Weak password detection method, device, electronic device and server

Abstract

The present application discloses a weak password detection method, device, electronic device, and server, belonging to the field of computer technology. The method is applied to a client and includes: obtaining first password information based on the password to be tested and the client private key; sending the first password information and first information to the server, the first information being used to represent the weak password dictionary set corresponding to the password to be tested; receiving a target data set and a first server-side negotiation key sent by the server; the target data set includes at least one second password information, the at least one second password information being obtained based on the weak password dictionary set and the server private key; the first server-side negotiation key being obtained based on the server private key and the first password information; obtaining a client-side negotiation key set based on the target data set and the client private key; and determining whether the password to be tested is a weak password based on the client-side negotiation key set and the first server-side negotiation key.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a weak password detection method, device, electronic device and server. Background Art

[0002] When using Internet services, users usually need to set a username and password. To improve the security of passwords, passwords will be checked to determine whether they are weak.

[0003] Currently, existing technologies require uploading the original password or hash value to the server when performing weak password detection. During the detection process, the server can obtain the original password value entered by the user by comparing the matching values. If the server does not store the password properly, it is easy to cause the user's password to be leaked or be used maliciously by the server. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a weak password detection method, device, electronic device and server, which can solve the problem in the prior art that the server side is prone to password leakage when detecting weak passwords.

[0005] In a first aspect, an embodiment of the present application provides a weak password detection method, which is applied to a client and includes:

[0006] Obtaining first password information according to the password to be tested and the client private key;

[0007] Sending the first password information and first information to the server, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0008] receiving a target data set and a first server-side negotiated key sent by the server; wherein the target data set includes at least one second password information, and the at least one second password information is obtained based on the weak password dictionary set and the server private key; and the first server-side negotiated key is obtained based on the server private key and the first password information;

[0009] Obtaining a client negotiated key set according to the target data set and the client private key;

[0010] Determine whether the password to be tested is a weak password based on the client-side negotiated key set and the first server-side negotiated key.

[0011] In a second aspect, an embodiment of the present application provides a weak password detection method, which is applied to a server, including:

[0012] Obtaining P data sets based on the server private key and P weak password dictionary sets, wherein the data sets correspond one-to-one to the weak password dictionary sets, and each data set includes at least one second password information; P is a positive integer;

[0013] Receiving first password information and first information sent by a client, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0014] Determining a target data set corresponding to the first information from the P data sets;

[0015] Obtaining a first server-side negotiated key based on the server-side private key and the first password information;

[0016] Send the target data set to the client and negotiate a key with the first server.

[0017] In a third aspect, an embodiment of the present application provides a weak password detection device, characterized in that it is applied to a client and includes:

[0018] A first processing module is used to obtain first password information according to the password to be tested and the client private key;

[0019] A first sending module is configured to send the first password information and first information to a server, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0020] a first receiving module, configured to receive a target data set and a first server-side negotiated key sent by the server; wherein the target data set includes at least one second password information, the at least one second password information being obtained based on the weak password dictionary set and the server-side private key; and the first server-side negotiated key being obtained based on the server-side private key and the first password information;

[0021] A second processing module, configured to obtain a client negotiated key set according to the target data set and the client private key;

[0022] The first determining module is configured to determine whether the password to be tested is a weak password based on the client-side negotiated key set and the first server-side negotiated key.

[0023] In a fourth aspect, an embodiment of the present application provides a weak password detection device, which is applied to a server, including:

[0024] a fourth processing module, configured to obtain P data sets based on the server private key and the P weak password dictionary sets, wherein the data sets correspond one-to-one to the weak password dictionary sets, and each data set includes at least one second password information; P is a positive integer;

[0025] A second receiving module is configured to receive first password information and first information sent by a client, wherein the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0026] A second determining module is configured to determine a target data set corresponding to the first information from the P data sets;

[0027] a fifth processing module, configured to obtain a first server-side negotiated key based on the server-side private key and the first password information;

[0028] The second sending module is configured to send the target data set and the first server-side negotiated key to the client.

[0029] In a fifth aspect, an embodiment of the present application provides an electronic device comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0030] In a sixth aspect, an embodiment of the present application provides a server comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the weak password detection method as described in the second aspect are implemented.

[0031] In a sixth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect are implemented.

[0032] In the seventh aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the method described in the first aspect or the second aspect.

[0033] In an eighth aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the method described in the first aspect or the second aspect.

[0034] In an embodiment of the present application, the client obtains first password information based on the password to be tested and the client private key; and sends the first password information and the first information to the server, wherein the first information is used to represent the weak password dictionary set corresponding to the password to be tested; the client then receives a target data set sent by the server based on the first password information and the first information and negotiates a key with the first server; wherein the target data set includes at least one second password information, and the at least one second password information is obtained based on the weak password dictionary set and the server private key; the first server negotiated key is obtained based on the server private key and the first password information; the client obtains a client negotiated key set based on the target data set and the client private key; further, the client determines whether the password to be tested is a weak password based on the client negotiated key set and the first server negotiated key. In this way, during the weak password detection process, the server cannot obtain the original value of the password to be tested entered by the user, and the user password is only known to the client itself, thereby preventing the server from maliciously collecting the user password and improving the security of the password. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is one of the flow charts of the weak password detection method provided in the embodiment of the present application;

[0036] Figure 2 This is the second flow chart of the weak password detection method provided in the embodiment of the present application;

[0037] Figure 3 This is one of the structural block diagrams of the weak password detection device provided in the embodiment of the present application;

[0038] Figure 4 This is the second structural block diagram of the weak password detection device provided in the embodiment of the present application;

[0039] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of the present application;

[0040] Figure 6 Schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application;

[0041] Figure 7 This is a structural block diagram of the server provided in an embodiment of the present application;

[0042] Figure 8 This is a schematic diagram of the hardware structure of the server provided in the embodiment of the present application. DETAILED DESCRIPTION

[0043] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field are within the scope of protection of this application.

[0044] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0045] The following, in conjunction with the accompanying drawings, describes in detail the weak password detection method, device, electronic device, and server provided in the embodiments of the present application through specific embodiments and their application scenarios.

[0046] See also Figure 1 The present invention provides a method for detecting weak passwords, which is applied to a client and specifically includes the following steps:

[0047] Step 101: Obtain first password information according to the password to be tested and the client private key.

