問85
頻出度★★★
一度の認証で, 許可されている複数のサーバやアプリケーションなどを利用できる仕組みを何というか。
平成23年度 秋期 ITパスポート試験 問85
This question's explanation and your answers so far.
解説
問 85
- ア
正解 The correct answer is ア. Single sign-on (SSO) is a mechanism in which a user is authenticated just once and the individual systems share the result of that authentication, so that the user can use the multiple servers, applications, and business systems that he or she has been authorized to use without having to log in again each time. The two conditions in the question, “with a single authentication” and “can use multiple authorized servers, applications, and so on”, correspond directly to the definition of SSO. Ways of implementing it include having an authentication server issue a ticket or credentials that each system then verifies (the Kerberos method, for example), holding the credentials in a cookie in the web browser, having a reverse proxy carry out the authentication on the user's behalf, and keeping an agent resident on each server. The benefits of introducing SSO are that the user only has to remember one password, so dangerous practices such as writing it down or reusing it decrease and the work of logging in is reduced, and that on the administrator side the registration, change, and deletion of user IDs and the management of access rights can be handled centrally. On the other hand, if that single set of credentials leaks, every linked system can be broken into, so measures that strengthen the authentication itself are required as well, such as making the password strong or combining it with the one-time password or biometric authentication described below. Note also that SSO is only a mechanism for “finishing authentication in one step”; authorization, that is, deciding which operations on which systems are permitted after authentication (the setting of access rights), is still needed separately.
Incorrectイ
A smart card is a term for the card-shaped medium itself with an IC chip embedded in it, also called an IC card. Keys, certificates, and personal information can be stored safely inside the chip, and combined with a PIN it is used as a possession-based authentication tool for verifying identity, in employee ID cards, electronic money, health insurance cards, and the like. This is the name of a means or medium used when performing authentication; it does not mean a mechanism that lets the result of a single authentication be shared and reused across multiple servers and applications. It does not express the function the question asks about, being able to use multiple systems with a single authentication, so it is wrong.
Incorrectウ
Biometric authentication, also called biometrics, is an authentication method that verifies a person's identity using physical or behavioral characteristics such as fingerprints, vein patterns, the iris, the face, the voiceprint, or handwriting. Because it does not rely on memory and is hard to lose or lend to someone else, it can be made safer than a password, while balancing the false rejection rate, which wrongly rejects the genuine person, against the false acceptance rate, which wrongly accepts someone else, is a challenge. It is a term for a method of authentication, that is, how to confirm who someone is, and not a mechanism for carrying an authenticated state over between multiple systems, so it does not fit the description in the question.
Incorrectエ
A one-time password is an authentication method that uses a password that is valid only once and is then discarded. The user is made to enter a string of digits generated at fixed intervals by a dedicated token or a smartphone app, or notified by e-mail or a similar means on each use, so that even if it is eavesdropped on over the communication line it cannot be reused, which prevents impersonation. If anything it is a method in which the password has to be entered again on every use, so it has the opposite character to the description in the question, where a single authentication lets the user go on to use multiple systems. It is one means of making authentication stronger, not a mechanism that integrates the authentication of multiple systems, so it is wrong.
ここがポイント
- The definition of single sign-on (SSO) — a mechanism that lets a user use multiple authorized servers and applications with one authentication, without logging in again. The user only has to remember one password, and the administrator can manage IDs and access rights centrally. On the other hand, if those credentials leak, every linked system is put at risk, so it must be used together with measures that strengthen the authentication itself.
- The difference in the roles of authentication-related terms — a smart card (IC card) is a medium for authentication by possession, biometric authentication is a method of authentication by physical characteristics, and a one-time password is a method of authentication by a disposable password; all three are about how to verify who a person is. SSO, by contrast, is about how to share the result of one verification across multiple systems, so it sits at a different layer.
用語