Password generation strategy evaluation method based on efficient data-driven password guessing model

Abstract

The present invention belongs to the field of cyberspace security technology, and specifically is a password generation strategy evaluation method based on an efficient data-driven password guessing model. The method of the present invention is divided into three steps: generating a password set that corresponds to the password generation strategy, measuring the strength of the password set, and calculating the security of the password generation strategy based on the strength. The present invention uses a real password set that has been publicly leaked as the original evaluation set, and matches the password generation strategy one by one in the original evaluation set to obtain an evaluation password subset. The advantage of the present invention is that a real data set can be used to objectively and quantitatively evaluate the security of the password generation strategy. For different password generation strategies, it is only necessary to screen the real data set that meets its password generation strategy, and then the password generation strategy can be quantitatively evaluated by this method, which effectively improves the objectivity of the evaluation results and avoids the heavy reliance on user surveys and expert knowledge in traditional evaluation methods.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and in particular relates to a password generation strategy evaluation method based on an efficient data-driven password guessing model. Background Art

[0002] To help users set strong passwords, most organizations and websites have implemented mandatory password generation policies. A secure password generation policy ensures that the passwords generated based on it are generally strong. However, password generation policy evaluation methods often rely heavily on user research and expert knowledge. The innovation of this method lies in extracting a set of passwords that conform to the corresponding password generation policy from a set of leaked real passwords as the evaluation set, thus eliminating the reliance on user research. Secondly, by replacing traditional expert knowledge with a highly accurate data-driven model, the objectivity of the evaluation results is effectively improved.

[0003] Current password generation strategy evaluation methods often use the minimum entropy of passwords generated by a given strategy to quantify their security. However, existing research has shown that this approach is not precise. For one thing, the lower bound on the strength of generated passwords fails to reflect the average strength of the entire password dataset, and the corresponding evaluation results often deviate from the results of actual attacks on the same password dataset. Furthermore, the calculated entropy value lacks practical interpretation. When it comes to categorizing the security of password generation strategies, it is difficult to find a reasonable metric, and only a rough ranking of the strength of the strategies can be obtained. To obtain more precise, data-driven conclusions, researchers have adopted an evaluation method based on password guessing to evaluate password generation strategies. This method estimates the overall strength of the password set generated by the given strategy (generally, the number of guesses required to crack the password) to provide a three-dimensional, practically meaningful quantitative security metric. However, this method places high demands on the amount of data, making it difficult to systematically and efficiently evaluate a large number of different password generation strategies. Summary of the Invention

[0004] The purpose of the present invention is to provide a password generation strategy evaluation method based on an efficient data-driven password guessing model, so as to improve the evaluation efficiency and accuracy of the password generation strategy.

[0005] This paper proposes a password generation strategy evaluation method based on an efficient data-driven password guessing model. Using a publicly leaked password dataset as the original password set, this method extracts passwords that meet the password strategy to form an evaluation set, replacing the need for user surveys. An efficient password guessing model is then used to assess the strength of the corresponding subset, which is then used to quantitatively assess the security of the password generation strategy. This method effectively quantitatively evaluates a large number of different password generation strategies and provides high-confidence evaluation results. The method is divided into three steps:

[0006] Step 1: Generate a password set that matches the password generation strategy

[0007] We select a dataset of publicly leaked passwords to form an original evaluation set, and use this original evaluation set to simultaneously evaluate multiple password generation strategies.

[0008] The format of the original evaluation set is as follows:

[0009] (1) Each line represents a user password;

[0010] (2) Each user password must contain only numbers, uppercase and lowercase letters, and special symbols (except blank characters and printable ASCII characters).

[0011] According to different password generation strategies, the traversal method is used to extract passwords matching the corresponding generation strategy from the original evaluation set to form a password set under the password generation strategy.

[0012] The password generation policy includes but is not limited to the following restrictions on passwords:

[0013] (1) Minimum and maximum length (the minimum and maximum number of characters allowed in a password);

[0014] (2) Character type requirements (the number of different character types that the password must contain, such as "must contain two of the following: letters, numbers, and special characters");

[0015] (3) Keyboard sequence restrictions (keyboard sequences such as "qwe" or repeated characters such as "111" are not allowed in passwords);

[0016] (4) Blacklist restriction (passwords are not allowed to contain certain high-risk strings, such as "'password' is not allowed").

[0017] Step 2: Measure the strength of the generated password set

[0018] Using an efficient data-driven password guessing model [1], we estimate the number of guesses for each password in the password set and obtain the distribution of the number of guesses for the password set. Based on the distribution of the number of guesses, we calculate the percentage of passwords in the password set with a guess number lower than a certain value (called weak passwords), and use this percentage as the strength of the password set.

[0019] Step 3: Calculate the security of the password generation strategy based on strength

[0020] Repeat step 2 for the original evaluation set generated in step 1 to obtain the strength of the original evaluation set. Compare the strength of the original evaluation set with the strength of the generated password set to obtain the quantitative security of the password generation strategy. This security measure eliminates the influence of the strength of the original evaluation set.

