臺灣博碩士論文加值系統

多因子身分驗證（multifactor authentication，MFA）結合了兩種或更多類型的身分驗證機制，目的是提供存取資源時的更高程度的安全保障。近年來智慧型手機普及並且配備多種感測器，可以捕捉使用者所在的環境資訊。研究人員希望開發一個使用智慧型手機的感應器之環境因子身分認證機制。如此後端的認證伺服器即可驗證使用者的身分而不需要額外的硬體，。
本論文提出一個以音頻為基礎之環境因子認證機制，由認證伺服器判斷認證端與被認證端是否存在於相同環境中。在過往環境音頻之研究中，並無法辨識來自相同範圍的攻擊者，但我們所提出的方法可縮小辨識範圍至0.5公尺，如此可大幅提高認證系統的安全性。

Multifactor authentication (MFA) combines two or more authentication mechanisms to provide a better way to authenticate users. In recent years, smart phones are popular and equipped with various sensors that can record the ambient parameters around of the users. Researchers want to use the ambient sensors equipped with a smart phone to develop novel authentication mechanisms. Thus, the authentication server can validate the identity of the user without additional hardware devices.
In this paper, we propose an ambient authentication mechanism based on audio. The authentication server determines whether the authenticator and the authenticated user are located in the same position. In previous works, they cannot identify attackers from the same range. In the past studies of ambient audio authentications, they are not possible to identify attackers from the same range, but our proposed method can narrow the recognition range to less than 0.5 meters, which can greatly improve the security of the authentication system.

摘要 i
Abstract ii
第一章 緒論 1
第二章 相關文獻 10
2.1 先進個人設備基於情境的無互動配對與金鑰演進 10
2.2 基於環境音頻的安全通訊 11
2.3 以環境聲音接近程度為基礎的第二因子身分認證 13
2.4 隱私威脅通過行動設備上的超聲側通道 14
2.5 聲音-接近程度：防止被動無鑰進入和啟動系統遭受中繼攻擊的第二因子認證 15
2.6 Amigo:用於智慧型手機的基於接近程度的認證機制 18
2.7 零互動（Zero-Interation） 認證中不同感測器模型抵抗中繼攻擊的比較與結合 19
第三章 研究方法 20
3.1 音頻訊雜比與位元錯誤率 20
3.2 距離與音頻訊號衰減 23
3.3 同步偏移訊號 26
3.4 訊號分析 28
第四章 基於音頻之環境因子認證機制 34
4.1基於音頻之環境因子認證機制 36
第五章 實驗設計 47
5.1實驗場景設置 47
5.2音頻編碼 48
5.3同步訊號 49
5.4 分析環境中的噪音 51
第六章 實驗結果 52
6.1音頻振幅與距離測量 52
6.2認證端與被認證端單向接收測量 54
6.3認證端與被認證端雙向接收測量 57
6.4 認證範圍比較 64
第七章 結論 67
參考文獻 68

[1]“2017 First Half Report: Its all about identity theft,” [Online]. Available: http://breachlevelindex.com/assets/Breach-Level-Index-Report-H1-2017-Gemalto.pdf, 2017. [Accessed: 02- Jan- 2018].
[2]Al Pascual, “Identity Fraud: Protecting vulnerable populations,” [Online]. Available: https://www.javelinstrategy.com/brochure/347, 2015. [Accessed: 07- Jan- 2018].
[3]“Identity theft and cybercrime,”[Online]. Available: http://www.iii.org/fact-statistic/identity-theft-andcybercrime, 2015.[Accessed: 10- Jan- 2018].
[4]Anderson Torben, “Why multi-factor authentication is a security best practice,”[Online]. Available: https://www.scmagazineuk.com/why-multifactor-authentication-is-a-security-bestpractice/ article/540513/, 2014. [Accessed: 12- Jan- 2018].
[5]SafeNet, “Authentication survey,” [Online]. Available: http://www.safenet-inc.com/resources/dataprotection/2014-authentication-survey executivesummary/, 2014. [Accessed: 12- Jan- 2018].
