A mimicry system account password dynamic management method

Abstract

The application provides a mimic system account password dynamic management method, which comprises the following steps: in an initial state, the same user account has different passwords on different mimic components and executors; a password cracking detector is arranged on the executor or mimic component of the mimic system to detect whether the executor or mimic component is subjected to a password cracking attack in real time; when it is detected that the executor or mimic component is subjected to a password cracking attack, the current user account is locked, the executor or mimic component is informed to enable a traffic filtering rule to block the network attack cracking, and a password regeneration request message is sent to a password manager to change the password of the current user account; wherein the password cracking attack detection step comprises the following steps: detecting whether the number of login requests in a certain time range exceeds a preset threshold value, and if yes, and the return result of each login request is failure, it is considered that a password cracking attack occurs.

Description

Technical Field

[0001] This invention relates to the field of mimicry defense, and more specifically, to a method for dynamic management of account passwords in mimicry systems. Background Technology

[0002] Mimicry defense technology has revolutionized cybersecurity, offering a novel solution for network system network security. However, since mimicry components and executors are often based on operating system design, and traditional host operating system account passwords are static, once successfully brute-forced, the entire mimicry system becomes vulnerable. For attackers, gaining control of the host machine renders the mimicry mechanism ineffective in protecting the business system. Therefore, protecting the security of system passwords for mimicry components and executors by randomizing and dynamizing static passwords is crucial for enhancing the mimicry system's resistance to brute-force attacks.

[0003] In order to solve the above problems, people have been seeking an ideal technological solution. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing a dynamic management method for account passwords in a mimicry system, thereby solving the problem that mimicry systems cannot resist brute-force attacks due to the static nature of passwords.

[0005] To achieve the above objectives, the technical solution adopted by this invention is to provide a method for dynamic management of account passwords in a mimicry system, comprising the following steps:

[0006] In the initial state, the same user account on different mimicry components and execution bodies has different passwords;

[0007] A password brute-force detector is installed on the execution body or mimicry component of the mimicry system to detect in real time whether the execution body or mimicry component is subjected to password brute-force attacks;

[0008] When a password brute-force attack is detected on the executor or mimicry component, the current user account is locked, the executor or mimicry component is notified to enable traffic filtering rules to block the network attack brute-force, and a password regeneration request message is sent to the password manager.

[0009] After receiving the response message returned by the password manager, the password receiver set on the execution body or mimicry component of the mimicry system decrypts it using a preset decryption algorithm to obtain a new random password;

[0010] A password changer set on the execution body or mimicry component of the mimicry system changes the password of the current user account according to a new random password;

[0011] The password brute-force attack detection steps are as follows: detect whether the number of login requests within a certain time range exceeds a preset threshold. If it does, and the return result of each login request is failure, then a password brute-force attack is considered to have occurred.

[0012] This invention introduces a password manager into the mimicry system. When a password brute-force attack is detected on the execution body or mimicry component, the current user account is locked, and the execution body or mimicry component is notified to enable traffic filtering rules to block network attack brute-force attacks. At the same time, a new password is requested from the password manager to update the password of the current user account. By making the passwords of the mimicry component and execution body system dynamic, the problem that the mimicry system cannot resist password brute-force attacks due to the static nature of passwords is solved.

[0013] In the mimicry system, different mimicry components and executors have different user passwords for the same user account. This prevents attackers from cracking the password of a mimicry component or executor and thus cracking the password of the entire mimicry system, thereby improving the security of the mimicry system.

[0014] The password manager uses a random method to generate random passwords, further realizing the randomization of passwords for mimicry components and execution systems, and further solving the problem that mimicry systems cannot resist password brute-force attacks due to the static nature of passwords. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the structure of Embodiment 1 of the present invention.

[0016] Figure 2 This is a flowchart of Embodiment 1 of the present invention. Detailed Implementation

[0017] Brute-force traffic refers to network traffic during the process of logging into an execution system via the network (SSH, telnet, samba, http, etc.).

[0018] Since mimicry components and executors are often based on operating system design, and the account passwords of traditional host operating systems are static, once they are successfully brute-forced, the entire mimicry system will be in an open state. For attackers, after gaining control of the host machine, the mimicry mechanism's defense against business systems will also become ineffective. Therefore, protecting the security of the system passwords of mimicry components and executors by randomizing and dynamizing static passwords is of great significance for improving the mimicry system's ability to resist brute-force attacks.

