CN111786796B

CN111786796B - Password Strength Evaluation Method Based on Password Reuse, Character Jump and Separation

Info

Publication number: CN111786796B
Application number: CN202010625153.0A
Authority: CN
Inventors: 董奇颖; 贾春福; 汪定; 单轩; 洪淑弘; 段非
Original assignee: Nankai University
Current assignee: Nankai University
Priority date: 2020-07-02
Filing date: 2020-07-02
Publication date: 2021-10-12
Anticipated expiration: 2040-07-02
Also published as: CN111786796A

Abstract

A password strength evaluation method based on password reuse, character jumping and separation, belonging to the technical field of information security. The password input by the user is restored to the basic character fragment and the character conversion and password structure are recorded; the basic character fragment construction probability is calculated by the neural network, and the corresponding probability of the character conversion and the password structure is searched from the dictionary, and the probability is multiplied to obtain the password construction probability; The user feedbacks the absolute strength, relative strength of the password, and candidate passwords that are similar to the user password but sufficiently secure. The present invention summarizes the reuse features of user passwords into capital conversion, character jumping and separation. Neural network combined with fuzzy matching algorithm can more accurately and robustly evaluate password strength. The user learns the strength of his password relative to other users' passwords through relative strength, and selects a more secure and easy-to-remember password from candidate passwords.

Description

Password strength evaluation method based on password reuse, character jump and separation

Technical Field

The invention belongs to the technical field of information security, relates to the field of password security authentication, and more particularly relates to a password strength evaluation method.

Background

The password is the most widely used identity authentication mode at present, and is the first line of defense for maintaining the safety of an information system and protecting the privacy of a user. Many users tend to set weak passwords that are low in strength, easy to guess, for easy remembering, or to reuse passwords in multiple websites, which creates serious security risks for both the website and the user.

In order to protect the security of the system and the user, the mainstream internet service provider feeds back the password strength to the user through a password strength evaluator (PSM) when the user registers the website service or modifies the password. Only the PSM which can accurately feed back the password intensity can obviously improve the password intensity of the user, thereby protecting the security of the user account.

However, various PSMs widely used at present often give inaccurate and misleading feedback, and the evaluation results of different websites have great conflict, so that the claimed security is difficult to guarantee. Inaccurate intensity feedback causes the user to misunderstand that the end of the password needs to be added with a number or special character, or simply capitalize on the first letter to raise the original weak password to a strong one. Such PSMs fall far behind the true level of current attackers and do not help users to increase password strength. Therefore, the scholars propose a new idea for designing PSM according to the attack difficulty level, and Markov based on the attack algorithm^[5]、PCFG^[6]、RNN^[9]、fuzzyPSM^[4]The operation is carried out at the same time. Unfortunately, except for fuzzyPSM^[4]In addition, the existing PSM based on the attack algorithm defaults that the password of the user is completely constructed, which obviously does not conform to the actual password use habit of the user.

Therefore, there is a need for: and feeding back the accurate password strength to the user on the basis of fully considering the user password reuse behavior.

Disclosure of Invention

In order to overcome the defects of the technology, the invention provides a password strength evaluation method based on password reuse, character jump and separation. The purpose of the invention is realized by the following technical scheme:

1. a password strength evaluation method based on password reuse, character jump and separation is composed of a dictionary construction module, a password preprocessing module, a probability calculation module and a strength feedback module, and specifically comprises the following steps:

A. in a dictionary construction module, selecting a password set S matched with the service type as a training set, constructing a character conversion dictionary and a password structure dictionary through a fuzzy matching algorithm, and specifically executing the following operations:

A1. counting the frequency of occurrence of each capital letter and the basic character in S, and calculating the probability of converting the lower case letters into the capital letters and the probability of keeping the basic character unchanged;

A2. converting capital letters contained in each password in the S into corresponding lowercase letters to obtain a new data set S_lower；

A3. According to the character composition, S_lowerPartitioning into two subdata sets: set S_matchIs composed of character strings only containing basic characters and having frequency number more than or equal to 10, S_specialIs composed of a character string containing special characters;

A4. after setting a proper confidence coefficient CR, executing a fuzzy matching algorithm, wherein the algorithm comprises the following steps:

selecting S_specialString str1 in (S)_matchExtracting character strings str2 with the length meeting the condition that len (str2) is less than or equal to len (str1), and constructing a set S to be matched_match′；

