パスワードのいらない世界へ～windows 10とfido

パスワードのいらない世界へ～ Windows 10 と FIDO

那須悟（ Nasu Satoru ）ブログ元「なんでもエンジニ屋」のダメ日記

Twitter @nasunotw

2015/12/22b 第八回雑談会～はやりそうな技術を考察しよう！～

http://nasunoblog.blogspot.com/

https://twitter.com/nasunotw

パスワード認証は

既に古い !!!

今までのユーザー認証

UserName & Password

パスワードマネージャー

Automatically Remembers Your Passwords.

悪い人達の手口（一例）

Phishing Malware

企業を狙った不正送金

出展）法人口座を狙ったネット犯罪が急増！インターネットバンキングの不正送金対策https://direct.fujixerox.co.jp/ap1/sc/beat/ja/trend/031320.html

パスワードのいらない

世界になりたい

Windows 10の認証方法

Windows Hello & Microsoft Passport

PIN Code Windows Hello

• Windows Hello光彩・指紋・顔※の生体で認証

生体認証は PIN 入力の代わりである※ 顔認証は赤外線 (IR) カメラが必要

• Microsoft PassportFIDO 2.0 に準拠した認証プロセス


• Windows Hello光彩・指紋・顔※の生体で認証

生体認証は PIN 入力の代わりである※ 顔認証は赤外線 (IR) カメラが必要

• Microsoft PassportFIDO 2.0 に準拠した認証プロセス


http://www.buildinsider.net/small/newsensor/realsenser200

FIDO～新しいオンライン認証技術

• 読み方は“ファイド”

• 生体認証などを利用した新しいオンラ

イン認証技術の標準化を目指す

• ユーザー認証の仕組みとして共通フ

レームワークを用意＝シンプル＆安全

FIDO とは

U2F(Universal Second Factor)

U2F(Universal Second Factor)

Hardware Software

UAF(Universal Authentication Framework)

UAF(Universal Authentication Framework)

PIN Code Iris, Fingerprint Voice, Face

Board Level

Sponsor Level

Associate

Level28 社 74 社 153 社

FIDO を推進する企業数

出展） https://fidoalliance.org/membership/members/

2FA inc.Acceptto CorporationAktiv-Soft CompanyAladdin R.D.AllWeb TechnologiesAratekArxanAthena EyesAustria CardAware, Inc. Ayoy ABBehavioSecBeijing Stone Shield Technology Co., LtdBeijing Sykean Technology Co., LtdBiomatiquesBiocatchBIO–keyBluink LimitedBoomHope Information and Technology Co., LtdB-Secur LimitedBTWorks Inc.CBA Japan, Inc.Century Longmai Technology Co., Ltd.certgate GmbHChanging Information TechnologyChongqing Kaize Technology Co., Ltd.CICADA Security Technology Inc. CiptorClarkson UniversityClover Network IncCogito Group Pty Ltd CopSonicCREA plus d.o.ocryptovisionCryptsoft Pty LtdCURAY Soft, Inc.Cybertrust Japan Co.,Ltd.Design SHIFTDiamond Fortress TechnologiesDigiFlakDream Security Co., Ltd KoreaDreamtech Co., LtdD–TRUSTEasy Solutions, Inc.Ebiid Products and Solutions SL

Elliptic Technologies IncEnterprise Sentinel AuthenticationEncap Security, Inc.EyeVerifyeWBM Co., LtdFacePhi BiometriaFingerprint Cards ABFusionPipe Software Solutions Inc.Getac Technology CorporationGoTrust Technology Inc.GuangZhou Edao Network Technology Ltd.Hangzhou Synochip Data Security Technologies Co., LtdHYPRHypersecu Information Systems, Inc.ID&Trust Ltd.Identiv, Inc.IDMCloud, Inc.InAuthInCOMM Technologies Co., LtdIndicativ, Inc. Inside SecureIntellisisIRIENCE Co., LtdIrisys Co. LtdIritech, Inc.j-Metrics Technology Co., Ltd.LSE Leading Security Experts GmbHLaunchkeyLedgerLightFactorLion Security Co., Ltd.LogIn PeoplemagicJackMeontrust, IncMirae TechnologyMondoKey LimitedMontelbaanMTRIX GmbHmyPinPad LtdNanchang O-Film Bio-Identification Technology Co., Ltd.NeowaveNexID Biometrics LLCNext Biometrics

