問58
頻出度★★★
システムの利用者認証技術に関する記述のうち, 適切なものはどれか。
平成25年度 春期 ITパスポート試験 問58
This question's explanation and your answers so far.
解説
問 58
Incorrectア
The description given — “a mechanism that allows a user to access multiple permitted servers, applications, and so on with a single authentication” — is the definition of single sign-on (SSO), not of challenge-response authentication. Challenge-response authentication is a method in which the user combines a random value sent by the server that differs every time (the challenge) with the user password, computes a value from them (the response), and returns it, thereby verifying identity without sending the password itself over the network. The definition and the term name do not match, so this choice is wrong.
Incorrectイ
The description given — “a mechanism that performs identity authentication using physical characteristics such as fingerprints or voiceprints” — is the definition of biometrics authentication, not of single sign-on. Single sign-on is the mechanism that lets a user access multiple permitted servers and applications with a single authentication. Note also that choices ア, イ, and ウ in this question are structured so that the term names are shifted by one against the definitions (a cyclic shift) — for example, the term name that matches the definition in ア is placed as the term name in イ — so the question tests whether you remember the term-to-definition pairings exactly.
Incorrectウ
The description given — “a method in which the user memorizes information about positions rather than a specific sequence of numbers or characters, and at authentication time enters, as the password, the numbers or characters arranged at the memorized positions within a table displayed on the screen” — is called matrix authentication, not biometrics authentication. Because the numbers shown in the table change every time, the value entered also changes every time, which makes this method resistant to shoulder surfing. Biometrics authentication uses physical characteristics such as fingerprints, voiceprints, irises, or veins, so the definition and the term name do not match and this choice is wrong.
- エ
正解 エ is the correct statement. A one-time password (OTP) is, just as the name suggests, a disposable password that can be used only once for authentication; once it has been used, it becomes invalid. A fixed password that uses the same string every time can be eavesdropped on over the communication line or seen by someone looking at the screen, and after that a third party can simply reuse it. A one-time password, by contrast, issues a different value for each authentication — through a dedicated token (a hardware token or a smartphone app), or by sending the value to a mobile phone or e-mail address registered in advance — so even if it is eavesdropped on it cannot be used for the next authentication, which greatly reduces the risk of impersonation. It is widely used for things like transaction authentication in internet banking, and it is a standard IT Passport term.
ここがポイント
- A one-time password is a disposable password issued for each authentication, and it becomes invalid once it has been used. Even if it is eavesdropped on or seen by someone, it cannot be reused, so it is stronger against impersonation than a fixed password.
- The point being tested is whether you can correctly pair the terms of user authentication technology with their definitions. Learn them apart like this: single sign-on = a mechanism that lets you use multiple servers and applications after a single authentication; biometrics authentication = authentication using physical characteristics such as fingerprints or voiceprints; challenge-response authentication = authentication that exchanges a different value each time without sending the password itself; matrix authentication = authentication in which you enter the characters at the positions you memorized in a table.
用語