Weak password screening method

Abstract

In order to improve detection accuracy and efficiency of weak passwords in existing account passwords in an application system, and find same encrypted passwords in a lot of encrypted password lists and display and determine the same encrypted passwords as weak passwords and make clear the serial number and quantity thereof, the invention provides a weak password screening method. The method comprises the following steps: providing a weak password dictionary for a checking tool through a password generation tool; enabling encryption mode of the weak password dictionary to be totally same with the encryption mode of an application system encrypted password file to be checked; carrying out comparison check on the encrypted passwords, wherein the encrypted passwords unmatched with the weak password dictionary but appearing repeatedly are also judged as suspected weak passwords; and displaying password comparison check results. The method improves the original single mode of generating the weak password dictionary through the password dictionary generation tool to supply to the checking tool, and can check the application system weak passwords missed in the weak password dictionary and is complementary with the weak password dictionary, thereby reducing cases of detection miss to the maximum degree.

Description

technical field [0001] The present invention relates to the technical field of information security, and more specifically, relates to a screening method for weak password dictionaries of application systems, which is used for simple and efficient screening and judging of weak passwords. The method is suitable for checking and screening weak passwords of large-scale enterprise application systems. Background technique [0002] During the detection of weak passwords in existing account passwords, the usual practice is to provide a large number of weak password dictionaries for supporting verification tools according to the needs of password verification, and the number of weak passwords to be verified reaches hundreds of thousands or even millions. . At present, password dictionary generation tools are relatively common, and also provide a relatively comprehensive password dictionary generation function, from the regular generation of numbers and letters to exhaustive enumera...

AI Technical Summary

Problems solved by technology

[0007] 1. Although there are many weak password dictionaries generated, full coverage cannot be guaranteed, and complex passwords that may be used many times due to specific reasons (usage scenarios, industries, domain abbreviations, etc.) cannot be detected normally;

[0008] 2. Usually, the password dictionary generated by means of exhaustive enumeration can reach millions of entries. If it is combined with other types of roots through the advanced combination function, the number will increase at the power level, and the verification time is too long , not suitable for huge password verification;

[0009] 3. In addition to verifying the encrypted password by blasting, there is no other way to judge the suspected weak password that the encrypted password is not in the weak password dictionary and is commonly used

[0010] 4. It is impossible to manually enter such a large number of weak passwords one by one, so it needs to be generated by a password dictionary tool, but even so, although the number of generated passwords is huge, it is inevitable that there will be omissions, and such a large number of password dictionaries also greatly increases password verification. Therefore, it is necessary to improve the accuracy and efficiency of weak password detection through new screening methods, so as to achieve the purpose of comprehensive and accurate detection of weak passwords.

Images