[0048] Optionally, the password to be tested is encrypted based on the client private key to obtain first password information to hide the real password to be tested.

[0049] Step 102: Send the first password information and first information to the server, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested.

[0050] Optionally, after receiving the password to be tested (upw) input by the user, the client uses a hash algorithm to calculate the hash value of the password to be tested, and uses the first n bytes of the hash value of the password to be tested as the first information; accordingly, the server uses the same hash algorithm as the client to calculate the hash value corresponding to the weak password dictionary, and uses the first n bytes of the hash value corresponding to the weak password dictionary to divide the weak password dictionary into different weak password dictionary sets. In this way, after receiving the first information, the server can obtain the weak password dictionary set corresponding to the password to be tested based on the first information.

[0051] Step 103: Receive a target data set and a first server-side negotiated key sent by the server; wherein the target data set includes at least one second password information, and the at least one second password information is obtained based on the weak password dictionary set and the server private key; the first server-side negotiated key is obtained based on the server private key and the first password information.

[0052] In a specific implementation, the server uses the same hash algorithm as the client to calculate the hash value corresponding to the weak password dictionary, and uses the first n bytes of the hash value corresponding to the weak password dictionary to divide the weak password dictionary into P weak password dictionary sets; further, the server encrypts the P weak password dictionary sets respectively according to the server private key to obtain P data sets, that is, one data set corresponds to one weak password dictionary set, each data set includes at least one second password information, and each second password information is obtained by the server private key and a weak password dictionary; after receiving the first password information and the first information sent by the client, the server determines the target data set corresponding to the first information from the P data sets according to the first information, and processes the first password information according to the server private key to obtain the first server-side negotiated key, and sends the first server-side negotiated key and the target data set to the client.

[0053] Exemplarily, the first password information sent by the client to the server is: b*H(upw), and the first server-negotiated password returned by the server to the client is: a*b*H(upw); wherein upw refers to the password to be tested, H(upw) refers to the processed value corresponding to the password to be tested, a is the server private key, and b is the client private key.

[0054] Step 104: Obtain a client negotiated key set according to the target data set and the client private key.

[0055] For example, the target data set corresponding to the first information sent by the server to the client is: BKT c ; The client negotiates the key set obtained by the client based on the target data set and the client private key: b*BKT c ; Since there is more than one data in the target dataset, b*BKT c Represents a negotiated key set.

[0056] Among them, the server-side data set corresponding to the weak password dictionary set is: BKT n＝ a*H(pw), where pw refers to the weak password dictionary, H(pw) refers to the processed value corresponding to the weak password dictionary, and a*H(pw) refers to the second password information obtained from the server private key and the weak password dictionary. a is the server private key, and b is the client private key. Thus, the value in the client-negotiated key set is: b*a*H(pw).

[0057] Step 105: Determine whether the password to be tested is a weak password based on the client-side negotiated key set and the first server-side negotiated key.

[0058] In a specific implementation, the intersection of the first negotiated key and the negotiated key set can be calculated. If an intersection exists, the original password value corresponding to the negotiated key in the intersection is the weak password dictionary collected by the server. This is because only when the password to be tested entered by the user is the same as the weak password dictionary on the server, will the same negotiated key be obtained under the same client private key b and server private key a.

[0059] For example, if the password negotiated by the first server is a*b*H(upw), and the value in the client-negotiated key set is b*a*H(pw), the intersection of a*b*H(upw) and b*a*H(pw) is calculated. If an intersection exists, it indicates that the password to be tested belongs to the weak password dictionary, that is, the password to be tested is a weak password. If no intersection exists, it indicates that the password to be tested is not a weak password.

[0060] In the above embodiment, during the weak password detection process, the server cannot obtain the original value of the password to be tested entered by the user. In this way, when the server verifies whether the user's input password is a weak password, it can ensure that the server cannot obtain the original text of the password entered by the user. The user password is only known by the client itself, which avoids the server from maliciously collecting the user password and improves the security of the password.

[0061] In one embodiment, in step 102, obtaining the first password information according to the password to be tested and the client private key includes:

[0062] Converting the password to be tested into an integer value;

[0063] Mapping the integer value onto an elliptic curve to obtain a first value;

[0064] Based on the elliptic curve encryption algorithm, the first value is encrypted according to the client private key to obtain the first password information.

[0065] For example, after the user enters the password to be tested (upw), a hash algorithm is used to calculate the hash value of the password to be tested, which is recorded as H(upw), and the first n bytes of the hash value are recorded as the first information c; further, the hash value is mapped to a point on the elliptic curve, which is recorded as H swu (upw); select a random secret value b (this value is the client private key), swu (upw) is processed to obtain b*H swu (upw), b*H swu(upw) is the first password information. Here, it should be pointed out that the “*” in the formula refers to the “scalar multiplication” calculation defined on the elliptic curve, which simply means moving the mapping point on the elliptic curve. For example, b*H swu (upw) means to change H swu (upw) A point after moving b times on the elliptic curve.

[0066] In this embodiment, since the mapping point H swu (upw) The characteristic of moving b times on the elliptic curve is that if the starting point and the end point are known, it is impossible to infer how many times the movement has been made. In other words, even if we know two points b*H on the elliptic curve swu (upw) and H swu (upw), the value of b cannot be calculated, so the client cannot infer the server's private key, ensuring the security of the server's weak password dictionary.

[0067] To further increase the difficulty of password recovery on the server side, in one embodiment, the weak password detection method further includes:

[0068] Obtaining N third password information based on the client private key and N random passwords, where N is a positive integer; in the above step 102, sending the first password information and the first information to the server includes:

[0069] Sending a first data set and a second data set to the server;

[0070] Among them, the first data set includes: the first password information and the N third password information; the second data set includes: the first information and N second information; the second information corresponds one-to-one to the random password, and the second information is used to represent the weak password dictionary set corresponding to the random password.

[0071] For example, the client generates N random passwords {r1, r2, ..., rN}, and uses the same method as the client to process the password to be tested to obtain N third password information {b1*H swu (r1),b2*H swu (r2),…,bN* Hswu (rN)}, and obtain the first n bytes of the hash value corresponding to the N random passwords as N second information {c1, c2, ..., cN}. Finally, the first data set sent by the client to the server is: {b1*H swu (r1),b2*H swu (r2),…,bN*H swu (rN),b*H swu(upw)}; the second data set sent to the server is: {c1,c2,…cN,c}; where b*H swu (upw) is the first password information, and c is the first information. Optionally, N is required to be ≥ 50 to better hide the password that actually needs to be detected.