[0021] In the present invention, before implementing step 1, the following assumptions need to be made to generate a password set that corresponds to the password generation strategy:

[0022] (1) In the original evaluation set, there are user passwords that can pass the password generation policy required for evaluation;

[0023] (2) The password generation policy applied to the passwords in the original evaluation set is strictly weaker than the password generation policy that needs to be evaluated. That is, if a password passes the password generation policy that needs to be evaluated, it will definitely pass the password generation policy applied to the passwords in the original evaluation set.

[0024] The specific process of generating a password set corresponding to the password generation strategy described in step 1 of the present invention is as follows:

[0025] (1) Select the publicly leaked password dataset to form the original evaluation set P leak The original evaluation set P leak No modification will be made after confirmation;

[0026] (2) According to different password generation strategies w, in the original evaluation set P leak Use the traversal method to extract the passwords that match w and form a password set P that corresponds to the password generation strategy w w .

[0027] The strength of the generated password set measured in step 2 of the present invention requires the following assumptions (with the following characteristics):

[0028] (1) The Monte Carlo method can be used to convert the corresponding password probability into the number of password guesses, that is, a quantitative estimate of the password strength;

[0029] (2) Password strength is negatively correlated with the frequency of password occurrence, that is, the more frequently a password is used, the lower its strength.

[0030] The specific process of measuring the strength of the generated password set in step 2 of the present invention is as follows:

[0031] (1) Use an efficient data-driven password guessing model to estimate the password set P w The number of guesses for each password is P w The distribution of guesses G w ;

[0032] (2) According to the distribution G of the guess number w , calculate P w The proportion of passwords with a guess count lower than a certain value e (called weak passwords) is ρ w , using ρ w As the password set P w The strength of the attack. Due to the limitations of hardware and algorithm selection, attackers have different levels of guessing resources. More professional attackers have more sufficient guessing resources, allowing them to make more guesses. In practice, two constant values e are used to simulate the attacker's guessing resources being insufficient e1 (e1 = 10 6 ) and the attacker guesses that there are sufficient resources e2 (e2 = 10 14 ) cases, the selection of e is based on the classification criteria of efficient data-driven password guessing models [1]. The evaluation results under the simulation with insufficient guessing resources reflect the overall security of the password set against general attackers. The evaluation results under the simulation with sufficient guessing resources reflect the overall security of the password set against professional attackers.

[0033] The security level of the password generation strategy is calculated based on the strength in step 3 of the present invention. The specific process is as follows:

[0034] (1) For the original evaluation set P generated in step 1 leak , repeat step 2 to obtain P leak The intensity ρ;

[0035] (2) Calculation γ w As a quantitative security indicator of the password policy w.

[0036] Technical Effects

[0037] The method proposed in this paper efficiently evaluates the security of password generation strategies. For different password generation strategies, the evaluation criteria can be met by simply performing different matching operations on the original evaluation set. This effectively improves the objectivity of the evaluation results and avoids the heavy reliance on user research and expert knowledge in traditional evaluation methods.

[0038] The method proposed in this paper is easy to implement and does not rely on complex data structures. However, it requires a relatively accurate estimate of the password strength to obtain a precise distribution of guesses for the policy password set. Therefore, it places certain demands on the accuracy of the password guessing model. For choosing a password guessing model, probabilistic context-free grammars, N-th-order Markov algorithms, and other methods can be used.

[0039] The method proposed by the present invention has certain requirements on the data format of the original password evaluation set. The passwords in the password set are text types in ASCII encoding format and only contain printable ASCII characters except blank characters. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flowchart of how policies are evaluated for password generation. DETAILED DESCRIPTION

[0041] The following examples of the present invention are described in detail, with specific implementation methods and operating procedures provided, but the protection scope of the present invention is not limited to the following examples.

[0042] In the example of the present invention, the generation of a password set that corresponds to the password generation strategy and the evaluation process of the corresponding password generation strategy are as follows: Figure 1 shown.

[0043] Generate a password set that matches the password generation strategy

[0044] For each password in the original evaluation set, we match it against each password generation policy to be evaluated, and generate a binary code with a number of bits equal to the number of password generation policies to be evaluated. If a password successfully matches a generation policy, the corresponding bit is set to 1, otherwise it is set to 0. These binary codes are stored in sequence to obtain a password generation policy matching index, which is used to generate the password subset under the corresponding password generation policy.

[0045] Measure the strength of the generated password set and calculate the security of the password generation strategy based on the strength

[0046] For the original password set, an efficient data-driven password guessing model is used to estimate the password strength (number of guesses) of each password and store it. For the original password set, the proportion of passwords with a certain number of guesses is calculated as the strength of the original evaluation set. For each password subset, the proportion of passwords with a certain number of guesses is calculated as the strength of the password subset. The two are compared to determine the security of the password generation strategy.

[0047] Password Generation Policy Evaluation Example

[0048] Given the following two password generation strategies:

[0049] A. The password length should not be less than 6 characters;

[0050] B. The password must be at least 8 characters long and must contain two of the following: numbers, letters, and special characters.

