Start dealing with NRI security, multi-factor authentication device "YubiKey"

In recent years, there is an increasing trend of illegal login and illegal access taking the opportunity of ID and password being stolen and leaked. According to the National Police Agency, the Ministry of General Affairs and the Ministry of economy, Trade and Industry, awareness of 1840 unauthorized visits increased from 1840 in 2016 to 2806 in 2020 [iii]. From this point of view, in order to protect information systems and users, we not only need to carry out "knowledge information" through passwords, but also need to promote the combination of "holding information", "biological information" and other elements of multi-factor authentication. YubiKey is a kind of automatic password generation device, which is suitable for multi-factor authentication of various forms of use. It can be used on a computer or smartphone without installing software or drivers (see photo for YubiKey devices). Photo: YubiKey "Security key Series"

The characteristics of YubiKey support a variety of authentication methods and services, including FIDO2 [iv]

Led by FIDO2, YubiKey can correspond to six authentication methods, such as smart card [v] and one-time password (OTP) token. It can also be used to authenticate about 1000 services, including the integrated ID and access management solution "Uni-ID Libra" developed and provided by Microsoft Azure Active Directory, Okta Identity Cloud and NRI security.

Support for multiple interfaces

USB-A, USB-C, NFC and Lightning are supported.

Many achievements in the world

It is used by about 160 countries and more than 4000 companies.

YubiKey's deployment support service NRI Security consultant has the latest development trend of certification technology, as well as rich knowledge and experience in designing and implementing security information systems, and puts forward the best use of YubiKey on the basis of meeting the challenges and requirements of the deployment enterprise. It provides a wide range of help from requirements definition to deployment support and operation. For more information about YubiKey and its deployment support services, refer to the following website: Https://www.nri-secure.co.jp/service/solution/yubikeyNRI Security has joined the international non-profit organization FIDO Alliance to promote the standardization of password-free authentication and has a wealth of knowledge in identity authentication. While making full use of this knowledge, we will also provide a variety of products and services to support the information security countermeasures of enterprises and organizations in the future, so as to contribute to the realization of a secure information system environment and society on a global scale. [I] Yubico: IT company founded in Sweden in 2007. Currently, we are developing security keys in Sweden and the United States. For more information about Yubico, please refer to the following website. Https://www.yubico.com/yubico/?lang=zh [ii] multi-factor authentication: refers to the three elements of certification-"knowledge information", "holding information", "biological information" in more than 2 combination certification. For example, after authenticating with an ID password, send a short message to the device held by the user to enter the password, or combine it with biological authentication such as fingerprints, so as to improve the level of security. [iii] Police Agency, Ministry of General Affairs, Ministry of economy, Trade and Industry (March 4, 2021) "occurrence of illegal access and research and development of technologies related to access control functions" Annex 1 https://www.soumu.go.jp/main_content/ 000735800.pdf [iv] FIDO (FIDO) 2:FIDO the latest version of the specification group. It consists of the W3C standardized Web Authentication Specification (WebAuthn) and the collaboration Specification (CTAP) with external authentication devices. [v] Smart card: a card containing an integrated circuit (IC) for recording and calculating information (data). Also known as IC card. The names of products and services recorded by the company shall be trademarks or registered trademarks of enterprises or groups.