User password strength evaluation method based on password reuse and cosine similarity

Abstract

The present invention discloses a method for evaluating the strength of user passwords based on password reuse and cosine similarity. The present invention evaluates the strength of passwords by introducing personalized user-determined password policies and password reuse based on user behavior. First, the website customizes and adjusts the password policy and the cosine similarity standard value range according to the user's choice of account importance and usage purpose; then, the passwords that the user attempts to design are stored as a basic password data set, and the reuse degree of the password is judged based on the cosine similarity between the newly designed password and the basic password data set, and the security and availability of the password are ensured based on the cosine similarity of the password and the importance of the account, effectively feeding back the password reuse behavior of the user, and greatly alleviating the threat of directional or roaming password guessing to the user account caused by large-scale password leakage.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular is a user password strength evaluation method based on password reuse and cosine similarity. Background Art

[0002] Passwords are widely used in identity authentication due to their convenience and simple operation process. Passwords are also the first line of defense to ensure the security of digital identities. Studies have shown that users tend to choose simple passwords that are easy to remember, and currently 45% to 61% of users reuse passwords. In recent years, password leaks have occurred frequently and are not easy to detect. In addition, based on the user's password reuse behavior, based on the leaked password data set, the directional password guessing algorithm and the wandering password guessing algorithm are used to attack the user's other platform accounts, posing a great threat to the user's account and property security.

[0003] To address this problem, ensure the password security of user accounts, and improve the ability of user accounts to resist attacks such as directional guessing and random guessing, many online services have adopted password complexity strategies (for example, passwords must be longer than 8 characters and contain both uppercase and lowercase letters and at least one number) or introduced password strength assessments to test the strength of users' passwords to help users assess the security of their passwords. Relevant research shows that by implementing these password strategies and using password strength meters, users can be encouraged to design and use longer passwords that are more complex and secure, and effectively improve the security of their accounts.

[0004] However, the current password strength assessment results are not only inaccurate, but also the password strength assessment structures of different websites are inconsistent, which confuses users about the password strength. Users rely more on the strength feedback and text prompts of the website when designing passwords to improve the strength of passwords. In the past, common password strength assessment meters included password entropy, which judged the security of passwords by calculating the entropy value of users' passwords; there were also common password strength based on password rules, which calculated the length of passwords and the types of characters contained in them to calculate the strength of passwords; these password strength meters judged some simple passwords as strong passwords by character substitution, but these behaviors of over-estimating password strength could not resist the guessing of powerful attackers.

[0005] Therefore, in order to solve these problems, researchers have proposed more password strength assessment models based on probability and password guessing numbers. For example, the paper "Golla M, Dürmuth M. On the accuracy of password strength meters [C] / / Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. 2018: 1567-1582." designed a single indicator (i.e., weighted Spearman correlation coefficient, which is only applicable to online guessing scenarios) to measure the accuracy of PSM (Password Strength Meter) and compared 45 PSMs on only three English password data sets. This method cannot make up for the language gap, but it improves the accuracy of password strength assessment.

[0006] Complex password strength estimators cannot be effectively deployed on the client due to their computational time and space complexity. The paper "Wheeler D L.zxcvbn:{Low-Budget}Password Strength Estimation[C] / / 25th USENIX Security Symposium(USENIX Security 16).2016:157-173." can effectively solve the deployment problem of password strength meters. However, the zxcvbn password strength meter cannot test the user's password reuse behavior, but can only calculate the number of password guesses for the user's input password under the current model.

[0007] At the same time, there is still a problem: different social group accounts cannot know each other's account passwords of the same user stored on each other's websites, so it is impossible to ensure that users do not reuse passwords on different platforms. To solve this problem, most websites have adopted a second-best method, which is to use the leaked passwords to detect whether the user's newly registered password is the same as the leaked password. However, this method still cannot provide clear password reuse similarity results.

[0008] Therefore, it is urgent to design a password strength assessment method that takes user password reuse into consideration. Summary of the invention

[0009] In view of the deficiencies in the prior art, the technical problem to be solved by the present invention is to provide a method for evaluating the strength of user passwords based on password reuse and cosine similarity.