[6]Aditi Roy, Nasir Member, and Arun Ross, “MasterPrint: Exploring the vulnerability of partial fingerprint-based authentication systems,” IEEE Transactions on Information Forensics and Security, vol. 12, no. 9, pp. 2013–2025, 2017.
[7]Chiara Lunerti, Richard M. Guest, and Ramon Blanco-Gonzalo, “Environmental effects on face recognition in smartphones,” in Proceeding of International Carnahan Conference on Security Technology (ICCST), Spain, 2017.
[8]Boris Danev, Davide Zanetti, and Srdjan Capkun, “On physical-layer identification of wireless devices,” ACM Computing Surveys (CSUR), New York, USA, vol. 45, no. 6, 2012.
[9]Weber, Frank. "Multi-factor authentication." U.S. Patent No.7,770,002. 3 Aug. 2010.
[10]Abhilasha Bhargav-Spantzel, Anna C. Squicciarini, Matthew Young, Elisa Bertino, and Stephen J. Elliott, “Privacy preserving multifactor authentication with biometrics,” Journal of Computer Security, vol. 15, no. 5, pp.529–560, 2007.
[11]Sabzevar, Alireza Pirayesh, and Angelos Stavrou, “Universal multi-factor authentication using graphical passwords.” in Proceeding of IEEE International Conference on Signal Image Technology and Internet Based Systems, (SITIS'08), Bali, Indonesia, pp. 625–632, 2008.
[12]Mohammed Alzomai, Bander Alfayyadh, and Audun Jøsang,“Display security for online transactions: SMS-based authentication scheme，” in Proceeding of 2010 International Conference for Internet Technology and Secured Transactions (ICITST), London, UK, 2010.
[13]M. Nystrom, The SecurID (r) SASL Mechanism. No. RFC 2808. 2000.
[14]Liou, Jing-Chiou, and Sujith Bhashyam, “A feasible and cost effective two-factor authentication for online transactions,” in Proceeding of 2010 2nd International Conference on Software Engineering and Data Mining (SEDM), Chengdu, China, 2010.
[15]Usman Alhaji Abdurrahman, Mustafa Kaiiali, and Jawad Muhammad, “A new mobile-based multi-factor authentication scheme using pre-shared number, GPS location and time stamp,” in Proceding of 2013 International Conference on Electronics, Computer and Computation (ICECCO), Ankara, Turkey, pp. 293–296, 2013.
[16]Thomas Zink, Marcel Waldvogel, “X. 509 user certificate-based two-factor authentication for web applications,” [Online]. Available: http://nbn-resolving.de/urn:nbn:de:bsz:352-0-414673, 2017. [Accessed: 08- May- 2018].
[17]Zhongjie Ba, Kui Ren, “Addressing Smartphonebased Multi-factor Authentication via Hardwarerooted Technologies,” in Proceedings of International Conference on Distributed Computing Systems (ICDCS), pp. 1910-1914, USA, 2017.
[18]Markus Miettinen, N. Asokan, Thien Duc Nguyen, Ahmad-Reza Sadeghi, Majid Sobhani, “Context-Based Zero-Interaction Pairing and Key Evolution for Advanced Personal Devices,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Arizona, USA, pp. 880-891, 2014.
[19]Alexei Czeskis, Michael Dietz, Tadayoshi Kohno, Dan Wallach, and Dirk Balfanz, “Strengthening user authentication through opportunistic cryptographic identity assertions,” in Proceedings of the 2012 ACM Conference on Computer and Communications Security, Raleigh, North Carolina, USA, pp.404-414, 2012.
[20]Maliheh Shirvanian, Stanislaw Jarecki, Nitesh Saxena, and Naveen Nathan, “Two-factor authentication resilient to server compromise using mix-bandwidth devices,” In The Network and Distributed System Security Symposium, San Diego, CA, USA, 2014.
[21]WIRELESS CABLES INC, AIRCable. [Online]. Available: https://www, aircable.net/extend.php. [Accessed: 12- May 2018].
[22]MOZZILLA. [Online]. Available: https://www.mozilla.org/en- US/firefox/geolocation/. [Accessed: 13- May- 2018].