[0072] It should be noted that this example uses b*H for convenience of representation. swu (upw) is placed at the end of the first data set, and the first information c is placed at the end of the second data set. However, in actual application, in order to hide the data related to the password to be tested, the first data set and the second data set can be randomly sorted, as long as the values ​​of the two sets are guaranteed to correspond one to one.

[0073] Correspondingly, the server encrypts the N third cryptographic information according to the server private key to determine N second server negotiation keys; further, the server sends a negotiation key set and N+1 target data sets to the client; wherein the N+1 target data sets are determined from the P data sets according to the first information and the N second information; that is, one second information corresponds to one target data set, and the first information corresponds to one target data set; the negotiation key set includes: the first server negotiation key and N second server negotiation keys; the N second server negotiation keys are obtained according to the server private key and the N third cryptographic information.

[0074] For example, the server receives the first data set {b1*H swu (r1),b2*H swu (r2),…,bx*H swu (rx),b*H swu (upw)}, and the second data set {c1, c2, ... cx, c}, the following processing is performed:

[0075] 1. According to the second data set {c1, c2, ... cN, c}, determine N+1 target data sets from P data sets. That is, according to {c1, c2, ... cN, c}, {BKT c1 ,BKT c2 ,…BKT cN ,BKT c}; Among them, BKT c1 is the target dataset corresponding to c1, ..., BKT cN is the first data set corresponding to cN, BKT c is the target data set corresponding to the first information c.

[0076] 2. The first data set {b1*H swu (r1),b2*Hswu (r2),…,bN*H swu (rN),b*H swu Each value in (upw)} is multiplied by the server private key a to get {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bN*H swu (rN),a*b*H swu (upw)}, this set is the negotiated key set on the server side.

[0077] Among them, a*b*H swu (upw) is the first server-side negotiated key, {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bN*H swu (rN)} is the key negotiated by N second servers.

[0078] 3. The server sends N+1 target data sets {BKT c1 ,BKT c2 ,…BKT cN ,BKT c}, and the negotiated key set {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bN*H swu (rN),a*b*H swu (upw)}.

[0079] In the above embodiment, in order to prevent the server from guessing the client's password to be detected through the queried data, the real password to be detected is hidden in a bunch of random passwords, which increases the difficulty for the server to guess the password and improves the security of the password.

[0080] In one embodiment, in step 103, receiving the target data set sent by the server and negotiating a key with the first server includes:

[0081] Receive the negotiated key set and N+1 target data sets sent by the server;

[0082] The N+1 target data sets are determined from P data sets based on the first information and the second information, and the P data sets are obtained based on the server private key and P weak password dictionary sets;

[0083] The negotiated key set includes: the first server negotiated key and N second server negotiated keys, where the N second server negotiated keys are obtained based on the server private key and the N third password information.

[0084] For example, the server sends N+1 target data sets {BKT c1 ,BKT c2 ,…BKT cN ,BKT c}, and the negotiated key set {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bN*H swu (rN),a*b*H swu After receiving the negotiated key set and N+1 target data sets from the server, the client performs the following processing:

[0085] 1. For {BKT c1 ,BKT c2 ,…BKT cN ,BKT c}, multiply the corresponding random number bi to obtain the client negotiated key set R1={b1*BKT c1 ,b2*BKT c2 ,…bx*BKT cx ,b*BKT c}, the value in this set is the client-negotiated key.

[0086] 2. Determine the server-side negotiated key set R2 = {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bx*H swu (rx),a*b*H swu (upw)}.

[0087] 3. Find the intersection of R1 and R2. When it is determined that R1 and R2 have an intersection, the original password value corresponding to the data in the intersection is the weak password dictionary recorded by the server, and the password to be tested entered by the user is determined to be a weak password.

[0088] In one embodiment, when N third password information is obtained based on the client private key and N random passwords, the N random passwords use the same client private key. That is, b = b1 = b2 = ... = bx. In this embodiment, if one password is cracked by the server, all the client passwords will also be cracked.

[0089] In another embodiment, the N third password information is obtained based on the client private key and the N random passwords, including:

[0090] Randomly generate N client private keys;

[0091] Based on the elliptic curve encryption algorithm, the N random passwords are encrypted according to the N client private keys to obtain N third password information; wherein the client private key corresponds to the random password one by one.

[0092] In this embodiment, a client uses multiple private keys, and each password to be verified is different. For example, in the above example, b!=b1!=b2=…!=bx. Here, "!=" is a computer operator, meaning "not equal to." Therefore, in this embodiment, even if one password is cracked by the server, the security of the other passwords is not affected.

[0093] See also Figure 2 The present invention provides a method for detecting weak passwords, which is applied to a server and specifically includes the following steps:

[0094] Step 201: Obtain P data sets based on the server private key and P weak password dictionary sets, wherein the data sets correspond one-to-one to the weak password dictionary sets, and each data set includes at least one second password information; P is a positive integer;

[0095] Exemplarily, the server collects common, leaked weak password dictionaries on the Internet and keeps them updated. To ensure the security of subsequent steps, there should be at least M weak password dictionaries, where M is a preset value. Furthermore, the server uses the same hash algorithm as the client to calculate the hash value corresponding to the weak password dictionary, and uses the first n bytes of the hash value corresponding to the weak password dictionary to divide the weak password dictionary into P weak password dictionary sets. Furthermore, the server encrypts the P weak password dictionary sets separately based on the server private key to obtain P data sets, that is, one data set corresponds to one weak password dictionary set, and each data set includes at least one second password information, and each second password information is obtained by the server private key and a weak password dictionary.

[0096] Step 202: Receive first password information and first information sent by the client, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested.

[0097] Optionally, after receiving the password to be tested (upw) input by the user, the client uses the same hash algorithm as the server to calculate the hash value of the password to be tested, and uses the first n bytes of the hash value of the password to be tested as the first information.

[0098] Step 203: Determine a target data set corresponding to the first information from the P data sets.

