研究生: |
陳威達 Chen, Wei-Ta |
---|---|
論文名稱: |
基於政府身份認證平台的真實身份驗證方法研究:應用於社群登入與網路服務 A Study on Real Identity Verification Methods Based on Government Identity Authentication Platforms: Applications in Social Logins and Online Services |
指導教授: |
孫宏民
SUN, HUNG-MIN |
口試委員: |
黃育綸
Huang, Yu-Lun 許富皓 Hsu, Fu-Hau |
學位類別: |
碩士 Master |
系所名稱: |
電機資訊學院 - 資訊安全研究所 Institute of Information Security |
論文出版年: | 2023 |
畢業學年度: | 112 |
語文別: | 中文 |
論文頁數: | 30 |
中文關鍵詞: | 社群登入 、單一簽入 、自然人憑證 |
外文關鍵詞: | OAuth2.0, passkeys, SocialLogin, CitizenDigitalCertificate |
相關次數: | 點閱:2 下載:0 |
分享至: |
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報 |
根據法務部對詐欺罪案件的統計分析,近年來詐欺罪新收件數在全般刑案中所占的比例逐年上升。此外,警政署的統計通報指出,詐欺類型中「投資詐欺」居首,即犯罪分子通過匿名身份刊登高額投資獲利廣告,吸引受害者加入私人社群後再進一步使其陷入圈套。
同時隨著人工智慧技術的迅猛發展,不同語言間的跨國交流變得越來越自然,虛擬人物模擬設定也日益簡單。然而,這也導致了社交工程、詐騙及假帳號等問題日益嚴重,對民眾網絡安全構成威脅。為了有效防範這些風險,並協助民眾辨認對象是否為假帳號或AI虛擬人物,本研究旨在創建一個真實身份驗證模型。本文將從研究背景、文獻綜述、方法與設計、實現與評估、結果與分析等方面展開,力求提出具有可行性和應用價值的解決方案。此外,在未來工作部分,我們將探討如何將此模型應用於單一簽入(SSO)或零信任架構,以提高企業或用戶導入此模型的意願。
本研究將為各類網路服務提供一個基於政府身份認證平台的真實身份驗證方法,使之更具信任度與安全性。經由此模型,用戶將能夠更加信任並安心地使用各種網路服務,同時減少受詐騙或虛擬人物攻擊的風險。此外,企業和網站亦可通過導入此模型,提升自身服務的安全性和可靠性,提高客戶滿意度。
然而,要使這一模型在實際應用中取得成功,還需充分考慮到風險評估與風險控制,包括隱私保護、資料安全、系統穩定性、抗攻擊能力和法律法規遵循等方面。在未來的研究中,我們將持續完善此模型,尋求更加全面的解決方案,以應對日益嚴重的網絡安全挑戰。
According to the statistical analysis of fraud cases by the Ministry of Justice the proportion of new fraud cases in general criminal cases has been increasing year by year. In addition, the statistical report of the National Police Agency points out that "investment fraud" is the most common type of fraud, in which criminals post high-yield investment advertisements anonymously, attract victims to join private groups, and further lure them into traps.
With the rapid development of artificial intelligence technology, cross-border communication in different languages has become increasingly natural, and the simulation of virtual characters has become easier. However, this has led to an increasing severity of social engineering, scams, and fake accounts, posing a threat to public network security. To effectively mitigate these risks and assist the public in identifying whether the counterparts are fake accounts or AI virtual characters, this study aims to create a real identity verification model. This paper will unfold from research background, literature review, methods and design, implementation and evaluation, results and analysis, and other aspects, striving to propose a feasible and valuable solution. Furthermore, in the future work section, we will explore how to apply this model to single sign-on(SSO) or OAuth, in order to increase the willingness of enterprises or users to adopt this model.
This study will provide a real identity verification method based on government identity authentication platforms for various online services, making them more trustworthy and secure. Through this model, users will be able to use various online services with greater trust and peace of mind, while reducing the risk of being scammed or attacked by virtual characters. In addition, enterprises and websites can improve the security and reliability of their services and increase customer satisfaction by adopting this model.
