新一代的數位身分識別證（New eID）是我們國家未來將實施的身分證明制度。該制度的主要目標在於提供公民一種更便捷的方式來取得政府服務，同時也能在促進產業創新與增值的同時，確實保護公民的隱私並加強資訊安全。鑑於此，為了提升基於數位身分識別證的數位應用之隱私防護，我們的研究提出一個以數位身分識別證和FIDO認證標準為基礎的隱私防護框架。此框架能針對數位身分識別證的數位應用進行資料流隱私風險評估，進而分析並釐清潛在的隱私洩漏風險，從而確定處理的優先順序和制定適當的緩解策略。此外，為了展現該框架的實際應用範疇，我們提出了三種視訊診療的應用情境方案。再者，我們更進一步提出一套基於免憑證簽章技術、數位身分識別證和FIDO認證的安全傳輸流程，以增強整體系統的資訊安全，並實證該架構的實際可行性。

The New eID is considered as the next generation technology of citizens’ identities verification in which our country is set to implement in the future. The main objective of the New eID is to provide citizens with a more convenient way to access government services, while also ensuring the protection of citizens' privacy and information security as industry innovation and value addition are promoted. With this in mind, to improve the privacy protection of digital applications based on the New eID, this study proposes a privacy protection framework based on the New eID and FIDO technology. This framework is designed to perform privacy risk assessments for data flows in the New eID applications, to analyze and clarify potential privacy leakage risks, and to determine the priority of handling and appropriate mitigation strategies. Additionally, to showcase the practical scope of this framework, We introduce three application scenarios suitable for telemedicine, we investigate a secure transmission process based on certificateless signature technology, the New eID, and FIDO technology to enhance the information security of the entire system and have proven the feasibility of this process.

第一章 緒論 1
第一節 研究背景與動機 1
第二節 研究目的 3
第三節 研究貢獻 3
第二章 文獻探討 4
第一節 數位身分識別證 4
第二節 FIDO 認證 6
第三節 現有安全防護技術 8
第四節 視訊診療 9
一、台灣 11
二、日本 11
三、美國(加州) 12
第三章 FIDO隱私防護框架 14
第一節 單一登入傳輸架構 14
第二節 隱私風險評鑑 15
一、 數位身分識別證之欄位 15
二、 識別利害關係人 16
三、 識別PII之資訊流 16
四、 判定相關隱私保護要求事項 20
五、 隱私風險分析 22
六、 隱私風險地圖 29
七、 隱私風險緩解 30
第四章 應用情境-以視訊診療為例 32
第一節 我國視訊診療適用範圍 32
一、 交通、地理位置不便 33
二、 後期照護或災害傳染病重大變故照護 33
三、 長期穩定和行動不便者 34
四、 限制移動 34
五、 國際醫療服務 34
第二節 系統架構 36
一、一般性方案 39
二、 特定場所或他人之方案 41
三、 矯正機關之方案 43
第三節 實驗與驗證 45
一、視訊診療服務流程 45
二、身分再鑑別流程 49
第四節 視訊診療情境之隱私衝擊評鑑 53
第五節 整合CLS、New eID與FIDO之安全傳輸流程 59
一、前言 59
二、流程步驟 60
三、系統實驗環境 63
四、實驗結果 64
第六節 視訊診療法規及技術標準 67
第五章 結論及未來研究方向 71
參考文獻 72

 

[1] 方怡捷。從國民卡計畫到數位身分識別證換發政策決策過程 ─以多元流觀點分析。﹝碩士論文。國立政治大學﹞，2020
[2] 內政部,數位身分識別證（New eID）-新一代國民身分證換發計畫, 民國 109 年8,資料來源: https://ws.moi.gov.tw/Download.ashx?u=LzAwMS9VcGxvYWQvNDAwL3JlbGZpbGUvMTIzNTEvMjE0NDM1LzQ0ZDVkZDA1LTFjN2MtNDliOS1iZDZiLTMwNmVmYzY1NjA5ZS5wZGY%3d&n=5paw5LiA5Luj5ZyL5rCR6Lqr5YiG6K2J5o%2bb55m86KiI55WrXzExMDQo5YWs6ZaL54mIKS5wZGY%3d (存取於2023/7/20)
[3] Aichholzer, G., & Strauß, S. (2010). The Austrian case: Multi-card concept and the relationship between citizen ID and Social Security Cards. Identity in the Information Society, 3(1), 65–85. https://doi.org/10.1007/s12394-010-0048-9
[4] e-Estonia, e-identity. Retrieved July 20, 2023, https://e-estonia.com/, 2021.