[0099] Step 204: Obtain the first server-side negotiated key based on the server-side private key and the first password information.

[0100] Step 205: Send the target data set and the first server-side negotiated key to the client.

[0101] In the above embodiment, after receiving the first password information and the first information sent by the client, the server determines the target data set corresponding to the first information from P data sets based on the first information, and processes the first password information based on the server private key to obtain the first server negotiation key, and sends the first server negotiation key and the target data set to the client.

[0102] Exemplarily, the first password information sent by the client to the server is: b*H(upw), and the first server-negotiated password returned by the server to the client is: a*b*H(upw); wherein upw refers to the password to be tested, H(upw) refers to the processed value corresponding to the password to be tested, a is the server private key, and b is the client private key.

[0103] For example, the target data set corresponding to the first information sent by the server to the client is: BKT c ; The client negotiates the key set obtained by the client based on the target data set and the client private key: b*BKT c ; Since there is more than one data in the target data set, b*BKT c Represents a negotiated key set.

[0104] Among them, the server-side data set corresponding to the weak password dictionary set is: BKT n＝ a*H(pw), where pw refers to the weak password dictionary, H(pw) refers to the processed value corresponding to the weak password dictionary, and a*H(pw) refers to the second password information obtained from the server private key and the weak password dictionary. a is the server private key, and b is the client private key. Thus, the value in the client-negotiated key set is: b*a*H(pw).

[0105] Optionally, to improve security, the server private key may not be fixed, that is, a different random value ai is used for each user, that is, different users use different server private keys, so that even if a malicious client cracks the first password information b*H(upw) it received, it cannot crack the data received by other clients.

[0106] In the above embodiment, during the weak password detection process, the server cannot obtain the password to be tested entered by the user. In this way, when the server verifies whether the user's input password is a weak password, it can ensure that the server cannot obtain the original password entered by the user. The user password is only known by the client itself, avoiding the server from maliciously collecting the user password and improving the security of the password.

[0107] In one embodiment, in step 201 above, P data sets are obtained based on the server private key and P weak password dictionary sets, including:

[0108] For each of the weak password dictionary sets, convert the weak password dictionary into an integer value, and map each of the integer values ​​onto an elliptic curve to obtain a second value;

[0109] Based on the elliptic curve encryption algorithm, the second value is encrypted according to the server private key to obtain the second password information corresponding to each second value, and obtain a data set corresponding to each weak password dictionary set.

[0110] As an optional method, when mapping the integer values ​​corresponding to the weak password dictionary to the elliptic curve, any one of sha256, sha384, sha512, etc. can be used to obtain the hash value of each weak password dictionary and express it as a hexadecimal string. For example, sha256(abcd123456) = 5fae31539e070a690c1b63720c25eb5b86084b5098a942c86c89c1d67157ed6b. Further, the hash values ​​of the weak password dictionaries in the P dictionary sets are processed and converted into integer values. Finally, according to the simple SWU method, the integer value is mapped to a point H on a commonly used elliptic curve (such as P224, P248, P256). swu (pw).

[0111] Specifically, the steps of converting the hash value into an integer include:

[0112] First, use a byte array to represent the hash value, and then translate the entire array into an integer (int). For example, the integer corresponding to 5fae31539e070a690c1b63720c25eb5b86084b5098a942c86c89c1d67157ed6b is:

[0113] 43277492444570550325322311094995103653756177751910488060832908287034657336683.

[0114] In this embodiment, based on the server private key a, the integer value is mapped to a point H on the common elliptic curve swu (pw) after, due to the mapping point H swu (upw) The characteristic of moving a times on the elliptic curve is that if the starting point and the end point are known, it is impossible to infer how many times the movement has been made. In other words, even if two points a*H on the elliptic curve are known swu (pw) and Hswu (pw), nor can the value of a be calculated. Therefore, the client cannot infer the server's private key, ensuring the security of the server's weak password dictionary.

[0115] In one embodiment, in step 202, receiving the first password information and the first information sent by the client includes:

[0116] Receive a first data set and a second data set sent by the client; wherein the first data set includes: the first password information and N third password information, where the N third password information are obtained by combining the client private key and N random passwords; and the second data set includes: the first information and N second information; the second information has a one-to-one correspondence with the random password, and the second information is used to represent a weak password dictionary set corresponding to the random password;

[0117] The above step 205 includes:

[0118] Sending the negotiated key set and N+1 target data sets to the client;

[0119] The N+1 target data sets are determined from the P data sets according to the first information and N pieces of the second information;

[0120] The negotiated key set includes: the first server negotiated key and N second server negotiated keys; the N second server negotiated keys are obtained according to the server private key and the N third password information.

[0121] For example, the client generates N random passwords {r1, r2, ..., rN}, and obtains N third password information {b1*H swu (r1),b2*H swu (r2),…,bN* Hswu (rN)}, and N second information {c1, c2, ..., cN} corresponding to the N random passwords. Finally, the first data set sent by the client to the server is: {b1*H swu (r1),b2*H swu (r2),…,bN*H swu (rN),b*H swu (upw)}; the second data set sent to the server is: {c1,c2,…cN,c}; where b*H swu (upw) is the first password information, and c is the first information. Optionally, N is required to be ≥ 50 to better hide the password that actually needs to be detected.

[0122] Accordingly, the server receives the first data set {b1*Hswu (r1),b2*H swu (r2),…,bx*H swu (rx),b*H swu (upw)}, and the second data set {c1, c2, ... cx, c}, the following processing is performed:

[0123] 1. According to the second data set {c1, c2, ... cN, c}, determine N+1 target data sets from P data sets. That is, according to {c1, c2, ... cN, c}, {BKT c1 ,BKT c2 ,…BKT cN ,BKT c}; Among them, BKT c1 is the target dataset corresponding to c1, ..., BKT cN is the first data set corresponding to cN, BKT c is the target data set corresponding to the first information c.

[0124] 2. The first data set {b1*H swu (r1),b2*H swu (r2),…,bN*H swu (rN),b*H swu Each value in (upw)} is multiplied by the server private key a to get {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bN*H swu (rN),a*b*H swu (upw)}, this set is the negotiated key set on the server side.

[0125] Among them, a*b*H swu (upw) is the first server-side negotiated key, {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bN*H swu (rN)} is the key negotiated by N second servers.

