题名

行動裝置之兩階段身分認證機制

并列篇名

Two-step mobile user authentication mechanisms

作者

羅嘉寧(Jia-Ning Luo)

关键词

兩階段驗證 ； 身分認證 ； 第二因子認證 ； two-step verification ； user authentication ； second-factor authentication

期刊名称

資訊安全通訊

卷期/出版年月

24卷4期（2018 / 10 / 01）

页次

31 - 43

内容语文

繁體中文
中文摘要

隨著雲端服務的興起，使用者有越來越多的資訊儲存在雲端服務中。傳統的文字密碼機制已無法保障使用者的帳號安全，使用第二因子認證及兩階段認證已逐漸成為趨勢。本文介紹Google所提供的兩階段驗證機制Google authenticator，及FIDO聯盟所提出的通用認證框架（Universal Authentication Framework，UAF）、通用第二因子認證（Universal 2nd Factor，U2F）及FIDO2機制。
英文摘要

With the rise of cloud services, users have more and more information stored in cloud services. The traditional text password mechanism has been unable to protect the user's account security. The use of the second factor authentication and two-stage authentication has gradually become a trend. This article introduces the Google authenticator, a two-stage authentication mechanism provided by Google, and the Universal Authentication Framework (UAF), Universal 2nd Factor (U2F), and FIDO2 mechanisms proposed by the FIDO Alliance.
主题分类 基礎與應用科學 > 資訊科學
参考文献
  1. RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm, https://tools.ietf.org/html/rfc4226 (2018/10/12).
  2. Google authenticator open source, https://github.com/google/google-authenticator (2017/12/17).
  3. FIDO 1.0, https://fidoalliance.org/fido-1-0-specifications-published-and-final/ (2014/12/9).
  4. FIDO 2.0: Overview, https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-overview-v2.0-rd-20170927.html (2017/10/4).
  5. FIDO 2.0: Client To Authenticator Protocol, https://fidoalliance.org/specs/fido-v2.0-rd20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html (2017/09/27).
  6. FIDO NFC Protocol Specification v1.0, https://fidoalliance.org/specs/fido-u2f-v1.2-ps20170411/fido-u2f-nfc-protocol-v1.2-ps-20170411.html (2017/04/11).
  7. Transitioning Google URL Shortener to Firebase Dynamic Links, https://developers.googleblog.com/2018/03/transitioning-google-url-shortener.html (2018/3/30).
  8. FIDO Universal 2nd Factor (U2F) Overview, https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-overview-v1.2-ps-20170411.html (2017/04/11).
  9. FIDO UAF Architectural Overview, https://fidoalliance.org/specs/fido-uaf-v1.1-ps20170202/fido-uaf-protocol-v1.1-ps-20170202.html (2017/02/02).
  10. FIDO Alliance, https://fidoalliance.org (2018/10/12).
  11. What is FIDO2, https://www.yubico.com/2018/05/what-is-fido2/ (2018/5/24).
  12. FIDO Bluetooth® Specification v1.0, https://fidoalliance.org/specs/fido-u2f-v1.2-ps20170411/fido-u2f-bt-protocol-v1.2-ps-20170411.html (2017/04/11).
  13. (2011).TOTP: Time-Based One-Time Password Algorithm.Internet Engineering Task Force
  14. ,未出版
  15. FIDO U2F HID Protocol Specification, https://fidoalliance.org/specs/fido-u2f-v1.2-ps20170411/fido-u2f-hid-protocol-v1.2-ps-20170411.html (2017/04/11).
  16. Titan Security Key, https://cloud.google.com/titan-security-key/ (2018/10/12).
  17. Web Authentication: An API for accessing Public Key Credentials Level 1, https://www.w3.org/TR/webauthn/ (2018/8/7).
  18. Roy, A.,Memon, N.,Ross, A.(2017).MasterPrint: Exploring the Vulnerability of Partial Fingerprint-based Authentication Systems.IEEE Transactions on Information Forensics and Security,12(9),2013-2025.
被引用次数
  1. (2023)。TW FidO 使用意願之研究。臺灣銀行季刊，74(3)，119-144。
print cancel