Password leakage detection method for protecting account from large-scale voucher filling attack

Abstract

The invention discloses a password leakage detection method for protecting an account from large-scale voucher filling attack, which comprises the following steps: a client selects a prefix of a hash value of a to-be-detected voucher and a blind value corresponding to the prefix to form a request report, and sends the request report to a service provider; after receiving the request report, the service provider performs modular exponential operation on the blind value in the request report; searching a corresponding block from a database by using prefixes of all hash values in the request report, forming a reply report by a modular exponent operation result and the block, and feeding back the reply report to the client; and after the client receives the reply report, performing modular index operation on a modular index operation result in the reply report, if the modular index operation result is equal to the blind value in the database establishment stage, outputting that the voucher of the to-be-detected voucher is leaked, and otherwise, outputting that the voucher is not leaked. The password security of the account is effectively protected.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a password leakage detection method for protecting accounts from large-scale credential stuffing attacks. Background Art

[0002] The widespread availability of usernames and passwords from data breaches has made it easy for attackers to access billions of accounts. Although these account data have been leaked and made public, some accounts are still valid, even years after the initial breach. Due to the lack of account security verification technology, attackers can target users' login accounts through credential stuffing attacks, that is, using each leaked credential to attempt to hijack a vulnerable account.

[0003] While users can mitigate this hijacking risk by resetting their account passwords, in practice, discovering which accounts need attention remains a key obstacle. As a result, several account leak alert services have been deployed that proactively look for leaked credentials to notify users of compromised accounts. Existing account leak alert services implicitly trust the service provider, and work by having the client and service provider share a prefix of the username / username and hash of the password, and then the client and service provider negotiate between the credentials to be checked and the bucket identified by the hash prefix. However, for schemes that include password information in the hash prefix, there is a risk of inferring password information from the prefix if the service provider is compromised or otherwise malicious, which raises user concerns about the reliability of the service provider. In addition, for large-scale leaked credential databases, existing account leak alert services have high computational and communication costs.

[0004] For large-scale leaked credential databases, existing account leak alert services have problems such as password information leakage, high computing and communication costs, etc. Summary of the invention

[0005] In view of this, the present invention provides a password leakage detection method for protecting accounts from large-scale credential stuffing attacks. By utilizing multiple hash functions to generate multiple hash prefixes of user names, multiple hash prefixes are used to divide the large-scale leaked credential database into smaller blocks, which effectively protects the password security of accounts and reduces the computational and communication costs of account leakage alarm services, providing better security and performance.

[0006] The present invention discloses a password leakage detection method for protecting an account from large-scale credential stuffing attacks, which comprises:

[0007] Step 1: The client selects the prefix of the hash value of the credential to be detected and its corresponding blinded value to form a request report, and sends the request report to the service provider;

[0008] Step 2: After receiving the request report, the service provider performs a modular exponential operation on the blinded value in the request report; uses the prefix of all hash values ​​in the request report to find the corresponding block from the database, combines the result of the modular exponential operation with the block to form a reply report and feeds it back to the client;

[0009] Step 3: After receiving the reply report, the client performs a modular exponential operation on the result of the modular exponential operation in the reply report. If the result of the modular exponential operation is equal to the blinded value in the database establishment phase, the output of the credential to be detected has been leaked, otherwise, the output is not leaked.

[0010] Furthermore, before step 1, the method further includes:

[0011] Database establishment phase: The service provider has multiple databases of leaked credentials, each of which includes a username and its corresponding password; a hash function is selected to calculate the hash value of each username in the database, as well as the blinded value of the username and its password; a matching relationship is established between the prefix of the hash value of each username and the blinded value of the username; the database is divided into multiple blocks by the prefixes of the hash values ​​corresponding to all usernames in the database.

[0012] Furthermore, the step 1 comprises:

[0013] Request generation phase: The client uses a hash function to calculate the hash value of the credential to be tested and the blinded value of the concatenation of the test username and its password, selects the prefix of the hash value of the credential to be tested and its corresponding blinded value to form a request report, and sends the request report to the service provider.

[0014] Furthermore, the service provider has a database D={(u 0 , v 0 ),…,(u m-1 , v m-1 )}, where u i and v i Represents the user name and password respectively. Each leaked credential includes a user name and its corresponding password. The client has a credential to be tested, which includes the user u to be tested. * and its corresponding password v * .