[0019] To address the aforementioned technical problems, this invention proposes a dynamic account password management method for a mimicry system. By introducing a password manager into the mimicry system, when a password brute-force attack is detected on the execution entity or mimicry component, the current user account is locked, and the execution entity or mimicry component is notified to activate traffic filtering rules to block network attack brute-force attacks. Simultaneously, a new password is requested from the password manager to update the current user account's password. By making the passwords of the mimicry component and execution entity system dynamic, the problem that the static nature of passwords in a mimicry system cannot resist password brute-force attacks is solved.

[0020] Furthermore, different mimicry components and executors in the mimicry system have different user passwords for the same user account. This prevents attackers from cracking the password of a single mimicry component or executor and thus cracking the password of the entire mimicry system, thereby improving the security of the mimicry system.

[0021] The technical solution of the present invention will be further described in detail below through specific embodiments.

[0022] Example 1

[0023] like Figure 1-2 As shown, this embodiment provides an example of a method for dynamically managing account passwords in a mimicry system, specifically including the following steps:

[0024] In the initial state, the same user account on different mimicry components and execution bodies has different passwords;

[0025] A password brute-force detector is installed on the execution body or mimicry component of the mimicry system to detect in real time whether the execution body or mimicry component is subjected to password brute-force attacks;

[0026] When a password brute-force attack is detected on the executor or mimicry component, the current user account is locked, the executor or mimicry component is notified to enable traffic filtering rules to block the network attack brute-force, and a password regeneration request message is sent to the password manager.

[0027] After receiving the response message returned by the password manager, the password receiver set on the execution body or mimicry component of the mimicry system decrypts it using a preset decryption algorithm to obtain a new random password;

[0028] A password changer set on the execution body or mimicry component of the mimicry system changes the password of the current user account according to a new random password;

[0029] The password brute-force attack detection steps are as follows: detect whether the number of login requests within a certain time range exceeds a preset threshold. If it does, and the return result of each login request is failure, then a password brute-force attack is considered to have occurred.

[0030] It is understood that the purpose of the traffic filtering rules is to filter out network traffic during the login process of the execution system via the network (SSH, telnet, samba, http, etc.), that is, to filter brute-force traffic. Therefore, the traffic filtering rules can be set according to the packet header characteristics of SSH, telnet, samba, http, etc., so that packets of SSH, telnet, samba, http, etc. can be identified by whether the packet header of the received login request matches the traffic filtering rules. These do not impose too many limitations on the traffic filtering rules.

[0031] In practice, after receiving the password regeneration request message, the password manager obtains the ID number and user account of the sender of the password regeneration request from the password regeneration request message, generates a password group keyGroup based on the ID number and user account, and returns the generated password group to the sender of the password regeneration request according to the ID number.

[0032] Wherein, keyGroup={ID, user, passwd, time, validTime}, where keyGroup is the password group, ID is the number of the sender of the password regeneration request, user is the user account, passwd is the generated random password with a length range limited to [6,64], consisting of characters, numbers, and special characters; time is the generation time of the random password, and validTime represents the validity period of the random password, which is consistent with the password timed update cycle and is in hours.

[0033] The generated keyGroup is stored in the password logger within the password manager. During storage, only the passwd field is encrypted; other fields remain unencrypted. This improves the security of the keyGroup without consuming encryption resources.

[0034] Furthermore, different encryption algorithms can be used to encrypt the keyGroup corresponding to different mimicry components and execution bodies. When in use, the corresponding encryption algorithm is selected according to the ID number to encrypt the random password passwd, and the encrypted ciphertext and other fields in the password group are added to the password logger.

[0035] When a user needs to view the user password on a mimicry component or execution body, the password viewer in the password manager obtains the password group keyGroup from the password logger, finds the random password ciphertext of the corresponding component or execution body by ID, and obtains the password of the mimicry component or execution body by decryption.

[0036] Similarly, the password manager also encrypts the keyGroup and sends it to the mimic component and the execution unit in the form of UDP packets. Different encryption algorithms are used between the mimic component and the execution unit to transmit the keyGroup. Specifically, the corresponding encryption algorithm is selected according to the ID number to encrypt the keyGroup, and the encrypted keyGroup is sent to the mimic component or execution unit with the corresponding ID number in the form of UDP packets.

[0037] Understandably, at preset intervals, the password manager also regenerates a unique password set for each mimic component and executor, and sends it to the corresponding mimic component and executor. For example, the password is regenerated once every 24 hours.

[0038] Furthermore, the password manager retransmits the keyGroup every hour.