However, to make this model successful in practical applications, it is necessary to fully consider risk assessment and risk control, including privacy protection, data security, system stability, anti-attack capabilities, and compliance with laws and regulations. In future research, we will continue to improve this model and seek more comprehensive solutions to address the increasingly severe network security challenges.
[1] fido行動自然人憑證-機關單位申請qa. https://moica.nat.gov.tw/repository/MOICA/CRL2/complete.crl. Accessed: 2023-06-04.
[2] 功能教學-中華民國內政部行動自然人憑證系統. https://fido.moi.gov.tw/pt/main/teaching. Accessed: 2023-06-04.
[3] 產 品 介 紹— twca - 臺 灣 網 路 認 證- 為 資 安 把 關 , 提 供ssl憑 證 、 身 分 識 別 、 電 子 簽 署 等 網 路 安 全 機 制. https://www.twca.com.tw/product/c0281542-f034-4ba9-8164-c517ebc5e0c0. Accessed: 2023-06-04.
[4] Fido alliance - open authentication standards more secure than passwords. https://fidoalliance.org/. Accessed: 2023-06-04.
[5] Sherman S M Chow, Jan Camenisch, Lucas C K Hui Siu, and Ming Yiu. Lncs 8783 - information security, 2014.
[6] Jan De Clercq. Single sign-on architectures, 2002.
[7] D. Hardt. The oauth 2.0 authorization framework. 10 2012.
[8] M. Jones and D. Hardt. The oauth 2.0 authorization framework: Bearer token usage. 10 2012.
[9] Ministry Of Justice. Statistical analysis of fraud cases. 2022.
[10] Farzaneh Karegar, Nina Gerber, Melanie Volkamer, and Simone Fischer-H¨ubner. Helping john to make informed decisions on using social login. Proceedings of the ACM Symposium on Applied Computing, pages 1165–1174, 4 2018.
[11] Georgios Kontaxis, Michalis Polychronakis, and Evangelos P. Markatos. Minimizing information disclosure to third parties in social login platforms. International Journal of Information Security, 11:321–332, 10 2012.
[12] J Kr¨amer, D Schnurr, M Wohlfarth Management Science, and undefined 2019. Winners, losers, and facebook: The role of social logins in the online advertising ecosystem. pubsonline.informs.org, 65:1678–1699, 4 2019.
[13] Michael Kuperberg, Sebastian Kemper, and Cemil Durak. Blockchain usage for government-issued electronic ids: A survey. volume 349, pages 155–167. Springer Verlag, 2019.
[14] Youness Madani, Jemaa Bengourram, and Mohammed Erritali. Social login and data storage in the big data file system hdfs. ACM International Conference Proceeding Series, Part F130280:91–97, 5 2017.
[15] Gunit Malik, Kshitij Parasrampuria, Sai Prasanth Reddy, and Seema Shah. Blockchain based identity verification model. pages 1–6, 2019.
[16] Peter Mell, Jim Dray, and James Shook. Smart contract federated identity management without third party authentication services.
[17] Andreas Pashalidis, Chris J Mitchell, and Royal Holloway. A taxonomy of single sign-on systems, 2003.
[18] Yung Shin Van Der Sype and Jean Marc Seigneur. Case study: Legal requirements for the use of social login features for online reputation updates. Proceedings of the ACM Symposium on Applied Computing, pages 1698–1705, 2014.
[19] HENNGE Taiwan. fido 是什麼?無密碼時代的來臨. https://hennge.com/tw/blog/what-is-fido.html, 2021. Accessed: 2023-06-04.
[20] Jos´e van Dijck and Bart Jacobs. Electronic identity services as sociotechnical and politicaleconomic constructs. New Media and Society, 22:896–914, 5 2020.
[21] Ting Yu, Audit Association for Computing Machinery. Special Interest Group on Security, National Science Foundation (U.S.), Association for Computing Machinery, and ACM Digital Library. CCS’12 : the proceedings of the 2012 ACM Conference on Computer and Communications Security : October 16-18, 2012, Raleigh, North Carolina, USA. 2012.