[0010] The technical solution of the present invention to solve the technical problem is to provide a user password strength evaluation method based on password reuse and cosine similarity, characterized in that the method comprises the following steps:

[0011] Step 1: When a user registers an account on the client of the website, the client of the website requires the user to select the importance and purpose of the account; then, the importance score of the account is obtained according to the importance and purpose of the account selected by the user; then, different account importance scores are mapped to obtain the cosine similarity standard value ranges of different account importance scores that meet the password strength requirements;

[0012] Step 2: The client of the website guides the user to design a password according to the password policy. The user designs a password according to the password policy and submits a registration request. The client of the website performs a security test on the password designed by the user. During the password security test, the client of the website continuously collects and stores the password designed by the user and the modified password to form a basic password data set DataSet.

[0013] Step 3: Perform a password reuse test. The user enters a newly designed password password_new. The website client calculates the cosine similarity between password_new and each password in the basic password data set DataSet obtained in step 2, and obtains the respective cosine similarity calculation values ​​between password_new and each password in the basic password data set DataSet. The maximum value of the cosine similarity calculation value is then compared with the upper limit of the cosine similarity standard value range corresponding to the different account importance scores obtained in step 1 to determine whether the reuse degree of password password_new is qualified. If the reuse degree is qualified, the password strength of password_new is qualified, the registration conditions are met, and registration is allowed. If the reuse degree is unqualified, registration is rejected.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] (1) The present invention evaluates the strength of passwords by introducing personalized user-determined password policies and password reuse based on user behavior. First, the website customizes the password policy and the cosine similarity standard value range according to the user's choice of account importance and usage purpose; then the passwords that the user attempts to design are stored as the basic password data set, and the reuse degree of the password is judged based on the cosine similarity between the newly designed password and the basic password data set. The security and availability of the password are ensured based on the cosine similarity of the password and the importance of the account, effectively feeding back the user's password reuse behavior, and greatly alleviating the threat of user accounts being subject to directed or roaming password guessing due to large-scale password leaks.

[0016] (2) The present invention improves the security and usability of passwords by allowing users to independently select the strictness of password policies and a reuse detection method based on user password creation behavior. Users can customize password policies according to personal needs, allowing users to customize the cosine similarity standard value range according to their own needs and the importance of their accounts, thereby improving the security and usability of account password registration. At the same time, the cosine similarity algorithm is used to measure the degree of password reuse. Experimental results show that the present invention has excellent results in password reuse detection, improves the password reuse effect, and has good deployability and robustness. Users can modify passwords according to their account security intentions or select password registration rules that meet their needs. In summary, the present invention provides a method for comprehensively optimizing password security and usability, making passwords more secure and reliable, and reducing the success rate of directed and wandering guessing attacks.

[0017] (3) The present invention changes the password detection behavior that was originally based on the password leakage data set to a method based on the current user password behavior habits. By collecting and storing user password registration data, accurate evaluation is performed based on the user's password reuse behavior, providing a more accurate evaluation of targeted user account password information. By calculating the cosine similarity between the user's current password and the previously collected user password, the user's cosine similarity standard value range is dynamically adjusted. By collecting the user's security intentions and calculating possible password reuse parameters, the password reuse behavior of users under important accounts is reduced. The password reuse algorithm based on user behavior of the present invention overcomes the lack of password reuse behavior calculation in previous password strength meters, accurately collects the password set that the user may currently use, and makes up for the shortcomings of inaccurate passwords in the cases provided by password leakage.

[0018] (4) The present invention uses a cosine similarity algorithm to measure the degree of password reuse by users, and combines the password reconstruction and modification behaviors of users, and calculates the cosine similarity between user passwords in pairs, thereby realizing real-time calculation and feedback of user password reuse behaviors. This method can accurately calculate the similarity between passwords, and balance the security and availability of passwords in combination with the number of password modifications of users. Experimental results show that the present invention has the best effect in evaluating users who have password reuse behavior. Under the same experimental environment, compared with the directional guessing password strength meter based on the leaked password data set, the password reuse effect of the present invention is improved by an average of 58%. In addition, compared with other large-scale password strength algorithm models, the present invention has the best deployability and robustness.