[0039] When the mimic component or the executor receives the password group keyGroup, it determines whether the random password passwd is a new password based on the time field in the password group keyGroup. If the random password passwd is not a new password, it is discarded; otherwise, it is determined that the random password passwd is a new password, and the user account password is updated with the random password passwd.

[0040] Specifically, the steps to determine whether the random password passwd is a new password based on the time field in the password group are as follows: if the time field in the password group is less than the password request sending time, then the random password passwd is determined not to be a new password; otherwise, the random password passwd is determined to be a new password.

[0041] It is important to note that in this embodiment, the password manager communicates with the password receiver and password brute-force detector on the mimicry component or executor via a dedicated password network, thereby isolating them from the mimicry service network of the mimicry system. This ensures that the use of the mimicry service network will not be affected during operation.

[0042] Example 2

[0043] The difference between this embodiment and Embodiment 1 is that this embodiment provides the following process for generating the random password passwd:

[0044] Randomly select an even number x from [6, 64] as the length of the random password;

[0045] Take x / 2 random numbers from the English characters abc...z, ABC...Z, numbers 0...10 and special characters, and then take x / 2 random numbers from the English characters abc...z, ABC...Z, numbers 0...10 and special characters. Concatenate the two random numbers to get the random password passwd.

[0046] Check if the generated random password "passwd" exists in the password logger in the password manager. If it exists, repeat the above steps to generate a new random password "passwd" until the generated random password no longer exists in the password logger.

[0047] As can be seen, in this embodiment, the password manager uses a random method to generate random passwords, which further realizes the randomization of passwords for the mimicry component and the execution system, and further solves the problem that the mimicry system cannot resist password brute-force attacks due to the static nature of the passwords.

[0048] Since each time a random password passwd is generated, an even number x is randomly selected from [6, 64] as the length of the random password, the length of the random password for different executors and mimicry components is also random, thereby improving the security of user passwords in the mimicry system.

[0049] Furthermore, since the generation of a random password involves two steps—the first step is to select x / 2 random numbers from English characters abc…z, ABC…Z, numbers 0…10, and special characters, and the second step is to select x / 2 more random numbers from English characters abc…z, ABC…Z, numbers 0…10, and special characters—the random numbers selected in the two steps may partially overlap or may not overlap at all. Compared to directly selecting x random numbers from English characters abc…z, ABC…Z, numbers 0…10, and special characters, this embodiment expands the random password generation method of passwd and broadens the value space of the random password.

[0050] Example 3

[0051] This embodiment uses Figure 1 For example, a specific implementation is given.

[0052] The mimicry system includes an input agent, executor 1, executor 2, executor 3, arbitrator, and scheduler. The input agent's ID is 0x01, executor 1's ID is 0x02, executor 2's ID is 0x03, executor 3's ID is 0x04, arbitrator's ID is 0x05, and scheduler's ID is 0x06.

[0053] In its initial state, the password manager generates different keygroups for the same user account "root" on different mimic components and execution bodies, specifically including: keyGroup1={0x01,root,abc123@,2021-10-05-15:03,24}, keyGroup2={0x02,root,cdef1 23&, 2021-10-05-15:04, 24}, keyGroup3={0x03, root, lki@123&, 2021-10-05-15:05, 24}, k eyGroup4={0x04,root,ola@123&,2021-10-05-15:06,24},keyGroup5={0x05,root,qwer@4 31&, 2021-10-05-15:07, 24}, keyGroup6={0x06, root, zxcd@278&, 2021-10-05-15:08, 24}.

[0054] When the password brute-force detector on Executor 2 detects that Executor 2 is under a password brute-force attack, it locks the current user account root, notifies Executor 2 to enable traffic filtering rules to block network attack brute-force, and sends a password regeneration request message to the password manager. The data field of the password regeneration request message contains req={0x03, root, 2021-10-05-19:30, 0x01}, where 0x03 is the ID of Executor 2, root is the user account, 2021-10-05-19:30 indicates the time the request was sent, and 0x01 represents regenerating the password.

[0055] After receiving the request message, the password manager obtains the ID number 0x03 of the requester and the user account root from the password re-regeneration request message; then it randomly selects an integer 8 from [6, 64] as the length of the random password.

[0056] Four random numbers, moZL, are drawn from the English characters abc……z, ABC……Z, numbers 0……10, and special characters. Then, four random numbers, @98@, are drawn from the English characters abc……z, ABC……Z, numbers 0……10, and special characters. The two random numbers are concatenated to obtain the random password passwd moZL@98@.

