隨著科技快速發展，元宇宙（Metaverse）作為一個結合虛擬實境、擴增實境、人工智慧及通訊技術的新興數位空間，逐漸成為下一代網路互動的發展方向。然而，元宇宙的開放性與跨裝置、跨平台特性，使得使用者身分驗證面臨前所未有的挑戰，包括身分偽冒、帳號竊取、社交工程攻擊、中間人攻擊及裝置竊取等風險。傳統以帳號密碼為基礎的驗證方式，已無法有效應對元宇宙中多元化、分散式的安全需求。
為解決上述問題，現有文獻研究提出基於橢圓曲線密碼學（Elliptic Curve Cryptography, ECC）的三因子驗證機制，強化安全性與隱私性。然而，該方案在跨域應用、裝置驗證與持續驗證層面仍有不足，難以完全滿足元宇宙高度互動與跨平台的需求。有鑑於此，本研究方法提出一個結合 FIDO（Fast Identity Online）、Kerberos 認證協定與符合零信任（Zero Trust）理念的身分驗證設計，期望有一個兼具安全性、互通性與可擴展性的身分驗證機制，以因應元宇宙環境下多裝置、多場景的應用挑戰。
本研究方法透過分析元宇宙中的身分驗證威脅、探討多因子驗證與 ECC 技術發展，並比較現有身分驗證方案的優缺點，進而設計出結合 FIDO 無密碼驗證特性、Kerberos 票據授權機制與符合零信任理念的身分驗證架構，為元宇宙中的身分驗證提供一套更安全、靈活且可持續發展的解決方案，也為未來建構更全面的元宇宙安全模型奠定了堅實的基礎。

As the Metaverse evolves into a next-generation interactive space, its open and cross-platform nature renders traditional password-based authentication inadequate against emerging threats like identity theft and impersonation. Existing ECC-based solutions also fall short in cross-domain and continuous verification. To address these challenges, this study proposes a secure authentication framework integrating FIDO (Fast Identity Online), Kerberos, and Zero Trust principles. By combining FIDO's passwordless capabilities with Kerberos's ticket-granting mechanism, the proposed architecture offers a secure, interoperable, and scalable solution tailored for multi-device Metaverse environments, establishing a robust foundation for future security models

[1] A. Armando et al., "The AVISPA tool for the automated validation of internet security protocols and applications," in International Conference on Computer Aided Verification, Berlin, Heidelberg: Springer Berlin Heidelberg, 2005, pp. 281–285.
[2] E. Barker et al., "Recommendation for pair-wise key-establishment schemes using discrete logarithm cryptography," NIST Special Publication (SP) 800-56A Rev. 3 (Draft), 2017.
[3] D. Basin, S. Mödersheim, and L. Vigano, "OFMC: A symbolic model checker for security protocols," International Journal of Information Security, vol. 4, no. 3, pp. 181–208, 2005.
[4] M. Bellare, R. Canetti, and H. Krawczyk, "Keying hash functions for message authentication," in Annual International Cryptology Conference, Berlin, Heidelberg: Springer Berlin Heidelberg, 1996, pp. 1–15.
[5] Checkpoint, "The ultimate guide to Zero Trust security," 2019. [Online]. Available: https://pages.checkpoint.com/the-ultimate-guide-to-zero-trust.html
[6] R. Di Pietro and S. Cresci, "Metaverse: Security and privacy issues," in 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), 2021, pp. 281–288.
[7] W. Diffie and M. E. Hellman, "New directions in cryptography," in Democratizing Cryptography: The Work of Whitfield Diffie and Martin Hellman, 2022, pp. 365–390.
[8] D. Dolev and A. Yao, "On the security of public key protocols," IEEE Transactions on Information Theory, vol. 29, no. 2, pp. 198–208, 2003.
[9] B. Falchuk, S. Loeb, and R. Neff, "The social metaverse: Battle for privacy," IEEE Technology and Society Magazine, vol. 37, no. 2, pp. 52–61, 2018.
