Weak password detection method, system, device, equipment, medium and program product

Abstract

The invention discloses a weak password detection method, system, device and equipment, a medium and a program product, and relates to the technical field of computers. The method comprises the following steps: acquiring user information of a user, wherein the user information comprises a first password and user identification information of the user in each of N scenes; determining a weak password rule corresponding to the user information based on the user information; and detecting a second password set by the user according to the weak password rule. Therefore, the weak password rule for the user can be constructed according to the user identification information of the user in different scenes, so that targeted detection of the second password set by the user is realized, and the accuracy and the safety of detection of the second password are improved. And moreover, the weak password coverage can be increased and the storage space can be reduced through the weak password rule, and the second password set by the user in the local can be detected according to the weak password rule without network connection and protocol collision, so that the weak password detection efficiency is improved.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a weak password detection method, system, device, equipment, medium and program product. Background Art

[0002] Weak passwords are passwords that are easy to guess or cracked by cracking tools. These passwords usually contain simple combinations of numbers and letters, such as "123", "abc", etc. Attackers will use this vulnerability to illegally obtain system and user data, and may even cause the server to fall, thus bringing serious data security risks. Therefore, how to detect weak passwords has become an urgent problem to be solved.

[0003] In the related art, weak password detection methods include network protocol scanning and dictionary enumeration. However, the former will cause large network traffic and transaction processing volume per second due to a large number of false attempts during the detection process, increasing network load; the latter will slow down the enumeration scan due to the large number of preset weak passwords in the dictionary, reducing the detection efficiency of weak passwords. Summary of the invention

[0004] The embodiments of the present application provide a weak password detection method, system, device, equipment and storage medium, which can solve the problems of low weak password detection efficiency and high network load in related technologies.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting a weak password, which may include:

[0006] Obtaining user information of the user, where the user information includes a first password and user identification information of the user in each of N scenarios, where N is a positive integer;

[0007] Based on the user information, determine the weak password rules corresponding to the user information;

[0008] According to the weak password rules, check the second password set by the user.

[0009] In a second aspect, an embodiment of the present application provides a weak password detection system, which includes a user end and a server end; wherein:

[0010] The server is used to obtain user information of the user from the client, where the user information includes a first password and user identification information of the user in each of N scenarios, where N is a positive integer; based on the user information, determine a weak password rule corresponding to the user information; and send the weak password rule to the client;

[0011] The client terminal is used to receive the weak password rules sent by the server terminal; according to the weak password rules, the second password set by the user in the client terminal is detected.

[0012] In a third aspect, an embodiment of the present application provides a weak password detection device, which may include:

[0013] An acquisition module, used to acquire user information of the user, the user information including a first password and user identification information of the user in each of N scenarios, where N is a positive integer;

[0014] A determination module, used to determine a weak password rule corresponding to the user information based on the user information;

[0015] The detection module is used to detect the second password set by the user according to the weak password rule.

[0016] In a fourth aspect, an embodiment of the present application provides a computer device, the computer device comprising: a processor and a memory storing computer program instructions;

[0017] When the processor executes the computer program instructions, the weak password detection method shown in the first aspect is implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a computer storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the weak password detection method as shown in the first aspect is implemented.

[0019] In a sixth aspect, an embodiment of the present application provides a chip, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the weak password detection method shown in the first aspect.

[0020] In a seventh aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the weak password detection method as shown in the first aspect.

[0021] The weak password detection method, system, device, equipment and storage medium of the embodiment of the present application can obtain the user information of the user, and the user information includes the first password and the user identification information of the user in each of N scenarios; then, based on the user information, the weak password rule corresponding to the user information is determined; then, according to the weak password rule, the second password set by the user is detected. In this way, a weak password rule for the user can be constructed according to the user identification information of the user in different scenarios to achieve targeted detection of the second password set by the user, avoiding the possibility that the user cross-sets the second password in other scenarios through the user identification information in one scenario or the user sets the second password in a certain scenario through the user identification information in the scenario, which is easily cracked, thereby improving the accuracy and security of the detection of the second password set by the user. Furthermore, by replacing the enumeration dictionary in the prior art with weak password rules, the coverage of weak passwords is increased. Since the weak password rules are smaller in size than the massive preset weak passwords enumerated in the dictionary, the storage space can be reduced. In addition, for the process of detecting the second password through the weak password rules, the second password set by the local user can be detected according to the weak password rules without the need for network connection and protocol collision, thereby improving detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0023] Figure 1 One of the structural schematic diagrams of a weak password detection system provided in an embodiment of the present application;