[0015] Furthermore, in the database establishment phase:

[0016] Service providers choose to operate in limited domains Elliptic curve E on y 2 =x 3 +ax+b parameters (p, a, b, g, n), where p is a large prime number, 4a 3 +24b 2 ≠0, g is a group A generator of , the large prime number n is The service provider randomly selects a positive integer less than n as the key s;

[0017] The service provider chooses the hash function h 0 ,…,h α-1 ,h, calculate the hash value of each user name in database D and blinded value And select each hash value p i，j The β-bit prefix is ​​used as an identifier u i ||v i represents the concatenation operation of the ith user name and password; (h(u i ||v i )) s It means that the blinded value is obtained by calculating the hash value after the concatenation operation and then performing the modular exponential operation, where s is the exponent;

[0018] Establishing Identity and Match between and use Divide the database D into multiple blocks where i∈{1, 2, …, m}, j∈{1, 2, …, α}, {h j : {0, 1} * →{0, 1} l |j∈{1, 2, …, α}}, is the group, l is the length of the bit string output by the hash function, h j : {0, 1} * →{0, 1} l is a bit string of arbitrary length {0, 1} * to l-length bit string {0, 1} l 's mapping.

[0019] Furthermore, the step 1 specifically includes:

[0020] The client uses the hash function h 0 ,…,h α-1 , h calculates the user u to be detected * Hash value and blinded value And select each hash value The β-bit prefix is And send a request report to the service provider; r is the index.

[0021] Furthermore, the step 2 comprises:

[0022] In the reply generation phase, after receiving the request report Q, the service provider calculates Use logo Look up database D and get a block containing multiple blinded certificates And return the reply report To the client.

[0023] Furthermore, the step 3 comprises:

[0024] In the result export phase, after receiving the reply report R, the client calculates And for each Determine whether If yes, output that its credentials have been compromised, otherwise, output that they have not been compromised.

[0025] Furthermore, the hash function used in step 1 is the same as the hash function used in the database establishment phase.

[0026] Due to the adoption of the above technical solution, the present invention has the following advantages: in view of the password information leakage risk existing in the existing account leakage alarm service, and the high computational and communication cost problem under the large-scale leakage credential database, based on the hash function and the privacy set intersection protocol, the present invention designs a password leakage detection method for protecting accounts from large-scale credential stuffing attacks. The method uses multiple hash functions to generate multiple hash prefixes of user names, and uses multiple hash prefixes to divide the large-scale leakage credential database into smaller buckets, and then the client and the service provider perform a privacy set intersection protocol between the credentials to be checked and the smaller buckets, which effectively ensures the password security of the account, reduces the computational and communication costs of the account leakage alarm service, and provides better security and performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0028] Figure 1 A flowchart of a password leakage detection method for protecting accounts from large-scale credential stuffing attacks according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0030] See also Figure 1 , the service provider has a database D = {(u 0 , v 0 ),…,(u m-1 , v m-1 )}, where u i and v i Represents the user name and password respectively. The client has a credential ( * , v * ) and want to check if the credentials have been compromised.

[0031] The password leak warning framework model for protecting accounts from large-scale credential stuffing attacks consists of four stages: database establishment stage, request generation stage, response generation stage, and result export stage.

[0032] In the database establishment phase, the service provider first initializes the system parameters (p, a, b, g, n) and the key s; then selects the hash function h 0 ,…,h α-1 ,h, calculate the hash value and blinded value And select each hash value p i，j The β-bit prefix is Finally create the logo and Match between and use Divide the database D into multiple blocks where i∈[m], j∈[α], {h j : {0, 1} * →{0, 1} l |j∈[α]},

[0033] During the request generation phase, the client uses the hash function h 0 ,…,h α-1 , h calculates the hash value and blinded value And select each hash value The β-bit prefix is And send a request report To service providers.

[0034] In the response generation phase, after receiving the request report Q, the service provider calculates Use logo Look up database D to get a block containing multiple blinded certificates And return the reply report To the client.

[0035] In the result export phase, after receiving the reply report R, the client calculates And for each Determine whether If yes, output that its credentials have been compromised, otherwise, output that they have not been compromised.

[0036] More specifically, this application assumes that the service provider has a database D = {(u 0 , V 0 ),…,(u m-1 , v m-1 )}, where u i and v i Represents the user name and password respectively. The client has a credential ( * , v * ), and want to check whether the credential has been leaked. Based on the hash function and the privacy set intersection protocol, the solution of this application includes four stages: database establishment stage, request generation stage, reply generation stage and result export stage, which are described as follows:

[0037] The first stage: database establishment stage

[0038] (1) Service providers choose to operate in a limited domain Elliptic curve E on y 2 =x 3 +ax+b parameters (p, a, b, g, n), where p is a large prime number, 4a 3 +27b 2 ≠0, g is a group A generator of , the large prime number n is Then, the service provider randomly selects a positive integer less than n as the key s.

[0039] (2) The service provider selects the hash function h 0 ,…,h α-1 ,h, for each leaked credential (u i , v i ), calculate the hash value and x i =h(u i ||v i ). The service provider then calculates the blinded value Finally, let each Yesi，j For the first β bits, by establishing a match between and , the service provider can divide the database D into multiple blocks where i ∈ [m], j ∈ [α], {h j : {0, 1} * →{0, 1} l | j ∈ [α]}, l ≥ (log n + λ), β << l, and β is usually in bytes. l is the length of the bit string output by the hash function, and h j : {0, 1} * →{0, 1}l is a mapping from any bit string of length {0, 1} * to a bit string of length l {0, 1} l .