[5] Martens, T. (2010). Electronic identity management in Estonia between market and State governance. Identity in the Information Society, 3(1), 213–233. https://doi.org/10.1007/s12394-010-0044-0
[6] Pappel, I., Tsap, V., & Draheim, D. (2021). The E-locgov model for introducing e-governance into local governments: An estonian case study. IEEE Transactions on Emerging Topics in Computing, 9(2), 597–611. https://doi.org/10.1109/tetc.2019.2910199
[7] A. H. Zwilling, Electronic Identity Management Systems in the European Union. Radboud University, 2017.
[8] FIDO Alliance, Retrieved July 20, 2023, from https://fidoalliance.org
[9] Grimes, R. (2019). The many ways to hack 2FA. Network Security, 2019(9), 8–13. https://doi.org/10.1016/s1353-4858(19)30107-2
[10] Sciarretta, G., Carbone, R., Ranise, S., & Viganò, L. (2020). Formal analysis of mobile multi-factor authentication with single sign-on Login. ACM Transactions on Privacy and Security, 23(3), 1–37. https://doi.org/10.1145/3386685
[11] 內政部戶政司，全面換發國民身分證大事紀，台北：內政部，2007 年。
[12] 陳家榮。數位治理的界限-以數位身分證為中心。﹝碩士論文。東吳大學﹞，2023
[13] 行政院研究發展考核委員會（2013）。第四階段電子化政府計畫（101 年至 105 年）,資料來源: https://www.ndc.gov.tw/cp.aspx?n=F9DCBD4D1F2CC9A8&s=9CDCD0E5265C48C9 (存取於2023/7/20)
[14] Jia-Ning Luo, Two-step mobile user authentication mechanisms, CCISA, Vol. 24,No. 4 ,Oct.,2018
[15] Nóbrega Gonçalves, S. M., Tomasi, A., Bisegna, A., Pellizzari, G., & Ranise, S. (2020). Verifiable contracting. Computer Security, 133–144. https://doi.org/10.1007/978-3-030-66504-3_8
[16] Gupta, A., Mahajan, R., & Kumawat, V. (2023). Secure hotel key card system using Fido Technology. Emerging Trends in Expert Applications and Security, 447–456. https://doi.org/10.1007/978-981-99-1909-3_39
[17] Mishra, D., Mukhopadhyay, S., Kumari, S., Khan, M. K., & Chaturvedi, A. (2014). Security enhancement of a biometric based authentication scheme for Telecare Medicine Information Systems with nonce. Journal of Medical Systems, 38(5). https://doi.org/10.1007/s10916-014-0041-1
[18] Renuka, K., Kumari, S., & Li, X. (2019). Design of a secure three-factor authentication scheme for Smart Healthcare. Journal of Medical Systems, 43(5). https://doi.org/10.1007/s10916-019-1251-3
[19] Sureshkumar, V., Amin, R., Obaidat, M. S., & Karthikeyan, I. (2020). An enhanced mutual authentication and key establishment protocol for TMIS using Chaotic Map. Journal of Information Security and Applications, 53, 102539. https://doi.org/10.1016/j.jisa.2020.102539
[20] Guo, J., & Li, H. (2022). Digital Portrait Model Construction for Telemedicine doctor authentication. 2022 2nd International Conference on Electronic Information Engineering and Computer Technology (EIECT). https://doi.org/10.1109/eiect58010.2022.00017
[21] Lin, T.-W., Hsu, C.-L., Le, T.-V., Lu, C.-F., & Huang, B.-Y. (2021). A smartcard-based user-controlled single sign-on for privacy preservation in 5G-IOT telemedicine systems. Sensors, 21(8), 2880. https://doi.org/10.3390/s21082880
[22] Hsu, C.-L., Le, T.-V., Hsieh, M.-C., Tsai, K.-Y., Lu, C.-F., & Lin, T.-W. (2020). Three-factor UCSSO scheme with fast authentication and privacy protection for telecare medicine information systems. IEEE Access, 8, 196553–196566. https://doi.org/10.1109/access.2020.3035076
[23] Lin, T.-W., & Hsu, C.-L. (2023). Chaotic Maps-based Privacy-Preserved Three-Factor Authentication Scheme for Telemedicine Systems. International Journal of Network Security, Vol.25(No.2), 194–200. https://doi.org/10.6633/IJNS.202303 25(2).02
[24] P. Team, EU General Data Protection Regulation (GDPR): An Implementation and Compliance Guide, Cambridge, U.K.:IT Governance, 2017.