[0051] Given the following five passwords, they constitute the original password set:

[0052] 1. Password

[0053] 2. Password111

[0054] 3. Pass

[0055] 4.P@ssword125

[0056] 5.pass1111.

[0057] First, the password generation strategies A and B are matched one by one in the original password set to obtain two different password sets P A 、P B Among them, P A Including passwords 1, 2, 4, 5, P B Including passwords 2, 4, and 5. Estimate P respectively A 、P B The distribution of the number of guesses, according to the evaluation results of the efficient password evaluation model, P A The number of passwords with a guess count less than e1 and a guess count less than e2 accounts for 50% and 75% respectively. B The percentage of passwords with a guess count less than e1 and a guess count less than e2 is 33.3% and 66.6% respectively. In the original dataset, the percentage of passwords with a guess count less than e1 and a guess count less than e2 is 60% and 80% respectively.

[0058] Use P A 、P B The distribution of the number of guesses is compared with the graded number of guesses for the original password set to simulate the security of the password generation strategies under two different scenarios. For password generation strategy A, the security factor γ is 1.20 under a low number of guesses (when the attacker has insufficient guessing resources), and 1.07 under a high number of guesses (when the attacker has sufficient guessing resources). For password generation strategy B, the security factor γ is 1.80 under a low number of guesses (when the attacker has insufficient guessing resources), and 1.20 under a high number of guesses (when the attacker has sufficient guessing resources). This indicates that password generation strategy B has better security.

[0059] Through the above data-driven approach, we objectively generate quantitative evaluation results for password generation strategies, effectively avoiding the heavy reliance on user surveys and expert knowledge in traditional evaluation methods.

[0060] References

[0061] 1. Xu M, Wang C, Yu J, et al. Chunk-Level Password Guessing: Towards Modeling Refined Password Composition Representations[C] / / Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021: 5-20.

Claims

1. A password generation strategy evaluation method based on an efficient data-driven password guessing model, characterized in that: Using a publicly leaked password dataset as the original password set, we extract passwords that meet the password policy to form an evaluation set, replacing the relevant steps of user research. We then use an efficient password guessing model to evaluate the strength of the corresponding subset, and use this strength to quantitatively assess the security of the password generation policy. This allows us to efficiently perform quantitative evaluations on a large number of different password generation policies and provide high-confidence evaluation results. This is done in three steps: Step 1: Generate a password set that matches the password generation strategy We select a publicly leaked password dataset to form an original evaluation set. We use this original evaluation set to simultaneously evaluate multiple password generation strategies. The format of the original evaluation set is as follows: (1) Each line represents a user password; (2) Each user password must contain only numbers, uppercase and lowercase letters, special symbols, and excludes space characters and printable ASCII characters; According to different password generation strategies, the traversal method is used to extract passwords matching the corresponding generation strategy from the original evaluation set to form a password set under the password generation strategy; The password generation policy imposes the following restrictions on passwords: (1) Maximum and minimum length, that is, the minimum and maximum number of characters allowed in a password; (2) Character type requirements, i.e., the number of different character types that must be included in the password; (3) Keyboard sequence restriction, i.e. keyboard sequences are not allowed in passwords; (4) Blacklist restriction, that is, passwords are not allowed to contain high-risk strings; Step 2: Measure the strength of the generated password set The specific process is as follows: (1) Use an efficient data-driven password guessing model to estimate the password set P w The number of guesses for each password is P w The distribution of guesses G w ; (2) According to the distribution G of the guess number w , calculate P w The proportion of passwords with a guess count lower than a certain value e ρ w , using ρ w As the password set P w Strength; two specific values e are used: e1=10 6 , simulating the attacker guessing that resources are insufficient, e2=10 14 , simulating the situation where attackers have sufficient guessing resources; the evaluation results under the simulation of insufficient guessing resources reflect the overall security of the password set against general attackers; the evaluation results under the simulation of sufficient guessing resources reflect the overall security of the password set against professional attackers; Step 3: Calculate the security of the password generation strategy based on strength The specific process is as follows: (1) For the original evaluation set generated in step 1, record it as P leak , repeat step 2 to obtain P leak The intensity ρ; (2) Compare the strength of the original evaluation set with the strength of the generated password set: γ w As a quantitative security indicator of the password policy w.

2. The password generation strategy evaluation method according to claim 1, characterized in that: Before step 1, the following assumptions are used to generate a password set that matches the password generation strategy: (1) In the original evaluation set, there are user passwords that can pass the password generation policy required for evaluation; (2) The password generation strategy applied to the passwords in the original evaluation set is strictly weaker than the password generation strategy that needs to be evaluated. That is, if a password can pass the password generation strategy that needs to be evaluated, it can definitely pass the password generation strategy applied to the passwords in the original evaluation set.

3. The password generation strategy evaluation method according to claim 1, characterized in that: The password generation strategy described in step 1 corresponds to a set of passwords that meet the requirements. The specific process is as follows: (1) Select the publicly leaked password dataset to form the original evaluation set P leak ; (2) According to different password generation strategies w, in the original evaluation set P leak Use the traversal method to extract the passwords that match w and form a password set P that corresponds to the password generation strategy w w .

Images