[0019] (5) The present invention takes into account the personalized needs of users and dynamically adjusts the range of cosine similarity standard values ​​according to the user's account usage intention. The system provides feedback to the user on the password reuse risk level and provides corresponding password reuse degree assessment for accounts with different security requirements, so that users can modify passwords according to their account security intentions or directly register and use the current password. In addition, the present invention collects the user's registration intention at the beginning of the user password registration through personalized customization, and provides different security standards by category to help users design passwords that meet their security and usability requirements.

[0020] (6) Compared with other password strength meters, the present invention has the following characteristics: it can be easily and quickly deployed on the front-end interface of the client, without relying on large servers and computing models; it is not affected by the timeliness and directional significance of leaked passwords, and is completely based on the user's current password behavior and password design content; it has fast calculation, lightweight model, simple parameters, and can provide timely feedback to users. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is the overall flow chart of the present invention;

[0022] Figure 2 An interface for selecting the importance and usage of an account for a user of the present invention;

[0023] Figure 3 A schematic diagram of password checking based on password policy of the present invention;

[0024] Figure 4 A schematic diagram of password checking based on a password blacklist of the present invention;

[0025] Figure 5 A schematic diagram of password checking based on password reuse of the present invention;

[0026] Figure 6 This is a schematic diagram of successful registration of a user of the present invention. DETAILED DESCRIPTION

[0027] The specific embodiments of the present invention are given below. The specific embodiments are only used to further illustrate the present invention in detail and do not limit the protection scope of the present invention.

[0028] The present invention provides a method for evaluating the strength of user passwords based on password reuse and cosine similarity (hereinafter referred to as the method), characterized in that the method comprises the following steps:

[0029] Step 1: When a user registers an account on the website's client, the website's client requires the user to select the importance and purpose of the account (such as Figure 2As shown); then, according to the importance and usage of the account selected by the user, the importance score of the account is obtained; then, different account importance scores are mapped to obtain the cosine similarity standard value range (referred to as the cosine similarity standard value range) of different account importance scores that meet the password strength requirements;

[0030] Preferably, in step 1, the importance of the account is a single choice, and the purpose of use of the account is an indefinite choice (ie, at least one is selected).

[0031] Preferably, in step 1, the importance of the account is divided into high importance, medium importance and low importance, wherein the score of high importance is 1 point, the score of medium importance is 0.5 points, and the score of low importance is 0 points.

[0032] Preferably, in step 1, the importance score of the account = 50% × the value of the importance of the account + 10% × the number of uses of the account.

[0033] Preferably, in step 1, the usage of the account includes financial transactions, information storage, social interaction, activity detection, leisure and entertainment, personalized experience, shopping and transactions, and content management.

[0034] Preferably, in step 1, when the importance score of the account is greater than 0.5, it indicates that the account is an important account, and the corresponding cosine similarity standard value range that meets the password strength requirement is [0, 25%); when the importance score of the account is [0.25-0.5] (i.e. greater than or equal to 0.25 and less than or equal to 0.5), it indicates that the account is a generally important account, and the corresponding cosine similarity standard value range that meets the password strength requirement is [0, 50%]; when the importance score of the account is less than 0.25, it indicates that the account is an unimportant account, and the corresponding cosine similarity standard value range that meets the password strength requirement is [0, 75%].

[0035] Step 2: The client of the website guides the user to design a password according to the password policy. The user designs a password according to the password policy and submits a registration request. The client of the website performs a security test on the password designed by the user. During the password security test, the client of the website continuously collects and stores the password designed by the user and the modified password to form a basic password data set DataSet.

[0036] Preferably, in step 2, the password policy is that the password length is at least 8 characters and contains uppercase letters (AZ), lowercase letters (az), numbers (0-9) and special symbols (for example: !@#$%^&*).

[0037] Preferably, in step 2, the specific steps of the safety test are as follows:

[0038] S2.1. Determine whether the password complies with the password policy requirements: If the password does not comply with the password policy requirements, the website client will refuse to register, prompt the user and ask the user to redesign a password that complies with the password policy requirements (e.g. Figure 3 When the password meets the requirements of the password policy, the password is marked as password_1 and stored in the basic password data set DataSet;

[0039] Preferably, in step S2.1, the prompt includes that the password length does not meet 8 characters or the password lacks certain character composition types.

