In short: Security Support Provider Interface (SSPI) is a component of Windows API that performs security-related operations such as authentication. SSPI functions as a common interface to several Security Support Providers (SSPs): A Security Support Provider is a dynamic-link library (DLL) that makes one or more security packages available to apps.

Key takeaways

Security Support Provider Interface belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Security Support Provider Interface to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Security Support Provider Interface from memory before moving on to harder problems.

Reference excerpt

Security Support Provider Interface (SSPI) is a component of Windows API that performs security-related operations such as authentication. SSPI functions as a common interface to several Security Support Providers (SSPs): A Security Support Provider is a dynamic-link library (DLL) that makes one or more security packages available to apps.

Providers The following SSPs are included in Windows:

NTLMSSP (msv1_0.dll) – Introduced in Windows NT 3.51. Provides NTLM challenge/response authentication for Windows domains prior to Windows 2000 and for systems that are not part of a domain. Kerberos (kerberos.dll) – Introduced in Windows 2000 and updated in Windows Vista to support AES. Performs authentication for Windows domains in Windows 2000 and later. NegotiateSSP (secur32.dll) – Introduced in Windows 2000. Provides single sign-on capability, sometimes referred to as Integrated Windows Authentication (especially in the context of IIS). Prior to Windows 7, it tries Kerberos before falling back to NTLM. On Windows 7 and later, NEGOExts is introduced, which negotiates the use of installed custom SSPs which are supported on the client and server for authentication. Secure Channel (schannel.dll) – Introduced in Windows 2000 and updated in Windows Vista to support stronger AES encryption and ECC This provider uses SSL/TLS records to encrypt data payloads. TLS/SSL – Public key cryptography SSP that provides encryption and secure communication for authenticating clients and servers over the internet. Updated in Windows 7 to support TLS 1.2. Digest SSP (wdigest.dll) – Introduced in Windows XP. Provides challenge/response based HTTP and SASL authentication between Windows and non-Windows systems where Kerberos is not available. CredSSP (credssp.dll) – Introduced in Windows Vista and available on Windows XP SP3. Provides single sign-on and Network Level Authentication for Remote Desktop Services. Distributed Password Authentication (DPA, msapsspc.dll) – Introduced in Windows 2000. Provides internet authentication using digital certificates. Public Key Cryptography User-to-User (PKU2U, pku2u.dll) – Introduced in Windows 7. Provides peer-to-peer authentication using digital certificates between systems that are not part of a domain.

Comparison SSPI is a proprietary variant of Generic Security Services Application Program Interface (GSSAPI) with extensions and very Windows-specific data types. It shipped with Windows NT 3.51 and Windows 95 with the NTLMSSP. For Windows 2000, an implementation of Kerberos 5 was added, using token formats conforming to the official protocol standard RFC 1964 (The Kerberos 5 GSSAPI mechanism) and providing wire-level interoperability with Kerberos 5 implementations from other vendors. The tokens generated and accepted by the SSPI are mostly compatible with the GSS-API so an SSPI client on Windows may be able to authenticate with a GSS-API server on Unix depending on the specific circumstances. One significant shortcoming of SSPI is its lack of channel bindings, which makes some GSSAPI interoperability impossible. Another fundamental difference between the IETF-defined GSSAPI and Microsoft's SSPI is the concept of "impersonation". In this model, a server can operate with the full privileges of the authenticated client, so that the operating system performs all access control checks, e.g. when opening new files. Whether these are less privileges or more privileges than that of the original service account depends entirely on the client. In the traditional (GSSAPI) model, when a server runs under a service account, it cannot elevate its privileges, and has to perform access control in a client-specific and application-specific fashion. The obvious negative security implications of the impersonation concept are prevented in Windows Vista by restricting impersonation to selected service accounts. Impersonation can be implemented in a Unix/Linux model using the seteuid or related system calls. While this means an unprivileged process cannot elevate its privileges, it also means that to take advantage of impersonation the process must run in the context of the root user account.

References

External links SSPI Reference on MSDN SSPI Information and Win32 samples Example of use of SSPI for HTTP authentification

Worked examples

Example 1 — a first encounter with Security Support Provider Interface

Start with the simplest possible case. Write down what Security Support Provider Interface claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Security Support Provider Interface before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Security Support Provider Interface ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Security Support Provider Interface

In research: Security Support Provider Interface appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Security Support Provider Interface in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Security Support Provider Interface is common in secondary-school and first-year university syllabi. It links to neighbouring topics Microsoft Windows security technology, Microsoft application programming interfaces, Transport Layer Security implementation, so understanding it makes those chapters shorter.
In everyday life: Look for Security Support Provider Interface outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Security Support Provider Interface in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Security Support Provider Interface means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Security Support Provider Interface out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Security Support Provider Interface in simple terms?

Why does Security Support Provider Interface matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Security Support Provider Interface?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Security Support Provider Interface.