Matching S with str1_match′Str2 in (1), i.e., character-by-character comparing str1 with str 2; if str1 and the basic characters in str2 cannot be in one-to-one correspondence, the matching is considered to be failed, str1 is shifted to the left by one character, and the str2 is tried to be matched again; if the special character in str1 corresponds to the base character in str2, the temporary match is considered to be successful;

and for the str1 and str2 which are successfully matched temporarily, calculating the matching rate MR to judge whether fuzzy matching is successful or not, and further judging whether the corresponding special character is obtained by jumping the basic character or not. If it is

(count is the number of characters successfully matched), the fuzzy matching between str1 and str2 is considered to be failed, the corresponding special character in str1 is a separator, otherwise, the fuzzy matching between str1 and str2 is considered to be successful, and the special character in str1 is obtained by jumping of the corresponding basic character in str 2;

A5. and (3) regarding the successful fuzzy matching as the special character obtained by jumping the basic character, and changing the 'debounce' into the corresponding basic character according to a regular expression [ < Lambda > B? (S)_nB)*S_n？$]In a format in which B represents a base character, S_nA special string of length n representing what is considered a separator;

A6. recording all the conditions of capitalization conversion, character jumping and character separation and storing the corresponding probability in a character conversion dictionary; recording all the presented password structures, and calculating corresponding probability to store in a password structure dictionary;

B. in the password preprocessing module, the password input by the user is restored into a basic password segment and the conversion type and the password structure are recorded, and the following operations are specifically executed:

B1. converting capital letters in the user password into corresponding lower case letters, and recording the conversion;

B2. using the algorithm described in A4, the converted password is set at S constructed in A3_matchCarrying out fuzzy matching; corresponding the fuzzy matching successful special character 'reverse jump' to the basic character, recording the password structure and the jump conversion;

B3. cutting the password into a plurality of basic character segments by taking the special character with the failure fuzzy matching as a separator, and recording the special character as the separator at the moment;

C. in the probability calculation module, the construction probability of the basic password is calculated through a neural network, the construction probability of the user password is calculated by combining the password format probability and the character conversion probability of the dictionary record, and the following operations are specifically executed:

C1. s with A3 construction_matchTraining an LSTM, taking the basic character segment obtained by B3 as the input of the LSTM, and calculating the corresponding construction probability of the basic character segment;

C2. looking up the capitalization transformation probability recorded in B1, the character jump probability recorded in B2 and the character separation probability recorded in B3 in a character transformation dictionary constructed by A6;

C3. looking up the password structure corresponding probability recorded by B2 in a password structure dictionary constructed by A6;

C4. multiplying the probabilities to obtain the construction probability of the password input by the user;

D. in the strength feedback module, the absolute strength and the relative strength of the password are fed back to the user, and meanwhile, the user is provided with a candidate password which is similar to the input password but is safer, and the following operations are specifically executed:

D1. the password construction probability calculated by C4 is used as the absolute strength of the password and is fed back to the user;

D2. calculating the difference between the password construction probability obtained by C4 and the benchmarking password construction probability, and feeding back the difference as the relative strength of the password to the user;

D3. based on the character conversion dictionary constructed by A6, randomly selecting a conversion condition, and modifying the user password so as to generate a plurality of safer candidate passwords for the user to select;

further, in the above-disclosed scheme, through step a, the present invention generalizes the user's password reuse behavior into three types, namely, upper case conversion, special character hopping, and special character separation, and calculates the probabilities respectively.

Further, in the above-disclosed scheme, through step B, the present invention restores the user password reuse process and divides the user password into a plurality of basic character segments.

Further, in the above-disclosed scheme, through step C, the invention multiplies the probability of the basic character segment calculated by LSTM, the conversion type looked up from the dictionary, and the probability corresponding to the password structure, to finally obtain the construction probability of the user input password;

further, in the above-disclosed solution, through step D, the present invention generates a candidate password similar to the password input by the user but sufficiently secure through simple steps while using the benchmarking password to show the user the relative strength of the password, for the user to select.

