MFDPG: Gudanar da Kalmar Sirri ta Hanyar Abubuwa Masu Yawa Tare da Babu Wani Sirrin da Aka Ajiye

1. Gabatarwa

Kalmomin sirri sun kasance babban hanyar tantancewa ga yawancin aikace-aikacen yanar gizo, duk da haka, satar bayanai da kuma hare-haren satar bayanai na ci gaba da addabar masu amfani. Masu sarrafa kalmomin sirri na tushen girgije kamar LastPass da Dashlane suna ba da sauki amma suna haifar da wuraren gazawa na tsakiya. An gabatar da Masu Samar da Kalmar Sirri ta Tsayayye (DPGs) a matsayin madadin, suna samar da kalmomin sirri na musamman ga kowane yanki ba tare da adana sirrin ba. Duk da haka, an hana karɓuwa ta hanyar lahani na tsaro, sirri, da kuma amfani. Wannan takarda ta binciki DPGs 45 da ke akwai kuma ta gabatar da MFDPG, mai samar da kalmar sirri ta tsayayye mai abubuwa masu yawa wanda ke magance waɗannan kasawa.

2. Teburin Abubuwan Ciki

3. Bincike na DPGs da ke Akwai

Marubutan sun binciki DPGs 45 da ke akwai, suna rarraba su ta hanyar tushen tsarin ɓoye bayanai da kuma tsarin aiki. Binciken ya bayyana manyan nau'ikan matsaloli guda uku.

3.1 Matsalolin Tsaro

Yawancin DPGs suna ba da damar kai hari kai tsaye ga kalmar sirri ta babban mai amfani idan an lalata kowace kalmar sirri da aka samar. Wannan saboda kalmar sirri ta babban mai amfani galibi ita ce kawai shigarwa ga aikin hash. Bugu da ƙari, yawancin tsare-tsare ba su da tsaron gaba, ma'ana, lalata kalmar sirri ta babban mai amfani yana fallasa duk kalmomin sirri na baya da na gaba.

3.2 Matsalolin Sirri

DPGs waɗanda ke buƙatar ɓangaren uwar garken ko sabis na aiki tare na iya fallasa jerin yankunan da mai amfani ke ziyarta. Ko da DPGs na gefen abokin ciniki na iya fallasa bayanai ta hanyoyin gefe ko ta hanyar tsarin kalmomin sirrin da aka samar.

3.3 Matsalolin Amfani

Juyawa kalmar sirri yana da wahala a yawancin DPGs, saboda canza kalmar sirri yana buƙatar tuna lambar sigar ko amfani da wata kalmar sirri ta babban mai amfani daban. Yawancin lokaci ba a tallafawa manufofin kalmar sirri masu rikitarwa (misali, buƙatar haruffa na musamman, mafi ƙarancin tsayi), wanda ke haifar da gazawar shiga akai-akai.

4. Tsarin MFDPG

MFDPG yana magance matsalolin da ke sama ta hanyar sababbin abubuwa guda uku: samar da maɓalli ta hanyar abubuwa masu yawa, tacewar Cuckoo don sokewa, da samar da kalmar sirri ta tushen DFA.

4.1 Samar da Maɓalli ta Hanyar Abubuwa Masu Yawa

Maimakon dogaro da kalmar sirri ta babban mai amfani kawai, MFDPG yana haɗa ƙarin abubuwa kamar alamar hardware (misali, YubiKey) ko kalmar sirri ta lokaci ɗaya (TOTP). Sirrin babban maɓalli ana samar da shi ta amfani da aikin samar da maɓalli (KDF) wanda ya haɗa dukkan abubuwa:

$K = \text{KDF}(P, T, H)$

inda $P$ shine kalmar sirri ta babban mai amfani, $T$ shine ƙimar TOTP, kuma $H$ shine sirrin alamar hardware. Wannan yana tabbatar da cewa lalata kalmar sirri ta babban mai amfani kadai bai isa ba don samar da kalmomin sirri.

4.2 Tacewar Cuckoo don Sokewa

Don tallafawa juyawa kalmar sirri ba tare da fallasa amfani da sabis ba, MFDPG yana amfani da tacewar Cuckoo—wani ƙaramin tsarin bayanai mai yiwuwa—don adana nau'ikan kalmomin sirrin da aka soke. Ana adana tacewar a gida kuma ana iya bincika ta don duba ko an soke wani nau'in da aka bayar. Wannan yana guje wa buƙatar bayanan uwar garken kuma yana kiyaye sirri.