[23]Babins Shrestha, Nitesh Saxena, Hien Thi ThuTruong, N. Asokan, “Drone to the rescue: Relayresilient authentication using ambient multisensing,” in Proceeding of International Conference on Financial Cryptography and Data Security, Berlin, Heidelberg, pp. 349-364, 2014.
[24]Dominik Schurmann, Stephan Sigg, “Secure Communication Based on Ambient Audio,” IEEE transactions on mobile computing, 2013, vol. 12, no. 2, pp.358– 370, 2013.
[25]Tsz-Kin Hon, Lin Wang, Joshua D. Reiss, and Andrea Cavallaro, “Audio Fingerprinting for Multi-Device Self-Localization,” IEEE/ACM Transactions on Audio, Speech and Language Processing (TASLP), vol. 23, no. 10, pp.1623–1636, 2015.
[26]Ngu Nguyen, Stephan Sigg, An Huynh, “Using ambient audio in secure mobile phone communication,” in Proceeding of 2012 IEEE International Conference on Pervasive Computing and Communications Workshops (PERCOM Workshops), Lugano, Switzerland, pp. 431–434, 2012.
[27]Alex Varshavsky, Anthony LaMarca, and Eyal deLara, “Enabling Secure and Spontaneous Communication between Mobile Devices using Common Radio Environment,” in Proceeding of HotMobile 2007. Eighth IEEE Workshop on Mobile Computing Systems and Applications, Tucson, AZ, USA, pp. 9–13, 2007.
[28]Nikolaos Karapanos, Claudio Marforio, Claudio Soriente, and Srdjan Čapku, “Sound-Proof: Usable Two-Factor Authentication Based on Ambient Sound,” 24th USENIX Security Symposium, Washington, D.C, pp.483–498, 2015.
[29]Luke Deshotels, “Inaudible Sound as a Covert Channel in Mobile,” in Proceedings of the 8th USENIX Conference on Offensive Technologies, USA, 2014
[30]Daniel Arp, Erwin Quiring, Christian Wressnegger, and Konrad Rieck, “Privacy Threats through Ultrasonic Side Channels on Mobile Devices,” in Proceedings of IEEE European Symposium on Security and Privacy (EuroS&P), pp.35–47, 2017.
[31]Wonsuk Choi, Minhye Seo, and Dong Hoon Lee, “Sound-Proximity: 2-Factor Authentication against Relay Attack on Passive Keyless Entry and Start System,” Journal of Advanced Transportation 2018, 2018.
[32]Brüel & Kjaer, “PRODUCT DATA, Audio Power Amplifier 100W Stereo - Type 2716-C,” BP 1923-12 2007-02.
[33]Theoretically calculated sound intensity (acoustic power). [Online]. Available: http://www.sengpielaudio.com/calculator-levelchange.htm. [Accessed: 02-Jul- 2018].
[34]Stefan L. Hahn, “Hilbert transforms in signal processing,” Boston, 1996.
[35]Sumali, Hartono, Kellogg, and Rick A, “Calculating Damping from Ring-Down Using Hilbert Transform and Curve Fitting,” in Proceeding of Conference: Proposed for presentation at the International Operational Modal Analysis, Istanbul, Turkey, 2011.
[36]Opinions on Analytic signal. [Online]. Available: http://www.writeopinions.com/analytic-signal. [Accessed: 02- Jul-2018].
[37]Alex Varshavsky, Adin Scannell, Anthony LaMarca, Eyal de Lara, “Amigo: Proximity-Based Authentication of Mobile Devices,” in Proceeding of International Conference on Ubiquitous Computing, Heidelberg, 2007.
[38]Hien Thi Thu Truong, Xiang Gao, Babins Shresthay, Nitesh Saxenay, N.Asokanz and Petteri Nurmi, “Comparing and Fusing Different Sensor Modalities for Relay Attack Resistance in Zero-Interaction Authentication,” in Proceeding of 2014 IEEE International Conference on Pervasive Computing and Communications (PerCom), pp.163–171, 2014.