[0126] 3. The server sends N+1 target data sets {BKT c1 ,BKT c2 ,…BKT cN ,BKT c}, and the negotiated key set {a*b1*H swu (r1),a*b2*H swu (r2),…,a*bN*H swu (rN),a*b*Hswu (upw)}.

[0127] In the above embodiment, in order to prevent the server from guessing the client's password to be detected through the queried data, the real password to be detected is hidden in a bunch of random passwords, which increases the difficulty for the server to guess the password and improves the security of the password.

[0128] In one embodiment, in step 201 above, before obtaining P data sets based on the server private key and P weak password dictionary sets, the method further includes:

[0129] Get at least M weak password dictionaries; M is a positive integer;

[0130] Divide the hash values ​​of the at least M weak password dictionaries into P buckets according to the first n bytes of the hash values ​​of the weak password dictionary; wherein P=16 n , one bucket corresponds to one of the weak password dictionary sets, and the number of hash values ​​in each bucket is greater than or equal to 10,000.

[0131] For example, the server collects common and leaked weak password dictionaries on the Internet and keeps them updated. To ensure the security of subsequent steps, the weak password dictionary should have at least M entries, where M is a calibration value. Furthermore, each password in the weak password dictionary is hashed to obtain the corresponding hash value. Based on the first n bytes of the hash value, all weak password dictionaries are divided into 16 n The number of hash values ​​in each bucket is S=M / (16 n ), the identification name of each bucket can be represented by these n bytes.

[0132] Here, in order to ensure the security of subsequent steps, the number of S should be at least ≥ 10000. The specific estimation process is as follows: if 100 million weak password dictionaries are collected, then n should be ≤ 3. In theory, the commonly used hash values ​​are evenly distributed. When n = 3, each bucket has 10000000 / (16 3 )=24414 values, which meets our requirement of ≥10000 above; when n=4, each bucket has 10000000 / (16 4 )=152 values, which does not meet our above requirement of S≥10000.

[0133] The weak password detection method provided in the embodiment of the present application can be executed by a weak password detection device. In the embodiment of the present application, the weak password detection device performing the weak password detection method is used as an example to illustrate the weak password detection device provided in the embodiment of the present application.

[0134] See also Figure 3 The embodiment of the present application provides a weak password detection device 300, which is applied to a client and includes:

[0135] The first processing module 301 is used to obtain first password information according to the password to be tested and the client private key;

[0136] A first sending module 302 is configured to send the first password information and first information to a server, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0137] A first receiving module 303 is configured to receive a target data set and a first server-side negotiated key sent by the server; wherein the target data set includes at least one second password information, and the at least one second password information is obtained based on the weak password dictionary set and the server private key; and the first server-side negotiated key is obtained based on the server private key and the first password information;

[0138] A second processing module 304 is configured to obtain a client negotiated key set according to the target data set and the client private key;

[0139] The first determining module 305 is configured to determine whether the password to be tested is a weak password according to the client-side negotiated key set and the first server-side negotiated key.

[0140] Optionally, the first processing module 301 includes:

[0141] A first processing unit, configured to convert the password to be tested into an integer value;

[0142] A second processing unit, configured to map the integer value onto an elliptic curve to obtain a first value;

[0143] The third processing unit is configured to encrypt the first value according to the client private key based on an elliptic curve encryption algorithm to obtain the first password information.

[0144] Optionally, the apparatus 300 further includes:

[0145] A third processing module is configured to obtain N third password information according to the client private key and N random passwords, where N is a positive integer;

[0146] The first sending module 302 includes:

[0147] A first sending submodule, configured to send a first data set and a second data set to the server;

[0148] Among them, the first data set includes: the first password information and the N third password information; the second data set includes: the first information and N second information; the second information corresponds one-to-one to the random password, and the second information is used to represent the weak password dictionary set corresponding to the random password.

[0149] Optionally, the first receiving module 303 includes:

[0150] A first receiving submodule is configured to receive the negotiated key set and N+1 target data sets sent by the server;

[0151] The N+1 target data sets are determined from P data sets based on the first information and the second information, and the P data sets are obtained based on the server private key and P weak password dictionary sets;

[0152] The negotiated key set includes: the first server negotiated key and N second server negotiated keys, where the N second server negotiated keys are obtained based on the server private key and the N third password information.

[0153] The weak password detection device in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices other than the terminal. Exemplary, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a palmtop computer, an in-vehicle electronic device, a mobile internet device (Mobile Internet Device, MID), augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) equipment, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., and the embodiment of the present application is not specifically limited.

[0154] The weak password detection device in the embodiment of the present application can be a device having an operating system. The operating system can be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0155] The weak password detection device provided in the embodiment of the present application can achieve Figure 1 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0156] See also Figure 4 The embodiment of the present application provides a weak password detection device 400, which is applied to a server and includes:

[0157] A fourth processing module 401 is configured to obtain P data sets based on the server private key and P weak password dictionary sets, wherein the data sets correspond one-to-one to the weak password dictionary sets, and each data set includes at least one second password information; P is a positive integer;

[0158] The second receiving module 402 is configured to receive first password information and first information sent by the client, wherein the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0159] A second determining module 403 is configured to determine a target data set corresponding to the first information from the P data sets;

[0160] A fifth processing module 404 is configured to obtain a first server-side negotiated key based on the server-side private key and the first password information;

[0161] The second sending module 405 is configured to send the target data set and the first server-side negotiated key to the client.

[0162] Optionally, the fourth processing module 401 includes:

[0163] a fourth processing unit, configured to convert the weak password dictionary into an integer value for each of the weak password dictionary sets, and map each of the integer values ​​onto an elliptic curve to obtain a second value;

[0164] The fifth processing unit is used to encrypt the second value according to the server private key based on the elliptic curve encryption algorithm, obtain the second password information corresponding to each second value, and obtain a data set corresponding to each weak password dictionary set.