The invention has the advantages and beneficial effects that:

(1) the invention summarizes the user password reuse behavior into three conditions of capitalization transformation, character jump and separation, designs a fuzzy matching algorithm and can accurately give the corresponding probability of various conversion conditions. Through a fuzzy matching algorithm, the invention overcomes the defects of lack of important conversion, lack of probability calculation and the like in the prior scheme.

(2) The invention uses LSTM to calculate the construction probability of the basic character string and combines fuzzy matching algorithm to calculate the probability of special character and password structure, thus the inventionThe invention can obtain good balance between the accuracy of strength evaluation and the operation efficiency. Experimental results show that the password evaluation method is used for evaluating the password with medium strength (the guess number is more than or equal to 10)¹⁰) The coverage ratio fuzzyPSM calculated by the method has the best effect under the same experimental environment^[4]The corresponding coverage rate is averagely 18.9 percent; markov order of 3^[5]The corresponding coverage rate is averagely 16.9 percent; specific to RNN^[9]The corresponding coverage was on average 6.1% higher. Meanwhile, compared with other PSM algorithm models, the robustness of the invention is also the best.

(3) The invention provides the absolute password strength to the user, and simultaneously feeds back the relative strength of the password of the user by using the four benchmarking passwords, thereby facilitating the user to fully know the strength of the password relative to the passwords of other users. Meanwhile, the invention generates the candidate password which is similar to the user password but is safe enough through few steps, thereby helping the user construct a safer password. The invention also provides a parameter setting method under different scenes by comprehensively considering the difference of the service types, the economic value, the password strategy and the like.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. The drawings in the following description are only some embodiments of the invention, and other drawings can be derived from them by a person skilled in the art without inventive exercise.

FIG. 1 is the overall module composition of the password strength evaluation method of the present invention;

FIG. 2 is the overall flow design of the password strength evaluation method of the present invention;

FIG. 3 is an exploded view of a password pre-processing module flow;

FIG. 4 is an example of preprocessing a command P @ ssword # # 12;

FIG. 5 is a schematic flow diagram of a probability calculation module;

FIG. 6 is an exploded view of the intensity feedback module flow.

Detailed Description

The invention is described in detail below with reference to the accompanying drawings so that the advantages and features of the invention will be more readily understood by those skilled in the art, and the scope of the invention will be clearly and clearly defined.

The embodiments of the present invention will be better understood by those skilled in the art with reference to the following explanation of concepts and terms used throughout the specification.

Password reuse: with the increase of the number of accounts, in order to reduce the memory burden, when setting the password, the user can directly use the old password or simply modify the old password to obtain a new password, and the behavior is called password reuse.

Basic character: lower case letters and numbers for constructing passwords.

Special characters: in addition to lower case letters, upper case letters, and numbers, other ASCII characters are used to construct the password.

Jumping: when constructing a password, users often replace some basic characters in the password with special characters similar to the shape and pronunciation of the password, and the replacement process is called jumping. Meanwhile, the process of restoring the special character obtained by jumping into the corresponding basic character is called 'reverse jumping'.

Separation: in constructing passwords, many users choose to add special characters before, between, or after the semantic string, which often act as separators.

Guessing number: guess number C for any password alpha_ΔCan pass through C_Δ{ β ∈ Γ: r (beta) < R (alpha) }, where Γ is the guessed password set generated by the PSM built-in algorithm, and R (beta) is the rank of beta in Γ.

And (3) carrying out online guessing attack: a password attack that requires interaction with the server to be implemented.

And (3) off-line guessing attack: a password attack mode that can be implemented without interaction with a server.

Breadth-first off-line guessing attack: an attacker conducts an offline guessing attack in order to break as many user passwords as possible.

Coverage rate: and generating a certain number of guessed password sets by using a PSM built-in password attack algorithm, wherein the ratio of the guessed password sets to the passwords covering the test set is the coverage rate.

Monte Carlo method (Monte Carlo): dell and Filippone^[7]The Monte Carlo method was designed to emulate password guessing numbers. The method requires that each PSM built-in algorithm participating in the test generates a sample password set theta with the size of n, and the probability of sampling the password beta in the sample password set is equal to the construction probability P of the password beta_(β). Guess number C for any password alpha_ΔIs composed of

And (3) ideal strength ranking: the guess set generated by the optimal attacker is considered to be identical to the test set, so the frequency ordering of each password in the test set is the ideal strength ranking corresponding to the password.

