互動式QR-code之OTP密碼系統研究

近年來電腦病毒、木馬程式、釣魚網站、間諜程式、暴力破解等不法技術的進步，密碼儘管使用SSL(Secure Sockets Layer)加密協定，也不再安全。一旦帳號密碼遭有心人士竊取，使用者身份可能因此被冒用，輕者造成個人財物損失，重者公司機密資料外洩等，無法彌補的損害。為了防止帳號密碼被竊取，目前已發展出一次性密碼機制(One-Time Password; OTP)，利用密碼產生器依據演算法運算，具有不可預測、不可重複、使用一次或時間過即失效。然而OTP密碼的機制面對各種網路攻擊手法還是有風險的，且有非同步的問題，利用社交工程的方式寄送假造的電子郵件，誘騙使用者連結至相似度高偽造的網頁介面，竊取使用者所登入的帳號密碼與OTP密碼。由於被竊取的OTP密碼並未於真正的合法介面上登入過，且某些OTP密碼系統於一定期間內仍為有效，因此，有心人士於有效期間內利用被竊取的密碼登入真正的合法介面即可冒用使用者的身份。因此傳統OTP機制就完全失效。二維條碼(Quick Response Code; QR-Code)，結合智慧型裝置可讓其內容能快速被解讀。本研究提出互動式QR-Code之OTP密碼驗證系統，將OTP技術與QR-Code相互結合應用於身分認證的機制上，去改善目前一次性密碼機制的缺點，經實驗分析，互動式QR Code之OTP密碼驗證系統確實可避免各種網路攻擊手法，提高系統安全性。

關鍵字

網路攻擊；一次性密碼； QR-Code ；身分認證

並列摘要

In recent years, the illegal technology that computer viruses, Trojans, Phishing, spyware, brute and son on made great progress, the password authentication isn’t secure no longer in spite of employing Secure Sockets Layer (SSL) encryption protocol. Once the usercode/password is stolen by the personage intentionally, user's identity may be falsely used, the lighter causes personal property losses, company's secret materials of the heavy one are let out etc., and that damage can't be remedied. In order to prevent the usercode/password from being stolen, have already developed One-Time Password at present; Utilize password generator according to qualified algorithm operation, have unpredictable, unrepeatable, using one-time, and invalid of time expire. However, it is still risky that the mechanism of OTP faces various tricks of networking attacks, and it has asynchronization problem. Using social engineering methods to send fake e-mail and tricking user link to high similarity fake web interface to steal user login account, password and OTP code. Due to the OTP code of stolen doesn’t login legitimate interface and some OTP code of system is still valid at an interval time, the intentional personage use the password of stolen to login legitimate interface and spoof user's identity. Therefore traditional OTP mechanism is completely ineffective. Quick Response Code (QR-Code) combines smart devices can read the contents quickly. This research paper proposes an interactive QR-code OTP system, combine OTP technology with QR-Code to be applies to identity authentication mechanism, to improve the shortcomings of traditional OTP mechanism. Via the experiments analysis, the interactive QR-code OTP system can defense various techniques of network attack certainly and promote systematic security.