4.3 Biyan Ka'idojin Kalmar Sirri ta hanyar DFA

MFDPG yana amfani da Tsarin Ƙayyadaddun Ƙayyadaddun Ƙayyadaddun (DFA) don ƙirƙirar manufar kalmar sirri ta kowane gidan yanar gizo. DFA yana tabbatar da cewa kalmomin sirrin da aka samar sun cika duk buƙatun manufofin (misali, aƙalla harafi ɗaya babba, lamba ɗaya, harafi na musamman ɗaya). Algorithm ɗin samarwa yana bi ta DFA don samar da ingantacciyar kalmar sirri ta tsayayye.

5. Kimantawa da Sakamako

An kimanta MFDPG akan manyan aikace-aikacen yanar gizo 100 mafi shahara. Sakamakon ya nuna daidaiton kashi 100% tare da manufofin kalmar sirri da ke akwai. Ma'aunin aiki ya nuna cewa samar da kalmar sirri yana ɗaukar ƙasa da 10ms a matsakaici, kuma tacewar Cuckoo yana buƙatar 1.5 KB na ajiya kawai don nau'ikan da aka soke 1000. Samar da maɓalli ta hanyar abubuwa masu yawa yana ƙara ɗan ƙaramin nauyi na 2ms.

6. Babban Fahimta, Tsarin Hankali, Ƙarfi & Rarrauna, Abubuwan da Ake Iya Aiki

Babban Fahimta

MFDPG yana sake tunanin sarrafa kalmar sirri ta hanyar kawar da buƙatar kowane sirrin da aka ajiye—ba a gefen abokin ciniki ko uwar garken ba. Wannan canji ne na tsari daga tsarin rumbun ajiya na tsakiya na yanzu. Babban fahimtar shine cewa ta hanyar haɗa abubuwa masu yawa na tantancewa a lokacin samar da kalmar sirri, za ku iya cimma tsaron alamar hardware ba tare da buƙatar tallafin uwar garken ba.

Tsarin Hankali

Takardar tana bin ci gaba na hankali bayyananne: na farko, tana gano gazawar DPGs da ke akwai ta hanyar bincike mai zurfi; na biyu, tana gabatar da tsarin da ke magance kowace gazawa kai tsaye; na uku, tana tabbatar da tsarin ta hanyar kimantawa mai tsauri. Tsarin yana da ragi, yana motsawa daga matsalolin gaba ɗaya zuwa takamaiman mafita.

Ƙarfi & Rarrauna

Ƙarfi: Hanyar abubuwa masu yawa wani sabon abu ne na gaske wanda ke ɗaga matakin tsaro ga maharan. Amfani da tacewar Cuckoo don sokewa yana da kyau kuma yana kiyaye sirri. Biyan ka'idoji ta tushen DFA mafita ce mai amfani ga matsalar amfani da ta daɗe.

Rarrauna: Takardar ba ta magance ƙwarewar mai amfani na sarrafa alamomin hardware da yawa ba. Dogaro da tacewar Cuckoo na gida yana nufin cewa ba a daidaita bayanan sokewa a cikin na'urori ba, wanda zai iya zama matsala ga masu amfani da na'urori da yawa. Kimantawar, duk da cewa tana da zurfi, an iyakance ta ga manyan gidajen yanar gizo 100 kuma mai yiwuwa ba za ta iya zama gama gari ga duk aikace-aikacen yanar gizo ba.

Abubuwan da Ake Iya Aiki

Ga masu aiki, MFDPG yana ba da hanya mai yuwuwa don kawar da rumbunan kalmar sirri. Ga masu bincike, takardar tana buɗe hanyoyi da yawa: inganta daidaita bayanan sokewa, bincika madadin tsarin bayanai don sokewa, da kuma faɗaɗa hanyar abubuwa masu yawa zuwa wasu mahallin tantancewa. Babban abin da za a iya aiki nan da nan shine cewa duk wata kungiya da ke amfani da mai sarrafa kalmar sirri na tushen girgije ya kamata ta kimanta MFDPG a matsayin madadin mafi tsaro.