Weighted Spearman Correlation (wspearman): and taking the occurrence frequency of each password in the test set as a weight, accumulating the occurrence frequency to the PSM output password strength ranking and the ideal PSM strength ranking, and obtaining the Spearman correlation coefficient between the two strength ranking results as wspearman. Maximiian and Markus^[8]It is confirmed that the index can well measure the robustness of the PSM.

As shown in fig. 1, the method for evaluating the strength of a user password according to the present invention comprises four modules: a dictionary construction module, a password preprocessing module, a probability calculation module and an intensity feedback module, and referring to fig. 2, the modules are described in detail as follows:

1. dictionary construction module

The character conversion dictionary and the password structure dictionary are the core of the invention. The character conversion dictionary contains the probability of converting lower case letters into upper case letters, the probability of jumping from the basic character to the special character and the probability of using the special character as a separator. The password structure dictionary records various possible password structures and corresponding probabilities.

The concrete construction steps are as follows:

firstly, selecting a password set as a training set S, converting capital letters contained in each password in the training set S into corresponding lowercase letters, and acquiring a new subdata set S_lower. Count the frequency of each capital and base character in S (e.g., the frequency of occurrence of character A is recorded as n_(A)The frequency of occurrence of the character a is recorded as n_(a)) Calculating the probability of each lower case letter being converted into an upper case letter

And probability of remaining unchanged

Secondly, according to the character type contained, S is divided into_lowerThe method is divided into two groups: set S_basicA character string set only containing basic characters; s_specialIs a set of character strings containing special characters. We need to set the appropriate confidence CR and use the fuzzy matching algorithm to pair S_specialEach password in (1) attempts a match. S is extracted because the user usually converts the commonly used password to obtain the final password_basicConstructing a data set S for fuzzy matching by using character strings with the medium frequency number more than or equal to 10_match。

The implementation details of the fuzzy matching algorithm are as follows: selecting S_specialString str1 in (S)_matchExtracting character strings str2 with the length meeting the condition that len (str2) is less than or equal to len (str1), and constructing a set S to be matched_match′. Str1 demaps S in high to low frequency order_match′Each str 2. Character-by-character comparison of str1 with str2, if str1 cannot correspond to the basic characters in str2 one-to-one, considering that matching fails, str1 shifts left by one character, and tries to match str2 again; if the special character in str1 corresponds to the base character in str2, the tentative match is considered successful. For str1 and str2 with temporally successful matching, the matching rate MR is calculated to judge fuzzy matchingAnd if the special character is successful, judging whether the special character can be obtained by jumping the basic character. If it is

(count is the number of characters successfully matched), the fuzzy matching between str1 and str2 is considered to be failed, the special character in str1 is a separator, otherwise, the special character in str1 is considered to be obtained by jumping from the corresponding basic character in str 2.

And (3) regarding the successful fuzzy matching as the special character obtained by jumping the basic character, and changing the 'debounce' into the corresponding basic character according to a regular expression [ < Lambda > B? (S)_nB)*S_n？$]In a format in which B represents a base character, S_nRepresenting a special string of length n that is considered as a separator. Repeating the above process until S_specialAll the character strings in (1) complete fuzzy matching.

As mentioned above, the confidence level CR is used to adjust the effect of the special character on the password strength, and different requirements of the application scenario on the password security can be adjusted.

Recording all the conditions of character jumping and character separation and storing corresponding probabilities in a character conversion dictionary; and recording all the presented password structures, calculating corresponding probabilities and storing the probabilities in a password structure dictionary.