[0057] The system checks if the generated random password "passwd" exists in the password logger. If it does not exist, it generates a password group "keyGroup={0x03, root, moZL@98@, 2021-10-05-19:31, 24}" using ID number 0x03, user account "root", and random password "passwd". The generated password group is then encrypted using the encryption algorithm corresponding to Execution 2 according to the ID number and sent back to Execution 2 in the form of a UDP packet.

[0058] When the password receiver of Execution 2 receives the password group keyGroup, it compares the time field in the password group with the password request sending time. It finds that 2021-10-05-19:31 is greater than 2021-10-05-19:30, so it determines that the random password passwd is the new password and updates the user account password with the random password passwd.

[0059] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for dynamic management of account passwords in a mimicry system, characterized by the following: step: In the initial state, the same user account on different mimicry components and execution bodies has different passwords; A password brute-force detector is installed on the execution body or mimicry component of the mimicry system to detect in real time whether the execution body or mimicry component is subjected to password brute-force attacks; When a password brute-force attack is detected on the executor or mimicry component, the current user account is locked, the executor or mimicry component is notified to enable traffic filtering rules to block the network attack brute-force, and a password regeneration request message is sent to the password manager. After receiving the password regeneration request message, the password manager obtains the ID number and user account of the sender of the password regeneration request from the password regeneration request message, generates a password group keyGroup based on the ID number and user account, and returns the generated password group to the sender of the password regeneration request according to the ID number. Wherein, keyGroup={ID, user, passwd, time, validTime}, where keyGroup is the password group, ID is the number of the sender of the password regeneration request, user is the user account, passwd is the generated random password, time is the generation time of the random password, and validTime represents the validity period of the random password. The process of generating the random password passwd is as follows: Randomly select an even number x from [6, 64] as the length of the random password; Take x / 2 random numbers from the English characters abc...z, ABC...Z, numbers 0...10 and special characters, and then take x / 2 random numbers from the English characters abc...z, ABC...Z, numbers 0...10 and special characters. Concatenate the two random numbers to get the random password passwd. Check if the generated random password "passwd" exists in the password logger in the password manager. If it exists, repeat the above steps to generate a new random password "passwd" until the generated random password no longer exists in the password logger. When using it, select the appropriate encryption algorithm according to the ID number to encrypt the random password "passwd", and add the encrypted ciphertext and other fields in the password group to the password logger. After receiving the response message returned by the password manager, the password receiver set on the execution body or mimicry component of the mimicry system decrypts it using a preset decryption algorithm to obtain a new random password; A password changer set on the execution body or mimicry component of the mimicry system changes the password of the current user account according to a new random password; The password brute-force attack detection steps are as follows: detect whether the number of login requests within a certain time range exceeds a preset threshold. If it exceeds the threshold and each login request returns a failure result, then a password brute-force attack is considered to have occurred. The original password manager communicates with the password receiver and password brute-force detector on the mimicry component or execution body through a dedicated password network. Different keyGroups corresponding to different mimicry components and execution bodies are encrypted using different encryption algorithms.

2. The method for dynamic management of account passwords in a mimicry system according to claim 1, characterized in that: When the mimic component or executor receives the password group, it determines whether the random password passwd is a new password based on the time field in the password group. If the random password passwd is not a new password, it is discarded; otherwise, it is determined that the random password passwd is a new password, and the user account password is updated with the random password passwd.

3. The method for dynamic management of account passwords in a mimicry system according to claim 2, characterized in that, The specific steps to determine whether the random password passwd is a new password based on the time field in the password group are as follows: if the time field in the password group is less than the password request sending time, then the random password passwd is determined not to be a new password; otherwise, the random password passwd is determined to be a new password.

4. The method for dynamic management of account passwords in a mimicry system according to claim 2, characterized in that: When a user needs to view the user password on a mimicry component or execution body, the password viewer in the password manager obtains the password group keyGroup from the password logger, finds the random password ciphertext of the corresponding component or execution body by ID, and obtains the password of the mimicry component or execution body by decryption.

5. The method for dynamic management of account passwords in a mimicry system according to claim 1, characterized in that: After the generated random password passwd is not found in the password logger, the corresponding encryption algorithm is selected according to the ID number to encrypt the password group keyGroup, and the encrypted password group is sent to the mimic component or executor with the corresponding ID number in the form of a UDP packet.

6. The method for dynamic management of account passwords in a mimicry system according to claim 1, characterized in that: At preset intervals, the password manager regenerates a unique password set for each mimic component and executor, and sends it to the corresponding mimic component and executor.

Images