[0165] Optionally, the second receiving module 402 includes:

[0166] a first receiving submodule, configured to receive a first data set and a second data set sent by the client; wherein the first data set includes: the first password information and N third password information, wherein the N third password information are obtained by combining the client private key and N random passwords; and the second data set includes: the first information and N second information; the second information has a one-to-one correspondence with the random password, and the second information is used to represent a weak password dictionary set corresponding to the random password;

[0167] The second sending module 405 includes:

[0168] A second sending submodule, configured to send the negotiated key set and N+1 target data sets to the client;

[0169] The N+1 target data sets are determined from the P data sets according to the first information and N pieces of the second information;

[0170] The negotiated key set includes: the first server negotiated key and N second server negotiated keys; the N second server negotiated keys are obtained according to the server private key and the N third password information.

[0171] Optionally, the apparatus 400 further includes:

[0172] The acquisition module is used to obtain at least M weak password dictionaries; M is a positive integer;

[0173] The sixth processing module is used to divide the hash values ​​of the at least M weak password dictionaries into P buckets according to the first n bytes of the hash values ​​of the weak password dictionary; wherein P =

[16] ^n, one bucket corresponds to one weak password dictionary set, and the number of hash values ​​in each bucket is greater than or equal to 10,000.

[0174] The weak password detection device in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices other than the terminal. Exemplary, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a palmtop computer, an in-vehicle electronic device, a mobile internet device (Mobile Internet Device, MID), augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) equipment, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., and the embodiment of the present application is not specifically limited.

[0175] The weak password detection device in the embodiment of the present application can be a device having an operating system. The operating system can be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0176] The weak password detection device provided in the embodiment of the present application can achieve Figure 2 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0177] Alternatively, as Figure 5 As shown, the embodiment of the present application further provides an electronic device 500, wherein the electronic device serves as a client. It includes a processor 501 and a memory 502. The memory 502 stores a program or instruction that can be executed on the processor 501. When the program or instruction is executed by the processor 501, each step of the above-mentioned weak password detection method embodiment is implemented and can achieve the same technical effect. To avoid repetition, it is not repeated here.

[0178] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0179] Figure 6 The following is a schematic diagram of the hardware structure of an electronic device for implementing an embodiment of the present application, wherein the electronic device serves as a client.

[0180] The electronic device 600 includes but is not limited to components such as a radio frequency unit 601 , a network module 602 , an audio output unit 603 , an input unit 604 , a sensor 605 , a display unit 606 , a user input unit 607 , an interface unit 608 , a memory 609 , and a processor 610 .

[0181] Those skilled in the art will understand that the electronic device 600 may also include a power source (such as a battery) to power each component, and the power source may be logically connected to the processor 110 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system. Figure 6 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be repeated here.

[0182] The processor 610 is configured to obtain first password information based on the password to be tested and the client private key;

[0183] The radio frequency unit 601 is configured to send the first password information and first information to the server, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0184] The radio frequency unit 601 is further configured to receive a target data set and a first server-side negotiated key sent by the server; wherein the target data set includes at least one second password information, and the at least one second password information is obtained based on the weak password dictionary set and the server private key; and the first server-side negotiated key is obtained based on the server private key and the first password information;

[0185] The processor 610 is further configured to obtain a client negotiated key set based on the target data set and the client private key; and determine whether the password to be tested is a weak password based on the client negotiated key set and the first server negotiated key.

[0186] Optionally, the processor 610 is specifically configured to:

[0187] Convert the password to be tested into an integer value;

[0188] Mapping the integer value onto an elliptic curve to obtain a first value;

[0189] Based on the elliptic curve encryption algorithm, the first value is encrypted according to the client private key to obtain the first password information.

[0190] Optionally, the processor 610 is further configured to:

[0191] Obtain N third password information based on the client private key and N random passwords; N is a positive integer;

[0192] The radio frequency unit 601 is further specifically configured to:

[0193] Sending a first data set and a second data set to the server;

[0194] Among them, the first data set includes: the first password information and the N third password information; the second data set includes: the first information and N second information; the second information corresponds one-to-one to the random password, and the second information is used to represent the weak password dictionary set corresponding to the random password.

[0195] Optionally, the radio frequency unit 601 is further configured to:

[0196] Receive the negotiated key set and N+1 target data sets sent by the server;

[0197] The N+1 target data sets are determined from P data sets based on the first information and the second information, and the P data sets are obtained based on the server private key and P weak password dictionary sets;

[0198] The negotiated key set includes: the first server negotiated key and N second server negotiated keys, where the N second server negotiated keys are obtained based on the server private key and the N third password information.

[0199] In the above electronic device, during the weak password detection process, the server cannot obtain the password to be tested entered by the user. The user password is only known to the user himself, which avoids the server from maliciously collecting the user password and improves the security of the server.

[0200] It should be understood that in an embodiment of the present application, the input unit 604 may include a graphics processing unit (GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 606 may include a display panel 6061, and the display panel 6061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 607 includes a touch panel 6071 and at least one of other input devices 6072. The touch panel 6071 is also called a touch screen. The touch panel 6071 may include two parts: a touch detection device and a touch controller. Other input devices 6072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0201] The memory 609 can be used to store software programs and various data. The memory 609 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, applications or instructions required for at least one function (such as a sound playback function, an image playback function, etc.). In addition, the memory 609 may include a volatile memory or a non-volatile memory, or the memory 609 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM), and a direct memory bus random access memory (DRRAM). The memory 609 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0202] Processor 610 may include one or more processing units. Optionally, processor 610 integrates an application processor and a modem processor. The application processor primarily handles operations related to the operating system, user interface, and application programs, while the modem processor primarily processes wireless communication signals, such as a baseband processor. It is understood that the modem processor may not be integrated into processor 610.

[0203] Alternatively, as Figure 7 As shown, an embodiment of the present application also provides a server 700, including a processor 701 and a memory 702, and the memory 702 stores a program or instruction that can be run on the processor 701. When the program or instruction is executed by the processor 701, the various steps of the weak password detection method embodiment on the above-mentioned server side are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0204] It should be noted that the server in the embodiment of the present application includes the mobile server and non-mobile server mentioned above.

[0205] Figure 8 A schematic diagram of the hardware structure of a server for implementing an embodiment of the present application.

[0206] The server 800 includes but is not limited to components such as a radio frequency unit 801 , a network module 802 , an audio output unit 803 , an input unit 804 , a sensor 805 , a display unit 806 , a user input unit 807 , an interface unit 808 , a memory 809 , and a processor 810 .