[0024] Figure 2 A second structural diagram of a weak password detection system provided in an embodiment of the present application;

[0025] Figure 3 A flowchart of a weak password detection method provided in an embodiment of the present application;

[0026] Figure 4 A schematic diagram of a weak password rule for a weak password detection method provided in an embodiment of the present application;

[0027] Figure 5 It is a structural diagram of a weak password detection device provided by an embodiment of the present application;

[0028] Figure 6 It is a schematic diagram of the structure of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0029] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0030] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0031] The acquisition, storage, use, and processing of data (including but not limited to the features and information in the text) in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0032] Weak password vulnerabilities have become a high-ranking attack vulnerability used by criminals. Criminals can use this vulnerability to automatically enumerate and blast the accounts and passwords on the device through programs, trying to guess the correct login account and weak password combination to enter the application system or management system, tamper with and delete the data in the system, or illegally obtain the system and user data. This process is likely to bring serious data security risks, so how to detect weak passwords has become an urgent problem to be solved.

[0033] In the related art, weak password detection methods may include regular expression detection, network protocol scanning detection, and enumeration dictionary detection.

[0034] Among them, the regular expression detection method can detect passwords by setting conditions, such as setting a length condition to require the user's password to reach a certain length, such as 8 bytes or more than 10 bytes; setting a complexity condition to require the user's password to include multiple types of characters such as numbers, letters, and symbols; setting a continuous character restriction condition to require that the same type of characters cannot be repeated continuously for more than a certain number of times; setting a restriction condition that the password cannot be repeated within a certain number of times. Although this detection method can reduce the risk of password leakage by increasing the complexity of the password. However, people always tend to use weak passwords that are easy to remember. For example, users usually use user information such as name, birthday, and contact number to make up the password length and complexity. Since this user information is very easy to be obtained by attackers, it will still increase the probability of passwords being hacked.

[0035] The detection method of network protocol scanning is usually to detect the password through network port scanning and protocol connection when the user and server are connected to the network. However, the detection process requires a large number of error attempts, which will cause large network traffic and transactions per second (TPS), increase the network load, and affect the detection efficiency of weak passwords.

[0036] The detection method of enumeration dictionary is usually to enumerate and scan weak passwords based on the preset weak passwords stored in the dictionary. However, on the one hand, the number and coverage of preset weak passwords in the dictionary are limited, which can easily reduce the accuracy of weak password detection. On the other hand, since the dictionary is enumerated and scanned line by line, the number of records is large. If the preset weak passwords are deformed, the preset weak passwords in the dictionary will increase exponentially. While increasing the storage space, it will also increase the detection time several times, reducing the detection efficiency of weak passwords.

[0037] Based on this, in order to solve the problems in the related technology, the following will be combined with the attached Figures 1 to 5 , describes in detail the weak password detection method, apparatus, system, computer equipment, storage medium and computer program product of the embodiments of the present application. It should be noted that these embodiments are not intended to limit the scope of the disclosure of the present application.

[0038] First, combine Figure 1 and Figure 2 The weak password detection system provided in the embodiment of the present application is described in detail as follows.

[0039] Figure 1 This is one of the structural diagrams of a weak password detection system provided in an embodiment of the present application.

[0040] like Figure 1As shown, the weak password detection system provided in the embodiment of the present application can be set on the weak password analysis server (Weak Pass Server). The weak password analysis server can include a weak password collection agent (PAM Agent), an analyzer (analyzer), a dictionary and a dispatcher (dispatcher).

[0041] Combine the following Figure 1 The above-mentioned weak password detection system is described in detail.

