一種新型的身分認證方法基於QR-code

為了在一個不安全的公用網路環境中確保安全的通訊及資源的共享，使用者的身分認證(User authentication)儼然成現今網路中的一項重要課題。因此，在現今的網路環境下，迫切需要一個安全又有效率的使用者身分認證系統。一般而言，雖然傳統的密碼身分認證機制已提供了基本的存取控制功能。然而，一次性密碼(One-time password)系統藉由每次登入時的動態密碼，更進一步提高了未經授權者的存取困難度。為了取代傳統身分認證系統中密碼表的使用，許多學者紛紛開始設計各式的一次性密碼系統，其使用的技術包括了：智慧卡、時間同步硬體設備、以及簡訊服務…等。這些努力無非都是想要降低固定式密碼遭竄改或竊取的風險。然而，考慮到硬體設備以及基礎建設的額外成本需求，顯然上述的這些傳統一次性密碼技術在實用性方面皆有明顯的缺陷。有鑑於此，我們將QR-Code二維條碼技術引入我們的一次性密碼身分認證方法中。有別於過去的認證方法，考慮到目前行動電話大量普及之特性，我們不僅僅去除了密碼驗證表格的使用，更進一步將驗證所需的額外成本需求降至最低。正因如此，減少了過去使用者需配置特殊硬體設備所造成的不便，並借助行動電話的隨身與便利等特性，更加突顯我們方法的方便性及實用價值。

關鍵字

一次性密碼；使用者身份認證；行動電話； QR-code

並列摘要

User authentication is one of the fundamental procedures to ensure secure communications and share system resources over an insecure public network channel. Thus, a simple and efficient authentication mechanism is required for securing the network system in the real environment. In general, the password-based authentication mechanism provides the basic capability to prevent unauthorized access. Especially, the purpose of the one-time password is to make it more difficult to gain unauthorized access to restricted resources. Instead of using the password file as conventional authentication systems, many researchers have devoted to implement various one-time password schemes using smart cards, time-synchronized token or short message service in order to reduce the risk of tampering and maintenance cost. However, these schemes are impractical because of the far from ubiquitous hardware devices or the infrastructure requirements. To remedy these weaknesses, the attraction of the QR-code technique can be introduced into our one-time password authentication protocol. Not the same as before, the proposed scheme based on QR code not only eliminates the usage of the password verification table, but also is a cost effective solution since most internet users already have mobile phones. For this reason, instead of carrying around a separate hardware token for each security domain, the superiority of handiness benefit from the mobile phone makes our approach more practical and convenient.

並列關鍵字

One-time Password ； User Authentication ； QR Code ； Mobile Phone

參考文獻

[34] W. H. Yang and S. P. Shieh, “Password authentication schemes with smart cards,” Computer and Security, Vol. 18, No. 8, pp. 727-733, 1999.

[1] Cryptography and Network Security: Principles and Practice; Fourth Edition.By William Stallings , Prentice Hall.

[3] H. Y. Chien, J. K. Jan, and Y. M. Tseng, “An efficient and practical solution to remote authentication: smart card,” Computers & Security, Vol. 21, No. 4, pp. 372– 375, 2002.

[4] C. C. Chang and T. C. Wu, “Remote password authentication with smart cards,” IEE Proceeding-Computers and Digital Techniques, Vol. 138, No. 3, pp. 165-168, 1991.

[5] T. Falas, H. Kashani, “Two-Dimensional Bar-code Decoding with Camera-Equipped Mobile Phones,” Proceedings of the Fifth Annual IEEE International Conference on Pervasive Computing and Communications Workshops, 19-23, pp. 597-600, March, 2007.

國際替代計量

一種新型的身分認證方法基於QR-code

未授權

主題瀏覽