[0207] Those skilled in the art will understand that the server 800 may also include a power supply (such as a battery) to power each component, and the power supply may be logically connected to the processor 810 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system. Figure 8 The server structure shown in the figure does not constitute a limitation on the server. The server may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be repeated here.

[0208] The processor 810 is configured to obtain P data sets based on the server private key and P weak password dictionary sets, wherein the data sets correspond one-to-one to the weak password dictionary sets, and each data set includes at least one second password information; P is a positive integer;

[0209] The radio frequency unit 801 is configured to receive first password information and first information sent by a client, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested;

[0210] The processor 810 is further configured to determine a target data set corresponding to the first information from the P data sets; and obtain a first server-side negotiated key based on the server-side private key and the first password information.

[0211] The radio frequency unit 801 is further configured to send the target data set and the first server-side negotiated key to the client.

[0212] Optionally, the processor 810 is specifically configured to:

[0213] For each of the weak password dictionary sets, convert the weak password dictionary into an integer value, and map each of the integer values ​​onto an elliptic curve to obtain a second value;

[0214] Based on the elliptic curve encryption algorithm, the second value is encrypted according to the server private key to obtain the second password information corresponding to each second value, and obtain a data set corresponding to each weak password dictionary set.

[0215] Optionally, the radio frequency unit 801 is further configured to:

[0216] Receive a first data set and a second data set sent by the client; wherein the first data set includes: the first password information and N third password information, where the N third password information are obtained by combining the client private key and N random passwords; and the second data set includes: the first information and N second information; the second information has a one-to-one correspondence with the random password, and the second information is used to represent a weak password dictionary set corresponding to the random password;

[0217] Sending the negotiated key set and N+1 target data sets to the client;

[0218] The N+1 target data sets are determined from the P data sets according to the first information and N pieces of the second information;

[0219] The negotiated key set includes: the first server negotiated key and N second server negotiated keys; the N second server negotiated keys are obtained according to the server private key and the N third password information.

[0220] Optionally, the processor 810 is further configured to:

[0221] Get at least M weak password dictionaries; M is a positive integer;

[0222] Divide the hash values ​​of the at least M weak password dictionaries into P buckets according to the first n bytes of the hash values ​​of the weak password dictionary; wherein P=16 n , one bucket corresponds to one of the weak password dictionary sets, and the number of hash values ​​in each bucket is greater than or equal to 10,000.

[0223] In the above server, during the weak password detection process, the server cannot obtain the password to be tested entered by the user. In this way, when the server verifies whether the user's input password is a weak password, it can ensure that the server cannot obtain the original password entered by the user. The user password is only known to the user himself, avoiding the server from maliciously collecting the user password and improving the security of the password.

[0224] It should be understood that in an embodiment of the present application, the input unit 804 may include a graphics processing unit (GPU) 8041 and a microphone 8042, and the graphics processor 8041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 806 may include a display panel 8061, and the display panel 8061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 807 includes a touch panel 8071 and at least one of other input devices 8072. The touch panel 8071 is also called a touch screen. The touch panel 8071 may include two parts: a touch detection device and a touch controller. Other input devices 8072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and an operating stick, which will not be repeated here.

[0225] The memory 809 can be used to store software programs and various data. The memory 809 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, applications or instructions required for at least one function (such as a sound playback function, an image playback function, etc.). In addition, the memory 809 may include a volatile memory or a non-volatile memory, or the memory 809 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 809 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0226] Processor 810 may include one or more processing units. Optionally, processor 810 integrates an application processor and a modem processor. The application processor primarily handles operations related to the operating system, user interface, and application programs, while the modem processor primarily processes wireless communication signals, such as a baseband processor. It is understood that the modem processor may not be integrated into processor 810.

[0227] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by the processor, the various processes of the above-mentioned weak password detection method embodiment on the client side or the server side are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0228] The processor is the processor in the electronic device or server described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0229] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned weak password detection method embodiment on the client side or the server side, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0230] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0231] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the weak password detection method embodiment on the client side or the server side as described above, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0232] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0233] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0234] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A weak password detection method, characterized in that: Applied to the client, including: Obtaining first password information according to the password to be tested and the client private key; Sending the first password information and first information to the server, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested; receiving a target data set and a first server-side negotiated key sent by the server, wherein the target data set includes at least one second password information, the at least one second password information is obtained based on the weak password dictionary set and the server private key, and the first server-side negotiated key is obtained based on the server private key and the first password information; Obtaining a client negotiated key set according to the target data set and the client private key; Determine whether the password to be tested is a weak password based on the client-side negotiated key set and the first server-side negotiated key.

2. The weak password detection method according to claim 1, characterized in that: The step of obtaining the first password information according to the password to be tested and the client private key includes: Convert the password to be tested into an integer value; Mapping the integer value onto an elliptic curve to obtain a first value; Based on the elliptic curve encryption algorithm, the first value is encrypted according to the client private key to obtain the first password information.

3. The weak password detection method according to claim 1, characterized in that: The method further comprises: Obtain N third password information based on the client private key and N random passwords, where N is a positive integer; The sending the first password information and the first information to the server includes: Sending a first data set and a second data set to the server; Among them, the first data set includes: the first password information and the N third password information; the second data set includes: the first information and N second information; the second information corresponds one-to-one to the random password, and the second information is used to represent the weak password dictionary set corresponding to the random password.

4. The weak password detection method according to claim 3, characterized in that: The receiving the target data set sent by the server and negotiating a key with the first server includes: Receive the negotiated key set and N+1 target data sets sent by the server; The N+1 target data sets are determined from P data sets based on the first information and the second information, and the P data sets are obtained based on the server private key and P weak password dictionary sets; The negotiated key set includes: the first server negotiated key and N second server negotiated keys, where the N second server negotiated keys are obtained based on the server private key and the N third password information.

5. A weak password detection method, characterized in that: Applied to the server, including: Obtaining P data sets based on the server private key and P weak password dictionary sets, wherein the data sets correspond one-to-one to the weak password dictionary sets, and each data set includes at least one second password information; P is a positive integer; Receiving first password information and first information sent by a client, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested; Determining a target data set corresponding to the first information from the P data sets; Obtaining a first server-side negotiated key based on the server-side private key and the first password information; Send the target data set to the client and negotiate a key with the first server.