7. Bincike na Asali

MFDPG yana wakiltar wani muhimmin ci gaba a cikin neman sarrafa kalmar sirri mai amfani da tsaro. Babban gudunmawar takardar—kawar da sirrin da aka ajiye ta hanyar samar da maɓalli na abubuwa masu yawa—yana magance babban wurin gazawa wanda ya addabi masu sarrafa kalmomin sirri na tushen girgije. Wannan yana tunatar da canji daga tsarin tsakiya zuwa tsarin da ba na tsakiya ba wanda aka gani a wasu fannoni, kamar canji daga gine-ginen abokin ciniki-uwar garken zuwa gine-ginen takwarorinsu (misali, BitTorrent). Amfani da tacewar Cuckoo don sokewa yana da wayo musamman, saboda yana ba da hanyar kiyaye sirri wacce ke guje wa buƙatar bayanan uwar garken. Wannan ya yi daidai da ƙarin girmamawa ga fasahohin kiyaye sirri, kamar yadda Dokar Kariyar Bayanai ta Gabaɗaya (GDPR) ta Tarayyar Turai ta nuna.

Duk da haka, kimantawar takardar ta ɗan iyakance. Yayin da manyan gidajen yanar gizo 100 mafi shahara ke wakiltar wani yanki mai mahimmanci na ayyukan mai amfani, mai yiwuwa ba za su wakilci dogon wutsiyar gidajen yanar gizon da masu amfani ke ziyarta ba. Bugu da ƙari, takardar ba ta magance amfanin sarrafa alamomin hardware da yawa ba, wanda zai iya zama shinge ga karɓuwa. Ƙwarewar mai amfani na saita da amfani da alamar hardware har yanzu yana da wahala ga mai amfani na yau da kullun, kamar yadda binciken Cibiyar Ƙididdiga da Fasaha ta Ƙasa (NIST) ya nuna.

Daga hangen nesa na fasaha, samar da kalmar sirri ta tushen DFA mafita ce mai ƙarfi ga matsalar manufar kalmar sirri. Duk da haka, takardar ba ta tattauna rikitarwar gina DFA ga kowane gidan yanar gizo ba. A aikace, wannan zai buƙaci bayanan manufofin kalmar sirri, wanda al'umma ko masu haɓaka MFDPG za su iya kula da shi. Wannan ƙalubale ne na injiniya mai mahimmanci.

A ƙarshe, MFDPG tsari ne da aka tsara da kyau wanda ke magance yawancin kasawar DPGs da ke akwai. Hanyar abubuwa masu yawa da amfani da tacewar Cuckoo sababbin abubuwa ne na gaske. Duk da haka, takardar za ta amfana daga ƙarin kimantawa mai yawa da kuma tattaunawa game da ƙalubalen aiki na yau da kullun. Makomar sarrafa kalmar sirri na iya kasancewa a cikin tsarin kamar MFDPG wanda ke kawar da sirrin da aka ajiye, amma akwai aiki mai mahimmanci da ya rage don sanya irin waɗannan tsarin su zama masu amfani ga mutum na yau da kullun.

8. Cikakkun Bayanai na Fasaha da Tsarin Lissafi

Jigon MFDPG shine aikin samar da maɓalli na abubuwa masu yawa. Bari $P$ ta zama kalmar sirri ta babban mai amfani, $T$ ta zama ƙimar TOTP a lokaci $t$, kuma $H$ ta zama sirrin alamar hardware. Ana samar da babban maɓalli $K$ kamar haka:

$K = \text{PBKDF2}(P \oplus T \oplus H, \text{salt}, \text{iterations})$

inda $\oplus$ ke nuna XOR. Kalmar sirri ga yanki $d$ tare da nau'in $v$ ita ce:

$\text{Password} = \text{DFA-Generate}(\text{HMAC-SHA256}(K, d || v), \text{policy})$

Aikin DFA-Generate yana ɗaukar iri na ƙarya-bazuwar da DFA mai wakiltar manufar kalmar sirri, kuma yana fitar da ingantacciyar kalmar sirri. Tacewar Cuckoo tana adana tuple $(d, v)$ ga kowane nau'in kalmar sirri da aka soke. Tacewar tana goyan bayan sakawa da bincike a cikin lokaci $O(1)$.