We present here a simple example to illustrate the implementation steps of the fuzzy matching algorithm. Assuming that the confidence CR is 0.5 at this time, the password P @ ssword # ##12 exists in S. For the password P @ ssword # ##12, the capital letter transformation P → P is recorded, and the capital letter is converted into the corresponding small letter, so as to obtain the character string P @ ssword # # # #12, and since the character string contains special characters, the P @ ssword # # #12 should be located at S_specialIn the collection. When fuzzy matching is performed, str1 ═ p @ ssword # ##12 and length len (str1) ### 14 are selected, and then S is performed_matchThe character strings str2 meeting the condition of len (str2) less than or equal to len (str1) form a new set S_match′{123456, password, 000012 }. We first use str1 ═ p @ ssword # ##12 to match str2 ═ 123456. In the first round of matching, stThe first character of r1 is p, and the first character of str2 is 1, both of which are basic characters but different, indicating that the first round of matching fails, so that the second round of matching is performed after p @ ssword # # # #12 is shifted left by one bit and updated to @ ssword # # # # 12; in the second round of matching, str1 @ ssword # #12, str2 123456, the first character of str1 is the special character @ and the first character of str2 is 1, the @ is tentatively considered a successful match with 1, and then the str1 is compared to the second character of str2, which still fails because s cannot correspond to 2. The steps are repeated, and finally the p @ ssword # #12 and 123456 cannot be successfully matched. Switching str2 to S_match′The second password passcode is obtained by using str1 ═ p @ ssword # #12 to match str2 ═ passcode. It can be found that, except the but character @ the base character in str2 corresponds to the base character at the corresponding position of str1 one by one, it can be considered that str1 matches str2 temporarily successfully, and when the matching rate MR 7/8 0.875 > CR 0.5, this means that str1 matches str2 successfully, it can be considered that @ in p @ ssword # #12 is obtained by a jump, therefore, the jump conversion a → @isrecorded, and @ "jump back" in str1 is changed to a, and str1 is updated. And subsequently, using str1 ═ passcode # #12 to dematch str2 ═ passcode, repeating the matching step, and finally finding that str1 ═ passcode # #12 cannot be successfully matched with str 2. Finally, we switch str2 to S_match′The last password 000012 in the matching process, it can be found that when str1 is updated to str1 ####12 by continuously moving left, the str1 ###### 12 and str2 ## 000012 are temporarily matched successfully, but the matching rate MR therebetween is 2/6 anger 0.333.333 < CR is 0.5, which means that the matching fails. At this time, S_match′All the passwords in p @ ssword # ##12 are exhausted, the fragment # # # in p @ ssword # #12 still cannot match the available transition, and therefore, the special character in the fragment can be considered as a separator. The password obtained after performing various conversions (P → P, a → @) recorded in the above process on the password P @ ssword # ##12 is P @ ssword # ##12, so the password structure of P @ ssword # ##12 is BS @₄B。

2. Password preprocessing module

The password preprocessing module restores the password input by the user into a basic password and records the transformation type and the password structure. In this module, the invention quantifies the impact of capitalized English characters, special characters, etc. on the password strength by probability. FIG. 3 is an exploded view of the password pre-processing module.

Assume that the user enters a password P @ ssword # ##12 that contains both base characters, capital letters, and special characters. In the preprocessing module, all capital letters are converted into corresponding lowercase letters to obtain a password P @ ssword # ##12, and the corresponding capital probability P is searched and obtained in a character conversion dictionary_(p→P). For the converted character string p @ ssword # #12, an attempt is made to match it with the S meeting the requirements by using a fuzzy matching algorithm_match′Matching, recording character jump and character separation, and searching in character conversion dictionary to obtain corresponding probability P_(a→@)And P_(####). Converting the successfully matched special characters into corresponding basic characters to obtain a character string password # # #12, and searching the probability corresponding to the password structure in a password structure dictionary

And finally, cutting the password by taking # # as a separator as a reference to obtain basic character fragments password and 12. Fig. 4 shows a process of preprocessing the password P @ ssword # # # # 12.

3. Probability calculation module

At the end of the password preprocessing module, the user entered password is cut into segments containing only the underlying characters, which are used as inputs to the neural network LSTM. Through S_matchThe trained LSTM can output the probability of the next character according to the prefix character sequence, and continuously carry out iterative operation, and finally the construction probability of the basic character segment can be obtained. By utilizing the capital letter conversion probability, the character hopping probability, the character separation probability and the probability corresponding to the password structure obtained by the password preprocessing module and combining the construction probability of the basic character segment output by the neural network, the construction probability of the password input by the user can be obtained by multiplying the probabilities. For example, the password P @ ssword # # # #12 has a construction probability of

Figure 5 shows a schematic flow decomposition of the probability calculation module.