[25] ISO/IEC 29134:2017 Information technology - Security techniques - Guidelines for privacy impact assessment, Retrieved July 20, 2023, from https://www.iso.org/standard/62289.html
[26] ISO/IEC 29100:2011 Information technology - Security techniques - Privacy framework, Retrieved July 20, 2023, from https://www.iso.org/standard/45123.html
[27] 《個人資料保護法》,資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?PCode=I0050021 (存取於2023/7/20)
[28] Ji, Y., Ma, Z., Peppelenbosch, M. P., & Pan, Q. (2020). Potential association between COVID-19 mortality and health-care resource availability. The Lancet Global Health, 8(4). https://doi.org/10.1016/s2214-109x(20)30068-1
[29] Incorporating telemedicine as part of COVID-19 Outbreak Response Systems. (2020). The American Journal of Managed Care, 26(4), 147–148. https://doi.org/10.37765/ajmc.2020.42784
[30] Health Companion. PharmEasy: Online Pharmacy & Medical Store in India | 50 Lakhs+ Customers. Retrieved April 7, 2023, from https://www.medlife.com/
[31] Healthcare Virtually Anywhere. Virtual Telehealth Solutions & Services | Walmart Health Virtual Care. Retrieved April 7, 2023, from https://www.memd.net/
[32] Online Healthcare. MDLIVE. Retrieved April 7, 2023, from https://www.mdlive.com/
[33] 健康益友APP懶人包 , 資料來源: https://www.mohw.gov.tw/dl-78114-f9e73b2f-5c47-4be5-a57d-8596658c66d5.html (存取於2023/4/7)
[34] Allaert, F. A., Legrand, L., Abdoul Carime, N., & Quantin, C. (2020). Will applications on smartphones allow a generalization of telemedicine? BMC Medical Informatics and Decision Making, 20(1). https://doi.org/10.1186/s12911-020-1036-0
[35] 《通訊診察治療辦法》,資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0020197(存取於2022/10/14)
[36] 衛部醫字第1091660661號函釋, 109.2.10 ,資料來源: https://www.tma.tw/files/meeting/N202022410493_002.pdf (存取於2022/10/14)
[37] 衛部醫字第1091661115號函釋, 109.2.19 , 資料來源: https://www.tma.tw/files/meeting/N202022410493_001.pdf(存取於2022/10/14)
[38] オンライン診療の適切な実施に関する指針 , 資料來源: https://www.mhlw.go.jp/content/000889114.pdf (存取於2023/3/13)
[39] 新型コロナウイルスを踏まえた遠隔医療の取組について , 資料來源: https://www8.cao.go.jp/kisei-kaikaku/kisei/meeting/tf/20200402/200402taskforce03.pdf (存取於2023/3/13)
[40] Curonオンライン診療サービス クロン , 資料來源: https://app.curon.co/ (存取於2023/3/14)
[41] Summary of the HIPAA Security Rule , Retrieved March 14, 2023, from https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
[42] Senate Bill No. 1665 , Retrieved March 14, 2023, from https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=199519960SB1665
[43] California Senate Bill No. 850 , Retrieved March 14, 2023, from https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201120120SB850
[44] Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency , Retrieved March 14, 2023, from https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html
[45] 數位身分識別證 說明簡報,資料來源: https://www.ris.gov.tw/documents/data/5/6/656c4007-98c6-4ace-b969-55dc1fbd08d1.pdf(存取於2023/4/7)
[46] FIDO Security Reference, Retrieved March 14, 2023, from https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html
[47] CVE, Retrieved March 14, 2023, from https://cve.mitre.org/cve/search_cve_list.html
[48] CVE-2021-3011 Detail, Retrieved March 14, 2023, from https://nvd.nist.gov/vuln/detail/CVE-2021-3011
[49] CVE-2020-12061 Detail, Retrieved March 14, 2023, from https://nvd.nist.gov/vuln/detail/CVE-2020-12061
[50] CVE-2021-40818 Detail , Retrieved March 14, 2023, from https://nvd.nist.gov/vuln/detail/CVE-2021-40818
[51] CVE-2021-36368 Detail, Retrieved March 14, 2023, from https://nvd.nist.gov/vuln/detail/CVE-2021-36368
