多要素認証（MFA）とは？

多要素認証（MFA）とは？

Multi-factor authentication, or MFA, is a way to verify user identity that is more secure than the classic username-password combination. MFA usually incorporates a password, but it also incorporates one or two additional authentication factors. Two-factor authentication (2FA) is a type of MFA.

MFA is an important part of identity and access management (IAM), and it is often implemented within single sign-on (SSO) solutions.

認証要素とは？

ユーザーにソフトウェアアプリケーションやネットワークへのアクセス権限を付与する前に、本人認証システムは、ユーザーが本人であることを確認するためにユーザー固有の特性に基づいてユーザーを評価します。こうした特性を「認証要素」とも呼びます。

次の認証要素が、最も広く使用されています。

1. Knowledge: something the user knows
2. Possession: something the user has
3. Inherent qualities: something the user is

MFAとは、2つ以上の認証要素を使用することを指します。2つの認証要素のみを使用するMFAのことは、二要素認証（2FA）または2ステップ認証とも呼びます。三要素認証はMFAのもう1つの形態です。

三要素認証の実例にはどのようなものがあるか？

• Knowledge (something the user knows): This factor is a piece of knowledge that only one user should have, like a username and password combination. Other types of knowledge factors include security questions, ID numbers, and Social Security numbers. Even a "secret handshake" may be something a user knows.
• Possession (something the user has): This factor refers to possession of a physical token, device, or key. The most basic example of this authentication factor is using a physical house key to enter one's home. In a computing context, the physical object could be a key fob, a USB device, or even a smartphone.
  Many modern MFA systems will text a temporary code to a user's phone and ask them to enter the code in order to access their account. This demonstrates that the user possesses a phone that no one else possesses, helping establish their identity (unless an attacker has hijacked the user's SIM card).
• Inherent qualities (something the user is): This refers to a physical property of one's body. The most basic version of this authentication factor is the ability to recognize someone by sight or by the sound of their voice. Humans use this ability constantly in their daily interactions. Checking one's appearance against the photo on one's ID card is another example of verifying inherent qualities.
  In a computing context, one example of this authentication factor is Face ID, a feature offered by many modern smartphones. Other methods may include fingerprint scanning, retina scans, and blood tests.

MFAが単一要素認証より安全な理由

単一要素認証とは、上記のいずれか1つの要素を使用して個人を識別することです。単一要素認証の最も一般的な例が、ユーザー名とパスワードのみを要求することです。

単一要素認証の問題は、攻撃者が1つの認証要素への攻撃に成功さえすればユーザーになりすますことができてしまうという点です。ユーザーのパスワードが盗まれると、ユーザーのアカウントは侵害されます。それに対して、ユーザーがMFAを実施した場合、攻撃者はアカウントにアクセスするのに、パスワード以外のものが必要になります。たとえば、ユーザーが持っているものを盗む必要があります。これは、攻撃者にとってはるかに難しいことになります。

This issue also applies to other forms of single-factor authentication. Imagine if banks only required the use of a debit card for withdrawing money — the possession factor — instead of requiring a card plus a PIN. In order to steal money from someone’s account, all a thief would need to do is steal their debit card.

It is important to keep in mind that it is the use of different factors that makes MFA secure, not multiple uses of the same factor.

あるアプリケーションがユーザーにパスワードのみを入力するよう促し、もう1つのアプリケーションがユーザーにパスワードと秘密の質問の答えを入力するよう促すとします。どちらのアプリケーションがより安全ですか？

Technically, the answer is neither: both applications are relying on one authentication factor alone, the knowledge factor. An application that requires a password and either a physical token or a fingerprint scan is more secure than an application that only requires a password and some security questions.

ほかにどのような認証要素があるか？

セキュリティ業界の一部では、上記の3つの認証要素に加えて追加の認証要素を提案または実装しています。実装が行われている例が極めて少ない、こうした認証要素には次のようなものがあります：

Location: Where a user is at time of login. For instance, if a company is based in the U.S. and all its employees work in the U.S., it could assess employee GPS location and reject a login from another country.

Time: When a user logs in, typically in context with their other logins and with their location. If a user appears to log in from one country, then attempts a subsequent login from another country several minutes later, those requests are not likely to be legitimate. A system might also reject login attempts outside of normal business hours — although this is more like a security policy than an identity authentication factor.

この両方を追加の認証要素とみなす場合（議論の余地がありますが）、厳密に言えば、四要素認証や五要素認証も可能になります。両方とも多要素認証に分類されることになります。（そうした強力なセキュリティ対策を講じる場合は、ユーザーに及ぼす影響を加味する必要があります。なぜなら、過度に厳格なセキュリティ対策を講じると、ユーザーは正式なポリシーを回避しようとするからです。）

ユーザーはどのようにアカウントに対してMFAを適用できるか？

Many consumer web services offer MFA today. Most applications that do have MFA offer a form of 2FA that requires the user to use their smartphone when logging in. Explore the security settings in each application to see if it is possible to activate 2FA. In addition, Cloudflare allows all Cloudflare users to implement 2FA for their accounts.

企業はどのようにMFAを実装できるか？

MFAの実装にはSSOソリューションを使用することが推奨されます。SSOは、すべてのアプリにMFAを実装するための単一箇所を提供しますが、すべてのアプリがMFAをサポートしているわけではありません。

Cloudflare Access integrates with SSO vendors who support 2FA. Cloudflare Access is an access control product that protects companies' websites and cloud applications by controlling what users are able to do. Cloudflare Access helps enforce security policies for employees whether they work within controlled office environments or work remotely.