行動平台上基於令牌的身份認證方案

Token-Based Authentication Solutions for Mobile Devices

吳忠憲(Zhong-Xian Wu)

指導教授 ： 鄭振牟

國立臺灣大學/電機資訊學院/電機工程學研究所/碩士(2014年)

https://doi.org/10.6342/NTU.2014.02413

摘要

近年來，愈來愈多人使用便捷的智慧型手機或平板電腦，通過各種雲端服務、應用軟體去存取個人資訊，而在這些行動裝置上，目前最常見的身份認證方法依舊是傳統的使用者名稱搭配「密碼」。不過，有別於傳統的個人電腦，在行動裝置上不依賴實體鍵盤輸入冗長的密碼相當困難。為了便於使用，人們通常選擇在安全性妥協：使用較短、易記的密碼，或一旦認證成功以後，就再也不登出這些行動裝置。

此外，「密碼」有一些根本的弱點，使得它無法為我們提供太高的安全性。因此除了密碼以外，其實有更安全的身份認證方案供我們選擇；搭配不斷更新的「一次性密碼」的「兩步驟驗證」就是個很常見的例子。可惜許多較「安全」的方案因為步驟繁複、不便於使用，並沒有得到廣泛的接納。

針對身份認證「易用」、「安全」兩個面向往往相互衝突的這個難題，我們在這篇論文提出了一個基於令牌的身份認證框架。並用它建構出行動裝置上可以使用的中央式單一登入服務和密碼管理員軟體。

關鍵字

身份認證 ； 行動裝置安全性 ； 密碼 ； 身份令牌 ； 身份管理 ； 單一登入

並列摘要

Nowadays, smartphones and tablets are widely used to access personal information through various applications and cloud services. On these mobile devices, the most commonly used identity authentications are still password-based, which have several usability and security issues. Because it is hard to type a long password on a mobile device without a physical keyboard, in contrast to traditional PCs, people usually choose to compromise the security for the ease of use by using a shorter password, or never log out the devices. In addition, with some fundamental weakness, ``password' is insecure in many practical scenario. Therefore people have developed authentication solutions with a higher security level; for example, ``two-step verification' with a one-time password. However, those ``better' solutions is not widely adopted since they are not simpler to use than just typing a password.

To overcome this issue, in this paper, we propose a token-based authentication architecture, based on which a centralized single sign-on service and a password manager can be easily built, in order to solve the problem in a secure and user-friendly manner.

並列關鍵字

identity token ； token-based authentication ； identity management ； remote authentication ； mobile security ； password

參考文獻

[4] GRC’s

[13] J. Bonneau, C. Herley, P. C. Van Oorschot, and F. Stajano. The quest to replace pass- words: A framework for comparative evaluation of web authentication schemes. In Security and Privacy (SP), 2012 IEEE Symposium on, pages 553–567. IEEE, 2012.

[14] C. Herley and P. Van Oorschot. A research agenda acknowledging the persistence of passwords. Security & Privacy, IEEE, 10(1):28–36, 2012.

[16] F. Schaub, R. Deyhle, and M. Weber. Password entry usability and shoulder surfing susceptibility on different smartphone platforms. In Proceedings of the 11th Inter- national Conference on Mobile and Ubiquitous Multimedia, page 13. ACM, 2012.

[1] 1Password. https://agilebits.com/onepassword. 2014/06/09.