[10] FIDO Alliance, "Specifications," n.d. [Online]. Available: https://fidoalliance.org/specifications/
[11] J. Kindervag, "Build security into your network’s DNA: The zero trust network architecture," Forrester Research Inc, vol. 27, pp. 1–16, 2010.
[12] J. Kindervag and S. Balaouras, "No more chewy centers: Introducing the zero trust model of information security," Forrester Research, vol. 3, no. 1, pp. 1–16, 2010.
[13] N. Koblitz, "Elliptic curve cryptosystems," Mathematics of Computation, vol. 48, no. 177, pp. 203–209, 1987.
[14] L. H. Lee et al., "All one needs to know about metaverse: A complete survey on technological singularity, virtual ecosystem, and research agenda," Foundations and Trends® in Human-Computer Interaction, vol. 18, no. 2–3, pp. 100–337, 2024.
[15] A. J. Menezes, P. C. Van Oorschot, and S. A. Vanstone, Handbook of Applied Cryptography. CRC Press, 2018.
[16] Microsoft, "如何使用安全金鑰在內部部署環境中設定無密碼驗證," n.d. [Online]. Available: https://learn.microsoft.com/zh-tw/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises
[17] V. S. Miller, "Use of elliptic curves in cryptography," in Conference on the Theory and Application of Cryptographic Techniques, Berlin, Heidelberg: Springer Berlin Heidelberg, 1985, pp. 417–426.
[18] S. Mystakidis, "Metaverse," Encyclopedia, vol. 2, no. 1, pp. 486–497, 2022.
[19] C. Neuman, T. Yu, S. Hartman, and K. Raeburn, "RFC 4120: The Kerberos network authentication service (V5)," 2005.
[20] A. Ometov et al., "Multi-factor authentication: A survey," Cryptography, vol. 2, no. 1, p. 1, 2018.
[21] S. M. Park and Y. G. Kim, "A metaverse: Taxonomy, components, applications, and open challenges," IEEE Access, vol. 10, pp. 4209–4251, 2022.
[22] H. Ravilla et al., "Study and analysis of FIDO2 passwordless web authentication," ResearchGate, 2024. [Online]. Available: https://www.researchgate.net/publication/383944347_Study_and_Analysis_of_FIDO2_Passwordless_Web_Authentication
[23] V. Stafford, "Zero trust architecture," NIST Special Publication, vol. 800, no. 207, pp. 800–207, 2020.
[24] W. Stallings, Network and Internetwork Security: Principles and Practice. Prentice-Hall, Inc., 1995.
[25] W. Stallings, Cryptography and Network Security, 4/E. Pearson Education India, 2006.
[26] J. G. Steiner, B. C. Neuman, and J. I. Schiller, "Kerberos: An Authentication Service for Open Network Systems," in USENIX Winter, 1988, pp. 191–202.
[27] N. Stephenson, Snow Crash. Penguin UK, 1994.
[28] G. Thakur et al., "A robust privacy-preserving ECC-based three-factor authentication scheme for metaverse environment," Computer Communications, vol. 211, pp. 271–285, 2023.
[29] M. Turuani, "The CL-Atse protocol analyser," in International Conference on Rewriting Techniques and Applications, Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 277–286.
[30] H. Wang et al., "A survey on the metaverse: The state-of-the-art, technologies, applications, and challenges," IEEE Internet of Things Journal, vol. 10, no. 16, pp. 14671–14688, 2023.
[31] Y. Wang et al., "A survey on metaverse: Fundamentals, security, and privacy," IEEE Communications Surveys & Tutorials, vol. 25, no. 1, pp. 319–352, 2022.
[32] J. Ryu, S. Son, J. Lee, Y. Park, Y. Park, Design of secure mutual authentication scheme for metaverse environments using blockchain, Ieee Access 10 (2022) 98944–98958.
[33] S. Son, J. Lee, M. Kim, S. Yu, A.K. Das, Y. Park, Design of secure authentication protocol for cloud-assisted telecare medical information system using blockchain, IEEE Access 8 (2020) 192177–192191.