[0040] S2.2, for password_1, the client refuses to register and prompts that the password is included in the password blacklist, requiring the user to change to a more secure password (such as Figure 4 As shown); then the password changed by the user is marked as password_2 and stored in the basic password data set DataSet;

[0041] S2.3. For password_2, the client refuses to register and prompts that the password has been reused, requiring the user to change to a more secure password (such as Figure 5 As shown); then the password changed by the user is marked as password_3 and stored in the basic password data set DataSet;

[0042] S2.4. Repeat steps S2.1 to S2.3 to obtain the basic password data set DataSet.

[0043] Preferably, in step 2, the password blacklist of the client of the website is selected from the first one thousand most frequently used passwords in the publicly leaked password data set.

[0044] Step 3: Perform a password reuse test. The user enters a newly designed password password_new. The client of the website calculates the cosine similarity between password_new and each password in the basic password data set DataSet obtained in step 2, and obtains the respective cosine similarity calculation values ​​between password_new and each password in the basic password data set DataSet. The maximum value of the cosine similarity calculation value is then compared with the upper limit of the cosine similarity standard value range corresponding to the different account importance scores obtained in step 1 to determine whether the reuse degree of password password_new is qualified. If the reuse degree is qualified, the password strength of password_new is qualified and meets the registration conditions, and registration is allowed (such as Figure 6 If the reuse level is not satisfactory, registration will be refused.

[0045] Preferably, in step 3, it is determined whether the reuse degree of the password password_new is qualified, and the specific operation is as follows:

[0046] max(Cos-similarity1, Cos-similarity2, …, Cos-similarity n) < 0.25 (i.e., the upper limit of the cosine similarity standard value range that meets the password strength requirements for important accounts), then the reuse degree of password_new is qualified, and thus the password strength of password_new is qualified, meeting the registration conditions, and registration is allowed; otherwise, registration is not allowed;

[0047] max(Cos-similarity1, Cos-similarity2, …, Cos-similarity n)≤0.5 (i.e., the upper limit of the cosine similarity standard value range that meets the password strength requirements for generally important accounts) and the account is a generally important account or an unimportant account, then the reuse degree of password_new is qualified, and thus the password strength of password_new is qualified, and the registration conditions are met, and registration is allowed; otherwise, registration is not allowed;

[0048] max(Cos-similarity1, Cos-similarity2, …, Cos-similarity n)≤0.75 (i.e., the upper limit of the cosine similarity standard value range that meets the password strength requirement for unimportant accounts) and the account is an unimportant account, then the reuse degree of password_new is qualified, and thus the password strength of password_new is qualified, and the registration conditions are met, and registration is allowed; otherwise, registration is not allowed;

[0049] Among them, Cos-similarity1=cosine similarity (password_1, password_new), which represents the calculated value of cosine similarity between password password_new and password password_1 in the basic password data set DataSet; Cos-similarity n=cosine similarity (password_n, password_new), which represents the calculated value of cosine similarity between password password_new and password password_n in the basic password data set DataSet.

[0050] Any matters not described in the present invention are applicable to the prior art.