nGenSoftNomad Connection, Inc. Odyssey Technologies LimitedOneginiOneLogin, Inc.OneVisagePaycasso Verify LimitedPayEgis Information Technology IncPayfonePersistent SystemsPixelPinPrecise Biometrics ABPrickzQuanTag IT Solutions GmbHQueralt, Inc. RaonSecure Co., Ltd.RCDevs SASafeGov Inc.Salesforce.comSalt Group Pty LtdSECIOSS, IncSecureMetric TechnologySecureResetSecuve Co., Ltd.Sensory Inc.SGA Solutions Inc.Shenzhen Decard Smartcard Tech Co.,Ltd.Shenzhen National Engineering Laboratory (aka NELD TV) Shenzhen SiliconGo Microelectronics Co., Ltd.ShenZhen DTEC Tech Co., Ltd.Shenzhen Snowball Technology Co., Ltd.Shenzhen Xinguodu Technology Co., LtdSIGMAXYZ, Inc.Silk ID SystemsSoftGiken Co.,Ltd.Solacia Inc.Startek Engineering IncorporatedSthalerStrongAuth, IncSunet SurePassIDTechnoglobal IncTechshino TechnologyThreatMetrix Inc.

Thunder Software Technology Co., Ltd.ToopherTouchcorpTrustonic LimitedTwilio, Inc.Ubiquitous CorporationuQontrol, Inc. V-Key IncValidSoft LimitedVancosys Data Solutions Inc VerbioVoicePIN.comVoiceVaultVP, Inc. VU LLCWinfrasoftWWPass CorporationZhejiang Wellcom Technology Co., Ltd.Zighra Inc.ZKAccessZwipe