[0040] The second stage: Request generation stage

[0041] (1) For a credential (u * , v * ) that the client wants to check, the client uses the hash functions h 0 , …, h α-1 , h to calculate the hash values and x * = h(u * || v * ). Then, the client selects the first β bits of each as the identifier randomly selects a positive integer r less than n, and calculates where j ∈ [α], {h j : {0, 1} * →{0, 1} l | j ∈ [α]}, l ≥ (log n + λ), β << l, and β is usually in bytes.

[0042] (2) The client sends the request report to the service provider.

[0043] The third stage: Reply generation stage

[0044] (1) After receiving the request report , the service provider calculates Then, the service provider uses the identifier to look up the database D to obtain a block containing multiple blinded credentials where

[0045] (2) The service provider returns a response report To the client.

[0046] The fourth stage: result export stage

[0047] (1) The client receives the response report After that, calculate

[0048] (2) For each The client determines whether If yes, output that its credentials have been compromised, otherwise, output that they have not been compromised.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A password leak detection method for protecting accounts from large-scale credential stuffing attacks, characterized in that: include: Step 1: The client selects the prefix of the hash value of the credential to be detected and its corresponding blinded value to form a request report, and sends the request report to the service provider; Step 2: After receiving the request report, the service provider performs a modular exponential operation on the blinded value in the request report; Use the prefix of all hash values ​​in the request report to find the corresponding block from the database, combine the result of the modular exponential operation with the block to form a reply report and feed it back to the client; Step 3: After receiving the reply report, the client performs a modular exponential operation on the result of the modular exponential operation in the reply report. If the result of the modular exponential operation is equal to the blinded value in the database establishment phase, the output of the credential to be detected has been leaked, otherwise, the output is not leaked.

2. The method according to claim 1, characterized in that Before step 1, the method further includes: Database establishment phase: The service provider has multiple databases of leaked credentials, each of which includes a username and its corresponding password; a hash function is selected to calculate the hash value of each username in the database, as well as the blinded value of the username and its password; a matching relationship is established between the prefix of the hash value of each username and the blinded value of the username; the database is divided into multiple blocks by the prefixes of the hash values ​​corresponding to all usernames in the database.

3. The method according to claim 1, characterized in that The step 1 comprises: Request generation phase: The client uses a hash function to calculate the hash value of the credential to be tested and the blinded value of the concatenation of the test username and its password, selects the prefix of the hash value of the credential to be tested and its corresponding blinded value to form a request report, and sends the request report to the service provider.

4. The method according to claim 1, characterized in that: The service provider has a database D = {(u0,v0),…,(u m-1 ,v m-1 )}, where u i and v i Represents the user name and password respectively. Each leaked credential includes a user name and its corresponding password. The client has a credential to be tested, which includes the user u to be tested. * and its corresponding password v * .

5. The method according to claim 2, characterized in that: During the database establishment phase: Service providers choose to operate in limited domains Elliptic curve E:y on 2 =x 3 +ax+b parameters (p,a,b,g,n), where p is a large prime number, 4a 3 +24b 2 ≠0, g is a group A generator of , the large prime number n is The service provider randomly selects a positive integer less than n as the key s; The service provider chooses the hash function h0,…,h α-1 ,h, calculate the hash value of each user name in database D and blinded value And select each hash value p i,j The β-bit prefix is ​​used as an identifier u i ||v i represents the concatenation operation of the ith user name and password; (h(u i ||v i )) s It means that the blinded value is obtained by calculating the hash value after the concatenation operation and then performing the modular exponential operation, where s is the exponent; Establishing Identity and Match between and use Divide the database D into multiple blocks where i∈{1,2,…,m}, j∈{1,2,…,α}, {h j :{0,1} * →{0,1} l |j∈{1,2,…,α}}, is the group, l is the length of the bit string output by the hash function, h j :{0,1} * →{0,1} l is a bit string of arbitrary length {0,1} * to l-length bit string {0,1} l 's mapping.

6. The method according to claim 5, characterized in that The step 1 specifically includes: The client uses hash functions h0,…,h α-1 ,h calculates the user u to be detected * Hash value and blinded value And select each hash value The β-bit prefix is And send a request report to the service provider; r is the index.

7. The method according to claim 6, characterized in that The step 2 comprises: In the reply generation phase, after receiving the request report Q, the service provider calculates Use logo Look up database D and get a block containing multiple blinded certificates And return the reply report To the client.

8. The method according to claim 2, characterized in that: The step 3 comprises: In the result export phase, after receiving the reply report R, the client calculates And for each Determine whether If yes, output that its credentials have been compromised, otherwise, output that they have not been compromised.

9. The method according to any one of claims 2 to 8, characterized in that: The hash function used in step 1 is the same as the hash function used in the database establishment phase.

Images