9. Nazarin Shari'a: Misalin MFDPG a Aiki

Yi la'akari da mai amfani Alice wanda ke son sarrafa kalmomin sirrinta ta amfani da MFDPG. Tana da kalmar sirri ta babban mai amfani "MySecureP@ss1" da YubiKey mai sirri "YubiSecret123". Ta ziyarci gidan yanar gizo, example.com, wanda ke buƙatar kalmar sirri mai aƙalla haruffa 8, harafi ɗaya babba, lamba ɗaya, da harafi na musamman ɗaya.

1. Alice ta shigar da kalmar sirrinta ta babban mai amfani kuma ta toshe YubiKey dinta.
2. MFDPG yana lissafta ƙimar TOTP (misali, "847291") kuma ya samar da babban maɓalli: $K = \text{PBKDF2}(\text{MySecureP@ss1} \oplus 847291 \oplus \text{YubiSecret123}, \text{salt}, 10000)$.
3. MFDPG yana samar da kalmar sirri ga example.com ta amfani da DFA don manufar: $\text{Password} = \text{DFA-Generate}(\text{HMAC-SHA256}(K, \text{example.com} || 1), \text{policy})$.
4. Kalmar sirrin da aka samar ita ce, misali, "A8b!cD2e".
5. Idan Alice daga baya ta canza kalmar sirrinta, ta ƙara lambar nau'in zuwa 2 kuma ta ƙara tsohon nau'in (example.com, 1) zuwa tacewar Cuckoo.

10. Aikace-aikace da Hanyoyi na Gaba

MFDPG yana buɗe hanyoyi masu ban sha'awa da yawa don bincike da haɓakawa na gaba. Na farko, ana iya faɗaɗa samar da maɓalli na abubuwa masu yawa don haɗa abubuwan halitta, kamar sawun yatsa ko tantancewar fuska, don ƙara haɓaka tsaro. Na biyu, ana iya maye gurbin tacewar Cuckoo da wani tsarin bayanai mafi ci gaba, kamar tacewar Bloom mai tallafin gogewa, don inganta inganci. Na uku, ana iya haɓaka samar da kalmar sirri ta tushen DFA don tallafawa manufofin kalmar sirri na sabani, gami da waɗanda ke buƙatar takamaiman tsari (misali, babu haruffa a jere).

Daga hangen nesa na aiki, ana iya haɗa MFDPG cikin masu binciken yanar gizo azaman plugin, yana ba da sarrafa kalmar sirri mara kyau ba tare da buƙatar wani aikace-aikace na daban ba. Hakanan za'a iya amfani dashi a cikin mahallin kamfanoni don tilasta manufofin kalmar sirri masu ƙarfi a cikin duk aikace-aikacen. Tsarin babu sirrin da aka ajiye yana da sha'awa musamman ga ƙungiyoyin da ke ƙarƙashin ƙa'idodin kariyar bayanai masu tsauri, kamar HIPAA ko PCI-DSS.

A ƙarshe, ana iya amfani da ƙa'idodin da ke ƙarƙashin MFDPG zuwa wasu mahallin tantancewa, kamar sarrafa maɓallin SSH ko samar da alamar API. Tunanin samar da sirri daga abubuwa masu yawa ba tare da adana su ba wani abu ne mai ƙarfi wanda zai iya canza yadda muke tunani game da tantancewa.

11. Manazarta

1. V. Nair da D. Song, "MFDPG: Multi-Factor Authenticated Password Management With Zero Stored Secrets," UC Berkeley, 2023.
2. B. Ross et al., "PwdHash: A Browser-Based Password Manager," a cikin USENIX Security Symposium, 2005.
3. J. Bonneau et al., "The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes," a cikin IEEE Symposium on Security and Privacy, 2012.
4. D. Florencio da C. Herley, "A Large-Scale Study of Web Password Habits," a cikin WWW, 2007.
5. NIST, "Digital Identity Guidelines," NIST Special Publication 800-63B, 2017.
6. Tarayyar Turai, "General Data Protection Regulation (GDPR)," 2016.
7. B. Fan et al., "Cuckoo Filter: Practically Better Than Bloom," a cikin CoNEXT, 2014.
8. M. Bellare et al., "Key Derivation Functions and Their Uses," a cikin CRYPTO, 1999.
9. J. Kelsey et al., "PBKDF2: Password-Based Key Derivation Function 2," RFC 2898, 2000.
10. D. M'Raihi et al., "TOTP: Time-Based One-Time Password Algorithm," RFC 6238, 2011.