## 1 Introduction  
With the rapid development of information and internet technologies, most information systems are facing significant security challenges. For instance, in industrial control systems, identity verification is crucial to prevent unauthorized access and potential security issues. Due to the unique nature of the industrial control environment, cybersecurity incidents can have severe consequences, including production downtime, equipment damage, and even harm to personnel [1]. However, the risks faced by information systems extend beyond industrial control systems. Essentially, most information systems require user authentication for identity verification, which in turn introduces the risk of system attacks. Currently, using account passwords and Public Key Infrastructure (PKI) for user identity verification is a common practice. However, a study titled \"Brute-force and dictionary attack on hashed real-world passwords\" demonstrated that it is relatively easy to crack most user-created passwords using simple and predictable patterns [2]. As a result, other forms of passwordless authentication technologies have emerged, such as biometric technologies and PKI, among others. However, biometric technologies also face many challenges and threats, such as biometric feature theft and forgery, leading to authentication failures and security vulnerabilities [3]. The passwordless authentication technology is now widely regarded as a more usable and secure alternative to traditional password-based methods [4]. The FIDO (Fast Identity Online) [5] Alliance provides a more secure and reliable identity authentication solution, with a robust passwordless login standard that enables safer and more convenient identity verification. [PERSON] et al. [6] proposes a method for solving existing identity management system issues using FIDO and W3C VC. It details the conceptual model, architecture, and protocols used. By extending FIDO's UAF, it achieves robust identity authentication and authorization. The paper establishes a pilot implementation for NHS patients in the UK, allowing them to access restricted NHS websites for appointment scheduling, cancellation, and prescription ordering using biometric authentication on mobile devices. Initial user trials with 10 UK NHS patients found the system easy to use, with biometric authentication preferred over usernames and passwords. The advantages of FIDO lie in its high security, effective phishing attack prevention, and convenient user authentication experience, significantly enhancing system security and usability. The FIDO Alliance has issued three sets of specifications aiming to enhance user authentication by providing simpler yet more robust mechanisms: FIDO Universal Second Factor (FIDO U2F), FIDO Universal Authentication Framework (FIDO UAF), and the Client to Authenticator Protocols (CTAP). CTAP complements the Web Authentication (WebAuthn) specification by the World Wide Web Consortium (W3C), together forming the FIDO2 standard. In short, FIDO2 provides passwordless login and two-factor authentication, integrating browser support through WebAuthn. This means users can log in without passwords using biometric authentication via their browsers, or they can use their own devices, such as USB drives or smartphones with built-in authentication capabilities, in conjunction with the CTAP protocol as authentication devices during login. Additionally, FIDO2 adopts public key cryptography, and the FIDO2 authentication server only stores the public key/verification, avoiding the upload of users' personal data and better safeguarding user privacy [7]. However, it should not be assumed that FIDO2 technology is entirely secure [8], as it may still face potential risks. For instance, if a user's device is stolen or subjected to other attacks, the private key could be compromised, thereby jeopardizing the authentication process.