http://2fa.com/

http://2fa.com/

https://www.acceptto.com/

https://www.acceptto.com/

http://aktiv-company.ru/

http://aktiv-company.ru/

http://aladdin-rd.ru/en/

http://www.allwebid.com/

http://www.allwebid.com/

http://www.aratek.com.cn/

http://www.arxan.com/

http://www.a-eye.cn/

http://www.austriacard.at/

http://www.aware.com/

http://www.ayoy.se/?lang=en

http://www.ayoy.se/?lang=en

http://www.behaviosec.com/

http://www.qrtoken.cn/

http://sykean.com/

http://sykean.com/

http://sykean.com/

http://www.biomatiques.com/

http://www.biocatch.com/

http://bio-key.com/

http://www.bluink.ca/

http://www.bluink.ca/

http://hunanbohong.com/

http://hunanbohong.com/

http://www.b-secur.com/



http://www.btworks.co.kr/

http://www.btworks.co.kr/

http://www.cba-japan.net/index.php

http://www.longmai.net/



http://www.certgate.com/

http://www.certgate.com/

http://www.changingtec.com/

https://www.kaizegf.com/



http://cicadasecurity.com/

http://ciptor.com/

http://clarkson.edu/

https://www.clover.com/

https://www.clover.com/

http://www.cogitogroup.com.au/

http://www.copsonic.com/

http://www.creaplus.si/sl/

http://www.creaplus.si/sl/

http://www.cryptovision.com/

http://www.cryptsoft.com/

http://www.cryptsoft.com/

https://www.cybertrust.ne.jp/index.html




http://www.design-shift.com/

http://www.diamondfortress.com/

http://www.digiflak.com/

http://www.dreamsecurity.com/

https://www.idreamtech.co.kr/

https://www.idreamtech.co.kr/

http://www.bundesdruckerei.de/de/162-e-services

http://www.easysol.net/newweb/

http://www.biid.com/

http://www.biid.com/

http://www.elliptictech.com/

http://www.elliptictech.com/

http://www.esauth.com/

https://www.encapsecurity.com/

https://www.encapsecurity.com/

http://eyeverify.com/

http://www.e-wbm.com/

http://www.e-wbm.com/

http://www.facephi.com/en/



http://www.fingerprints.com/

http://fusionpipe.com/

http://fusionpipe.com/

http://www.getac.com.tw/

http://www.go-trust.com/

http://www.go-trust.com/

http://www.edaotech.com/




http://www.synochip.com/en/



http://www.hypr.com/

http://hypersecu.com/

http://hypersecu.com/

http://www.idandtrust.com/

http://www.idandtrust.com/

http://www.identiv.com/

http://www.identiv.com/

http://www.idmcloud.io/

http://www.idmcloud.io/

http://inauth.com/

http://www.incomm.com.tw/

http://www.incomm.com.tw/

http://www.indicativ.com/

http://www.indicativ.com/

http://www.insidesecure.com/

http://www.intellisis.com/

http://www.irience.com/

http://www.irisys.co.kr/

http://www.irisys.co.kr/

http://www.iritech.com/

http://www.iritech.com/

http://www.j-metrics.com/en/

http://www.lsexperts.de/

https://launchkey.com/

http://www.ledger.co/

http://www.lightfactor.co/

https://www.loginpeople.com/?lang=en

https://www.loginpeople.com/?lang=en

http://www.magicjack.com/index.html

http://www.mepin.com/



http://www.mirae-tech.co.kr/english/solution/solutions1_tab01.php

http://www.mirae-tech.co.kr/english/solution/solutions1_tab01.php

http://www.mondokey.com/

http://www.mondokey.com/

http://www.montelbaan.nl/

http://www.mtrix.de/

http://www.mypinpad.com/

http://www.mypinpad.com/

http://www.o-film.com/

http://www.o-film.com/

http://www.neowave.fr/en/index.html

http://nexidbiometrics.com/

http://nexidbiometrics.com/

http://www.nextbiometrics.com/

http://www.ngensoft.co.kr/main/main.php

http://www.nomadconnection.com/

http://www.odysseytec.com/

http://www.onegini.com/

http://www.onelogin.com/

http://www.onelogin.com/

http://onevisage.com/

http://www.paycasso.com/

http://www.paycasso.com/

https://www.payegis.com.cn/



http://www.payfone.com/

http://www.persistent.com/

http://www.pixelpin.co.uk/

http://www.precisebiometrics.com/

http://prickz.net/

http://www.quantag-it.com/

http://www.quantag-it.com/

http://queraltinc.com/

http://queraltinc.com/

http://www.raonsecure.com/eng

http://www.raonsecure.com/eng

http://www.rcdevs.com/company/

http://www.rcdevs.com/company/

http://www.safegov.org/

http://www.safegov.org/

http://www.salesforce.com/

http://www.saltgroup.com.au/contact.php

http://secioss.co.jp/

http://secioss.co.jp/

http://www.securemetric.com/

http://www.securemetric.com/

http://www.securereset.com/

http://www.secuve.com/

http://www.secuve.com/

http://www.sensory.com/

http://www.sgacorp.kr/

http://www.decard.com/





http://www.neldtv.org/

http://www.neldtv.org/

http://snowballtech.com/

http://www.xinguodu.com/



http://www.sigmaxyz.com/

http://www.silkidsystems.com/

http://www.sgk.co.jp/




http://www.sola-cia.com/

http://www.sola-cia.com/

http://www.startek-eng.com/

http://www.startek-eng.com/

http://www.sthaler.com/

http://www.strongauth.com/



https://www.sunet.se/

https://www.sunet.se/

http://surepassid.com/

http://www.techno-global.net/



http://en.techshino.com/

http://en.techshino.com/

http://www.threatmetrix.com/

http://www.threatmetrix.com/

http://www.thundersoft.com/

http://toopher.com/

http://www.touchcorp.com/

http://www.trustonic.com/

http://www.trustonic.com/

http://www.twilio.com/

http://www.twilio.com/

http://www.ubiquitous.co.jp/

http://www.uqontrol.com/

http://www.uqontrol.com/

http://www.v-key.com/

http://www.v-key.com/

http://www.validsoft.com/

http://www.validsoft.com/

http://www.vancosys.com/




http://www.verbio.com/en/

http://voicepin.com/

http://www.voicevault.com/

http://vp.co.kr/

http://www.vusecurity.com/en-index.php

http://www.winfrasoft.com/

http://wwpass.com/

http://wwpass.com/

http://wellcom.cn/

http://wellcom.cn/

http://wellcom.cn/

http://www.zighra.com/

http://www.zighra.com/

http://www.zkaccess.com/default.aspx

http://www.zwipe.no/

パスワード認証

↓次世代認証

まとめ

おしまい