4. Intensity feedback module

Accurate calculation of the password construction probability can help the user to know the strength of the password set by the user, but the user cannot have more comprehensive knowledge of the security of the password due to lack of reference. The invention displays the password intensity to the user more intuitively from the two aspects of the absolute intensity feedback and the relative intensity feedback of the password by setting the flagpole password. The absolute strength reflects the actual strength of the password, and the relative strength is the difference between the actual strength and the strength of the website banner password. As a benchmarked password, pw1 is the bottom line of the password strength, passwords with probabilities lower than pw1 should be denied passage; pw2 is the basic security and relatively secure line of demarcation; pw3 is a relatively secure and sufficiently secure dividing line; pw4 is the strongest password preset by the system. The website administrator can set the benchmarking password according to the actual application requirements, and the basic setting principle is as follows:

pw 1: guess number is more than or equal to 10⁴The password of (2). Consider that modern network servers of large service providers are equipped with malicious traffic detection mechanisms and tend to limit the number of daily logins of IP. If the password cracking time acceptable to the attacker is assumed to be 4 months, the upper limit of guessing number for the attacker to make large-scale online guesses is 10^4[10]. Therefore, most service sites employ suspicious login detection (suspicious login detection)^[11]And account locking (l0ckout policies)^[12]Is effective enough to withstand most online guessing attacks. The strength of pw1 may be considered to be the password strength floor that the web site allows to pass through, and this strength may be reached as long as the password set by the user is not on the blacklist.

pw 2: guess number is more than or equal to 10⁷The password of (2). When the guess number is greater than 10⁷The gain of the attacker cannot be increased along with the increase of guess numberHas remarkable promotion^[10]. Therefore, the password with the strength of pw2 can basically meet the requirements of most websites on the password length and character type, and can also resist most online guessing attacks.

pw 3: guess number is more than or equal to 10¹⁴The password of (2). The number of guesses that can be implemented by an offline guessing attack is much higher than that of an online guessing attack, and can often reach 10¹¹Or even 10¹²The above^[10]. It has been documented that an attacker has an upper bound on the number of guesses for implementing a breadth-first offline guessing attack of 10^14[13][14]Meanwhile, experiments show that the guess number of most passwords is [10 ]⁶，10¹⁴]Within a region^[14]Therefore, the guess number of the present invention setting pw3 is greater than or equal to 10¹⁴. It can be considered that the guess number is 10 or more¹⁴The password of (2) can basically protect the security of the user account.

pw 4: guess number is more than or equal to 10²⁰The password of (2). Using Monte Carlo^[7]The method calculates guess numbers of each password in the test set and coverage rates corresponding to different guess numbers. In this experiment we found the PCFG of the invention^[6]、Markov^[5]、RNN^[9]And fuzzyPSM^[4]Five PSM built-in algorithms with good effect are provided, and the guess number is more than or equal to 10²⁰The coverage rate reaches the highest and keeps stable. Therefore, the guess number is considered to be 10 or more²⁰The password of (2) is very secure.

To reduce the computational burden, the guess number for the benchmarked password may be converted to a corresponding probability interval.

Although the password with the strength between pw2 and pw3 can be accepted by the website, but is still not safe enough, the invention randomly selects an available transformation to modify the password input by the user according to the character conversion dictionary, and generates a plurality of candidate passwords for the user to select and refer. The above measures can ensure that the generated candidate password is safe enough (strength is not lower than pw3) and is convenient for the user to remember. Fig. 6 shows a schematic flow chart of the intensity feedback module.

The embodiment ensures that the password strength evaluation result provided by the invention is accurate and robust, and the conclusion is proved by two groups of experiments.

Setting the same training set and test set by using the coverage rate as an evaluation index, and operating PCFG^[6]、 Markov^[5]、RNN^[9]、fuzzyPSM^[4]JtR four algorithms with better effect^[15]And HashCat^[16]Two common password cracking tools and the invention. We used Monte Carlo^[7]The method calculates a guess number for each password in the test set. Experimental results prove that the password evaluation method has the password evaluation strength (guess number is more than or equal to 10) above medium⁴) The time performance is always best and is obviously better than other algorithms.

Setting the same training set and test set by using wspearman as evaluation index, and actually operating the invention and PCFG^[6]、Markov^[5]、fuzzyPSM^[4]、zxcvbn^[3]Five algorithms with better robustness are used for evaluating the strength of the password with the frequency greater than 10 in the test set. And calculating a wspearman coefficient between the strength sorting result output by the algorithm and the strength result of ideal strength sorting, wherein experimental results show that the robustness of the password strength evaluation result output by the method is obviously superior to that of other algorithms.