[0042] A weak password collection agent is used to obtain the user information of the user from the user terminal and transmit the user information to the analyzer. Among them, the user information includes the first password and the user identification information of each scene in N scenes, N is a positive integer, and here, the N scenes include but are not limited to the following scenes: user life scene, user work scene, user learning scene, user medical scene. Further, the user identification information of the user's life scene includes but is not limited to the following information: user name, social account name, communication number, ID number; the user identification information of the work scene includes but is not limited to the following information: work nickname, work number, landline number, email address; the user identification information of the learning scene includes but is not limited to the following information: the school attended or graduated, the student number, the dormitory number; the user identification information of the user's medical scene includes the social security number. The first password can be determined based on the user behavior data. Specifically, the first password can be extracted from the user behavior data. At least one of the following passwords: the first wrong password entered by the user when logging into the system, the second wrong password entered by the user when resetting the password, the stored password, and the initial setting password entered by the user in the front-end password setting interface.

[0043] The analyzer is used to analyze the first password and determine the weak password rule corresponding to the user information. Specifically, the analyzer can divide the text characters in the first password to obtain a first feature item; perform a first operation on the first feature item to obtain a second feature item, and the first operation includes at least one of the following items: a character deformation operation and a character type conversion operation; and determine the weak password rule according to the matching result between the second feature item and the user identification information provided by the dictionary.

[0044] It should be noted that, in order to facilitate the analyzer to analyze the first password, the first password in the embodiment of the present application can be plain text. Of course, in order to ensure the security of the password, the first password in the embodiment of the present application can also be a hash value of the plain text password obtained by hashing the plain text. Since the hash value cannot be restored to the plain text password, the user terminal can perform the same hashing process on the plain text, and then compare the two hash values ​​to determine whether the password is hit.

[0045] The dictionary is used to provide user identification information, so as to determine whether the second feature item includes a date, a communication number, an ID number, a work number, a landline number, an email address, a student number, a dormitory number, and other continuous numbers with specific meanings. The dictionary may include at least one of the following: a rule dictionary and a user defined dictionary. Furthermore, the rule dictionary may provide more general information such as a date, an email address, and a dormitory number, and the user defined dictionary may provide more user-specific information such as a communication number, an ID number, a landline number, a student number, and an anniversary.

[0046] A dispatcher (dispat) is used to store weak password rules corresponding to user information, so that the weak password analysis server calls the weak password rules corresponding to the user information from the dispatcher, and detects the second password set by the user corresponding to the user information in at least one system, wherein the aforementioned system can be a large system belonging to different services, such as a remote work system logged in in a work scenario, in which case the second password can be the password of the account logged in to the remote work system. Of course, the aforementioned system can also be a subsystem under a large system, such as a mailbox system in a remote work system, in which case the second password can be the password of the account logged in to the mailbox system.

[0047] Therefore, a weak password rule for the user can be constructed based on the user identification information of the user in different scenarios to achieve targeted detection of the second password set by the user, avoiding the possibility that the user cross-sets the second password in other scenarios through the user identification information in one scenario or the user sets the second password in a certain scenario through the user identification information in the scenario, which is easily cracked, thereby improving the accuracy and security of the detection of the second password set by the user. In addition, by replacing the enumeration dictionary in the prior art with the weak password rule, while increasing the coverage of weak passwords, the weak password rule can reduce the storage space because the volume is small compared to the massive preset weak passwords enumerated in the issued dictionary. In addition, for the process of detecting the second password through the weak password rule, the second password set by the user in the local area can be detected according to the weak password rule without the need for network connection and protocol collision, thereby improving the detection efficiency.

[0048] Figure 2 The second structural diagram of a weak password detection system provided in an embodiment of the present application.

[0049] like Figure 2 As shown, the weak password detection system may include a user end and a server end. The server end may be as follows Figure 1 The weak password analysis server shown in FIG. 1 may refer to the structure of the weak password analysis server and the functions of each unit in the weak password analysis server as shown in FIG. Figure 1The description shown will not be repeated here.

[0050] The user end can be a node connected to the weak password analysis server, such as node (node1), node (node2), node (node3), ..., node (nodeN). The operating system (linux) in the user end includes at least a weak password collection agent (PAM Agent) and a weak password collision device (Scanner). In addition, the operating system can also plug in a database (DatabasePlugin), an application plug-in (Application Plugin) and a pluggable authentication module (PluggableAuthenticationModules, PAM).