6. The weak password detection method according to claim 5, characterized in that: According to the server private key and P weak password dictionary sets, P data sets are obtained, including: For each of the weak password dictionary sets, convert the weak password dictionary into an integer value, and map each of the integer values ​​onto an elliptic curve to obtain a second value; Based on the elliptic curve encryption algorithm, the second value is encrypted according to the server private key to obtain the second password information corresponding to each second value, and obtain a data set corresponding to each weak password dictionary set.

7. The weak password detection method according to claim 5, characterized in that: The receiving the first password information and the first information sent by the client includes: Receiving a first data set and a second data set sent by the client, wherein the first data set includes: the first password information and N third password information, where the N third password information are obtained by using the client private key and N random passwords; and the second data set includes: the first information and N second information, where the second information corresponds one-to-one to the random passwords, and the second information is used to represent a weak password dictionary set corresponding to the random passwords; The sending the target data set to the client and negotiating a key with the first server includes: Sending the negotiated key set and N+1 target data sets to the client; The N+1 target data sets are determined from the P data sets according to the first information and N pieces of the second information; The negotiated key set includes: the first server negotiated key and N second server negotiated keys; the N second server negotiated keys are obtained according to the server private key and the N third password information.

8. The weak password detection method according to claim 5, characterized in that: Before obtaining the P data sets based on the server private key and the P weak password dictionary sets, the method further includes: Get at least M weak password dictionaries; M is a positive integer; Divide the hash values ​​of the at least M weak password dictionaries into P buckets according to the first n bytes of the hash values ​​of the weak password dictionary; wherein P=16 n , one bucket corresponds to one of the weak password dictionary sets, and the number of hash values ​​in each bucket is greater than or equal to 10,000.

9. A weak password detection device, characterized in that: Applied to the client, including: A first processing module is used to obtain first password information according to the password to be tested and the client private key; A first sending module is configured to send the first password information and first information to a server, where the first information is used to represent a weak password dictionary set corresponding to the password to be tested; a first receiving module, configured to receive a target data set and a first server-side negotiated key sent by the server, wherein the target data set includes at least one second password information, the at least one second password information is obtained based on the weak password dictionary set and the server private key, and the first server-side negotiated key is obtained based on the server private key and the first password information; A second processing module, configured to obtain a client negotiated key set according to the target data set and the client private key; The first determining module is configured to determine whether the password to be tested is a weak password based on the client-side negotiated key set and the first server-side negotiated key.

10. The weak password detection device according to claim 9, characterized in that: The first processing module includes: A first processing unit, configured to convert the password to be tested into an integer value; A second processing unit, configured to map the integer value onto an elliptic curve to obtain a first value; The third processing unit is configured to encrypt the first value according to the client private key based on an elliptic curve encryption algorithm to obtain the first password information.

11. The weak password detection device according to claim 9, characterized in that: The device further comprises: A third processing module is configured to obtain N third password information according to the client private key and N random passwords, where N is a positive integer; The first sending module includes: A first sending submodule, configured to send a first data set and a second data set to the server; Among them, the first data set includes: the first password information and the N third password information; the second data set includes: the first information and N second information; the second information corresponds one-to-one to the random password, and the second information is used to represent the weak password dictionary set corresponding to the random password.

12. The weak password detection device according to claim 11, characterized in that: The first receiving module includes: A first receiving submodule is configured to receive the negotiated key set and N+1 target data sets sent by the server; The N+1 target data sets are determined from P data sets based on the first information and the second information, and the P data sets are obtained based on the server private key and P weak password dictionary sets; The negotiated key set includes: the first server negotiated key and N second server negotiated keys, where the N second server negotiated keys are obtained based on the server private key and the N third password information.

13. A weak password detection device, characterized in that: Applied to the server, including: a fourth processing module, configured to obtain P data sets based on the server private key and the P weak password dictionary sets, wherein the data sets correspond one-to-one to the weak password dictionary sets, and each data set includes at least one second password information; P is a positive integer; A second receiving module is configured to receive first password information and first information sent by a client, wherein the first information is used to represent a weak password dictionary set corresponding to the password to be tested; A second determining module is configured to determine a target data set corresponding to the first information from the P data sets; a fifth processing module, configured to obtain a first server-side negotiated key based on the server-side private key and the first password information; The second sending module is configured to send the target data set and the first server-side negotiated key to the client.

14. The weak password detection device according to claim 13, characterized in that: The fourth processing module includes: a fourth processing unit, configured to convert the weak password dictionary into an integer value for each of the weak password dictionary sets, and map each of the integer values ​​onto an elliptic curve to obtain a second value; The fifth processing unit is used to encrypt the second value according to the server private key based on the elliptic curve encryption algorithm, obtain the second password information corresponding to each second value, and obtain a data set corresponding to each weak password dictionary set.

15. The weak password detection device according to claim 13, characterized in that: The second receiving module includes: a first receiving submodule, configured to receive a first data set and a second data set sent by the client, wherein the first data set includes: the first password information and N third password information, where the N third password information are obtained by using the client private key and N random passwords; and the second data set includes: the first information and N second information, where the second information corresponds one-to-one to the random passwords, and the second information is used to represent a weak password dictionary set corresponding to the random passwords; The second sending module includes: A second sending submodule, configured to send the negotiated key set and N+1 target data sets to the client; The N+1 target data sets are determined from the P data sets according to the first information and N pieces of the second information; The negotiated key set includes: the first server negotiated key and N second server negotiated keys; the N second server negotiated keys are obtained according to the server private key and the N third password information.

16. The weak password detection device according to claim 13, characterized in that: The device further comprises: The acquisition module is used to obtain at least M weak password dictionaries; M is a positive integer; The sixth processing module is configured to divide the hash values ​​of the at least M weak password dictionaries into P buckets according to the first n bytes of the hash values ​​of the weak password dictionary; wherein P=16 n , one bucket corresponds to one of the weak password dictionary sets, and the number of hash values ​​in each bucket is greater than or equal to 10,000.

17. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the weak password detection method according to any one of claims 1 to 4 are implemented.

18. A server, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the weak password detection method according to any one of claims 5 to 8 are implemented.

19. A readable storage medium, characterized in that The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the weak password detection method according to any one of claims 1 to 4 are implemented, or the steps of the weak password detection method according to any one of claims 5 to 8 are implemented.

Images