Therefore, the password strength evaluation method disclosed by the invention has the following advantages:

the invention has the advantages and beneficial effects that:

(2) The invention uses LSTM to calculate the construction probability of the basic character string, and combines the fuzzy matching algorithm to calculate the probability of the special character and password structure, thus leading the invention to obtain good balance between the accuracy of the strength evaluation and the operation efficiency. Experimental results show that the password evaluation method is used for evaluating the password with medium strength (the guess number is more than or equal to 10)¹⁰) The effect is the best. Under the same experimental environment, the coverage rate calculated by the inventionBifzzyPSM^[4]The corresponding coverage rate is averagely 18.9 percent; markov order of 3^[5]The corresponding coverage rate is averagely 16.9 percent; specific to RNN^[9]The corresponding coverage was on average 6.1% higher. Meanwhile, compared with other PSM algorithm models, the robustness of the invention is also the best.

The above description is only an embodiment of the present invention, and not intended to limit the scope of the present invention, and all modifications of equivalent structures and equivalent processes performed by the present specification and drawings, or directly or indirectly applied to other related technical fields, are included in the scope of the present invention.

Reference to the literature

[1]Egelman S,Sotirakopoulos A,Muslukhov I,et al.Does my password go up to elevenThe impact of password meters on password selection[C]//Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.2013: 2379-2388.

[2]Ur B,Kelley P G,Komanduri S,et al.How does your password measure upthe effect of strength meters on password creation[C]//Presented as part of the 21st USENIX Security Symposium(USENIX Security 12).2012:65-80.

[3]Wheeler D L.zxcvbn:Low-budget password strength estimation[C]//25th USENIX Security Symposium(USENIX Security 16).2016:157-173.

[4]Wang D,He D,Cheng H,et al.fuzzyPSM:A new password strength meter using fuzzy probabilistic context-free grammars[C]//2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks(DSN).IEEE, 2016:595-606.

[5]Ma J,Yang W,Luo M,et al.A study of probabilistic password models[C]//2014 IEEE Symposium on Security and Privacy.IEEE,2014:689-704.

[6]Weir M,Aggarwal S,De Medeiros B,et al.Password cracking using probabilistic context-free grammars[C]//2009 30th IEEE Symposium on Security and Privacy. IEEE,2009:391-405.

[7]Dell'Amico M,Filippone M.Monte Carlo strength evaluation:Fast and reliable password checking[C]//Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security.2015:158-169.

[8]Golla M,Dürmuth M.On the accuracy of password strength meters[C]//Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security.2018:1567-1582.

[9]Melicher W,Ur B,Segreti S M,et al.Fast,lean,and accurate:Modeling password guessability using neural networks[C]//25th USENIX Security Symposium(USENIX Security 16).2016:175-191.

[10]Florêncio D,Herley C,Van Oorschot P C.An administrator's guide to internet password research[C]//Proceedings of the 28th USENIX conference on Large Installation System Administration(LISA14).2014:35-52.

[11]Freeman D,Jain S,Dürmuth M,et al.Who Are YouA Statistical Approach to Measuring User Authenticity[C]//NDSS.2016:1-15.

[12]Alsaleh M,Mannan M,Van Oorschot P C.Revisiting defenses against large-scale online password guessing attacks[J].IEEE Transactions on dependable and secure computing,2011,9(1):128-141.

[13]Weir M,Aggarwal S,Collins M,et al.Testing metrics for password creation policies by attacking large sets of revealed passwords[C]//Proceedings of the 17th ACM conference on Computer and communications security.2010:162-175.

[14]Mazurek M L,Komanduri S,Vidas T,et al.Measuring password guessability for an entire university[C]//Proceedings of the 2013 ACM SIGSAC conference on Computer&communications security.2013:173-186.