[52] CVE-2021-31924 Detail, Retrieved March 14, 2023, from https://nvd.nist.gov/vuln/detail/CVE-2021-31924
[53] CVE-2020-27208 Detail, Retrieved March 14, 2023, from https://nvd.nist.gov/vuln/detail/CVE-2020-27208
[54] CVE-2021-38299 Detail, Retrieved March 14, 2023, from https://nvd.nist.gov/vuln/detail/CVE-2021-38299
[55] 通訊診察治療辦法修正草案,資料來源: https://tsem.blob.core.windows.net/newscontainer/%E9%80%9A%E8%A8%8A%E8%A8%BA%E5%AF%9F%E6%B2%BB%E7%99%82%E8%BE%A6%E6%B3%95%E4%BF%AE%E6%AD%A3%E8%8D%89%E6%A1%88%E7%B8%BD%E8%AA%AA%E6%98%8E%E5%8F%8A%E6%A2%9D%E6%96%87%E5%B0%8D%E7%85%A7%E8%A1%A8.pdf(存取於2023/4/7)
[56] 石崇良,當距離不再是問題 遠距醫療新解方, 打通數位健康任督二脈：數位健康產業發展政策前瞻研討會,資料來源: https://www.youtube.com/watch?v=4gyEMu6mT94&t=538s&ab_channel=%E7%A4%BE%E5%9C%98%E6%B3%95%E4%BA%BA%E5%8F%B0%E7%81%A3%E6%95%B8%E4%BD%8D%E5%81%A5%E5%BA%B7%E7%94%A2%E6%A5%AD%E7%99%BC%E5%B1%95%E5%8D%94%E6%9C%83%28TAIDHA%29(存取於2022/10/14)
[57] 國家通訊傳播委員會「強化偏鄉地區 5G 寬頻服務與涵蓋-普及偏鄉寬頻接取基礎建設計畫」, 資料來源: https://www.ey.gov.tw/File/9C7508704746DE24 (存取於2022/10/14)
[58] 法務部主管110年度單位預算評估報告, 資料來源:https://www.ly.gov.tw/Pages/ashx/File.ashx?FilePath=~/File/Attach/203939/File_279991.doc (存取於2022/10/14)
[59] 《醫療法》,資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0020021&kw=%e9%86%ab%e7%99%82%e6%b3%95(存取於2023/3/25)
[60] Al-Riyami, S. S., & Paterson, K. G. (2003). Certificateless public key cryptography. Advances in Cryptology - ASIACRYPT 2003, 452–473. https://doi.org/10.1007/978-3-540-40061-5_29
[61] A. Shamir. Identity-based cryptosystems and signature schemes (1984). In Advances in Cryptology – CRYPTO’84 - Lecture Notes in Computer Science, 1984, 47–53. https://doi.org/10.1007/3-540-39568-7_5
[62] ISO - ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems, Retrieved March 25, 2023 from https://www.iso.org/standard/82875.html
[63] ISO/IEC 27701:2019 - Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines, Retrieved March 25, 2023 from https://www.iso.org/standard/71670.html
[64] 《戶籍法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=D0030006 (存取於2023/7/18)
[65] 《電子簽章法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?PCode=J0080037 (存取於2023/7/18)
[66] 《資通安全管理法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=A0030297 (存取於2023/7/18)
[67] ISO/IEC 15408-2:2022 - Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Part 2: Security functional components, Retrieved March 25, 2023 from https://www.iso.org/standard/72892.html
[68] ISO/IEC 7816-4:2020 - Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange, Retrieved March 25, 2023 from https://www.iso.org/standard/77180.html
[69] ISO/IEC 18004:2015 - Information technology — Automatic identification and data capture techniques — QR Code bar code symbology specification, Retrieved March 25, 2023 from https://www.iso.org/standard/62021.html
[70] ISO/IEC 27018:2019 - Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors, Retrieved March 25, 2023 from https://www.iso.org/standard/76559.html
[71] 《醫療機構電子病歷製作及管理辦法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0020121 (存取於2023/7/18)
[72] 《醫師法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?PCode=L0020001 (存取於2023/7/18)
[73] 《社會工作師法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?PCode=D0050125 (存取於2023/7/18)
[74] 《長期照顧服務法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0070040 (存取於2023/7/18)
[75] 《監獄行刑法》, 資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=I0040001(存取於2023/3/25)
[76] 《受刑人保外醫治審核基準及管理辦法》,資料來源: https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=I0040050(存取於2023/ˇ3/25)