Claims

1. A method for evaluating the strength of user passwords based on password reuse and cosine similarity, characterized in that: The method comprises the following steps: Step 1: When a user registers an account on the client of the website, the client of the website requires the user to select the importance and purpose of the account; then, the importance score of the account is obtained according to the importance and purpose of the account selected by the user; then, different account importance scores are mapped to obtain the cosine similarity standard value ranges of different account importance scores that meet the password strength requirements; Step 2: The client of the website guides the user to design a password according to the password policy. The user designs a password according to the password policy and submits a registration request. The client of the website performs a security test on the password designed by the user. During the password security test, the client of the website continuously collects and stores the password designed by the user and the modified password to form a basic password data set DataSet. Step 3: Perform a password reuse test. The user enters a newly designed password password_new. The client of the website calculates the cosine similarity between password_new and each password in the basic password data set DataSet obtained in step 2, and obtains the respective cosine similarity calculation values ​​between password_new and each password in the basic password data set DataSet. The maximum value of the cosine similarity calculation value is then compared with the upper limit of the cosine similarity standard value range corresponding to the different account importance scores obtained in step 1 to determine whether the reuse degree of password password_new is qualified. If the reuse degree is qualified, the password strength of password_new is qualified, the registration conditions are met, and registration is allowed. If the reuse degree is unqualified, registration is rejected. Determine whether the reuse degree of the password password_new is qualified. The specific operations are as follows: max(Cos-similarity1, Cos-similarity2, …, Cos-similarity n) < 0.25, then the reuse degree of password_new is qualified, and thus the password strength of password_new is qualified, and the registration conditions are met, and registration is allowed; otherwise, registration is not allowed; If max(Cos-similarity1, Cos-similarity2, …, Cos-similarity n)≤0.5 and the account is a general important account or an unimportant account, the reuse degree of password_new is qualified, and thus the password strength of password_new is qualified, and the registration conditions are met, and registration is allowed; otherwise, registration is not allowed; If max(Cos-similarity1, Cos-similarity2, …, Cos-similarity n)≤0.75 and the account is an unimportant account, the reuse degree of password_new is qualified, and thus the password strength of password_new is qualified, and the registration conditions are met, and registration is allowed; otherwise, registration is not allowed; Among them, Cos-similarity1=cosine similarity(password_1,password_new), which represents the calculated value of cosine similarity between password password_new and password password_1 in the basic password dataset DataSet; Cos-similarity n=cosine similarity(password_n,password_new), which represents the calculated value of cosine similarity between password password_new and password password_n in the basic password dataset DataSet; the first password that meets the password policy requirements is marked as password_1; for password_1, the password after the user changes is marked as password_2; for password_2, the password after the user changes is marked as password_3.

2. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 1, characterized in that: In step 1, the importance of the account is a single choice, and the purpose of the account is an open-ended choice.

3. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 1, characterized in that: In step 1, the importance of the account is divided into high importance, medium importance and low importance, where the score of high importance is 1 point, the score of medium importance is 0.5 points, and the score of low importance is 0 points.

4. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 3, characterized in that: In step 1, the importance score of the account = 50% × the importance score of the account + 10% × the number of uses of the account.

5. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 1, characterized in that: In step 1, the purposes of using the account include financial transactions, information storage, social interaction, activity detection, leisure and entertainment, personalized experience, shopping and transactions, and content management.

6. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 1, characterized in that: In step 1, when the importance score of an account is greater than 0.5, it indicates that the account is an important account, and the corresponding cosine similarity standard value range that meets the password strength requirement is [0, 25%); when the importance score of an account is [0.25~0.5], it indicates that the account is a generally important account, and the corresponding cosine similarity standard value range that meets the password strength requirement is [0, 50%]; when the importance score of an account is less than 0.25, it indicates that the account is an unimportant account, and the corresponding cosine similarity standard value range that meets the password strength requirement is [0, 75%].

7. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 1, characterized in that: In step 2, the password policy is that the password length is at least 8 characters and contains uppercase letters, lowercase letters, numbers and special symbols.

8. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 1, characterized in that: In step 2, the specific steps of the security test are as follows: S2.

1. Determine whether the password complies with the requirements of the password policy: If the password does not comply with the requirements of the password policy, the website client will refuse registration, prompt the user and ask the user to redesign a password that complies with the requirements of the password policy; When the password meets the requirements of the password policy, the password is marked as password_1 and stored in the basic password dataset DataSet; S2.

2. For password_1, the client refuses to register and prompts that the password is included in the password blacklist, requiring the user to change to a more secure password; then the password changed by the user is marked as password_2 and stored in the basic password dataset DataSet; S2.

3. For password_2, the client refuses to register and prompts that the password is reused, requiring the user to change to a more secure password. The changed password is then marked as password_3 and stored in the basic password dataset DataSet. S2.

4. Repeat steps S2.1 to S2.3 to obtain the basic password data set DataSet.

9. The method for evaluating the strength of user passwords based on password reuse and cosine similarity according to claim 8, characterized in that: In step S2.1, the prompt includes that the password length does not meet 8 characters or the password lacks certain character composition types.

Images