[15]PESLYAK,A.:John the Ripper(1996),http://www.openwall.com/john/

[16]STEUBE:J.Hashcat(2018),https://hashcat.net/hashcat/。

Claims

1. A password strength assessment method based on password reuse, character jumping and separation, is composed of a dictionary construction module, a password preprocessing module, a probability calculation module and a strength feedback module, and specifically comprises the following steps:

A. In the dictionary construction module, select the password set S that matches the service type as the training set, and construct a character conversion dictionary and a password structure dictionary through a fuzzy matching algorithm;

B. In the password preprocessing module, the password input by the user is restored to the basic password fragment and the conversion type and password structure are recorded;

C. In the probability calculation module, the construction probability of the basic password segment is calculated through the neural network, and the construction probability of the user password is calculated by combining the password format probability and character conversion probability recorded in the dictionary;

D. In the strength feedback module, the absolute strength and relative strength of the password are fed back to the user, and at the same time, the user is provided with a candidate password that is similar to its input password but more secure;

Step A specifically performs the following operations:

A1. Count the frequency of occurrence of each uppercase letter and basic characters in S, and calculate the probability of converting lowercase letters to uppercase letters, as well as the probability that the basic characters remain unchanged; basic characters include lowercase letters and numbers;

A2. Convert the uppercase letters contained in each password in S into corresponding lowercase letters to obtain a new data set S _lower ;

A3. According to the composition of characters, S _lower is divided into two sub-data sets: the set S _match is composed of strings containing only basic characters and the frequency is ≥ 10, and S _special is composed of strings containing special characters; special characters include capital letters except uppercase letters. and ASCII characters other than the base characters;

A4. After setting the appropriate confidence level CR, execute the fuzzy matching algorithm. The algorithm steps are:

Select the string str1 in S _special , extract the string str2 whose length satisfies the condition of len(str2)≤len(str1) in S _match , and construct the set to be matched S _match' ;

Use str1 to match str2 in S _match' , that is, compare str1 and str2 character by character; if the basic characters in str1 and str2 cannot be one-to-one correspondence, it is considered that the matching fails, str1 is shifted to the left by one character, and try to match str2 again; The special characters in str2 correspond to the basic characters in str2, and the temporary matching is considered successful;

For str1 and str2 that have been successfully matched temporarily, calculate the matching rate MR to judge whether the fuzzy matching is successful, and then judge whether the corresponding special character is the result of the jump of the basic character.

Where count is the number of successfully matched characters, it is considered that str1 and str2 fail to match fuzzy, and the corresponding special character in str1 is a separator, otherwise, it is considered that str1 and str2 are fuzzy matched successfully, and the special characters in str1 are based on the corresponding basis in str2 Character jump result;

A5. The fuzzy matching is successful, that is, it is considered to be the special character obtained by the jump of the basic character, and the "de-jump" is the corresponding basic character, and according to the regular expression [^B? (S _n B)*S _n ? $] format to record the password structure, where B represents the basic character, S _n represents a special string of length n that is considered to be a delimiter;

A6. Record all the occurrences of capital conversion, character jumping, and character separation and store the corresponding probability in the character conversion dictionary; record all the password structures that have occurred, and calculate the corresponding probability and store them in the password structure dictionary;

Step B specifically performs the following operations:

B1. Convert the uppercase letters in the user password to the corresponding lowercase letters, and record the conversion;

B2. Using the algorithm described in A4, perform fuzzy matching on the converted password in the S _match constructed by A3, "de-jump" the successful special character of the fuzzy matching into the corresponding basic character, and record the password structure at this time and the jump conversion;

B3. Use the special characters that fail fuzzy matching as separators, cut the password into several basic character segments, and record the special characters that are used as separators at this time;

Step C specifically performs the following operations:

C1. Use the S _match constructed by A3 to train the long short-term memory network LSTM, and use the basic character fragment obtained by B3 as the input of the LSTM to calculate the corresponding construction probability of the basic character fragment;

C2. Find the uppercase conversion probability recorded in B1, the character transition probability recorded in B2 and the character separation probability recorded in B3 in the character conversion dictionary constructed by A6;

C3. Find the corresponding probability of the password structure recorded by B2 in the password structure dictionary constructed by A6;

C4. Multiply the above probabilities to obtain the construction probability of the user's input password;

Step D specifically performs the following operations:

D1. Use the password construction probability calculated by C4 as the absolute strength of the password and feed it back to the user;

D2. Calculate the difference between the password construction probability obtained by C4 and the benchmark password construction probability, and use the difference as the relative strength of the password and feed it back to the user;

D3. Based on the character conversion dictionary constructed by A6, randomly select a conversion situation and modify the user password, thereby generating several safer candidate passwords for the user to choose.