[0051] Furthermore, PAM is an operating system authentication mechanism that flexibly configures different authentication methods for different application services as needed by providing some dynamic libraries and application programming interfaces (APIs) without changing the application services.

[0052] The pluggable authentication module is a new plug-in added to the pluggable authentication module, which is used to send user information (such as the first incorrect password entered by the user when logging into the system in the application plug-in, and the second incorrect password entered by the user when resetting the password) to the PAM Reciever in the weak password server through an encrypted channel, so that the weak password analysis server can determine the weak password rules based on the user information.

[0053] In such Figure 2In the illustrated embodiment, after determining the weak password rule, the weak password analysis server can execute the weak password rule to be sent to each user terminal, i.e., the node, related to the user, so that the node detects the second password set by the user in the user terminal according to the weak password rule. Here, taking the node as node 1 (node1) as an example, the weak password analysis server can retrieve the weak password rule corresponding to the user ID from the distributor according to the user ID of the user, and send the weak password rule to the Scanner of at least one user terminal of the user. In some embodiments, the Scanner is used to generate a second weak password corresponding to the weak password rule according to the weak password rule, and compare the second weak password with the second password set by the local user, so that when the first encrypted weak password is the same as the second password, the user terminal can prompt the user to change the second password. Among them, the second password can be the password of at least one application related to the application plug-in, or it can be the password of at least one application service in the application. In other embodiments, after receiving the weak password rule, the Scanner generates a second weak password according to the weak password rule. Since the password in the relational database management system (MySQL) is an encrypted password, the hash algorithm of the database can be obtained from the relational database management system, and the second weak password is hashed to obtain the hashed second weak password. The hashed second weak password is subjected to collision scanning with the second password set by the local user in node 1. If it is an operating system, a collision is performed according to the algorithm in the operating system / wtc / passwd file. If the collision is successful, a weak password discovery message is sent to the PAM Reciever through an encrypted channel, and the device address, user name and collision weak password are used. In this way, more types of applications can be supported through application plug-ins, avoiding the low efficiency of network load and protocol collision.

[0054] Therefore, since the weak password rules sent by the weak password analysis server to the user end are smaller in size than the preset weak passwords enumerated in the dictionary, the sending efficiency can be improved and the storage space of the user end can be reduced. In addition, for the process of the user end detecting the second password through the weak password rules, the second password set by the local user can be detected according to the weak password rules without the need for a network connection, thereby avoiding network load and protocol collision, reducing network load and improving detection efficiency.

[0055] It should be noted that the weak password detection method provided in the embodiment of the present application can be used alone as a weak password detection method to detect the second password set by users in the server and the user end, or it can be used as a supplementary scheme of at least one of the following detection methods: regular expression detection method, network protocol scanning detection method, and enumeration dictionary detection method to jointly detect the second password set by users in the server and the user end, so as to improve the detection efficiency of weak passwords.

[0056] Combine the following Figure 3 right Figure 1 and Figure 2 The weak password detection method performed by the weak password detection system shown is described in detail.

[0057] Figure 3 A flowchart of a weak password detection method provided in an embodiment of the present application.

[0058] like Figure 3 As shown, the weak password detection method can be applied to Figure 1 or Figure 2 The weak password detection system shown in the figure, the weak password detection method may specifically include the following steps:

[0059] Step 310, obtaining user information of the user, the user information including a first password and user identification information of the user in each of N scenarios, where N is a positive integer; Step 320, determining a weak password rule corresponding to the user information based on the user information; Step 330, detecting a second password set by the user according to the weak password rule.

[0060] In this way, a weak password rule for the user can be constructed based on the user identification information of the user in different scenarios to achieve targeted detection of the second password set by the user, avoiding the possibility that the user cross-sets the second password in other scenarios through the user identification information in one scenario or the user sets the second password in a certain scenario through the user identification information in the scenario, which is easily cracked, thereby improving the accuracy and security of the detection of the second password set by the user. In addition, by replacing the enumeration dictionary in the prior art with the weak password rule, while increasing the coverage of weak passwords, the weak password rule can reduce the storage space because the volume is small compared to the massive preset weak passwords enumerated in the dictionary, and in addition, for the process of detecting the second password through the weak password rule, the second password set by the user in the local area can be detected according to the weak password rule without the need for network connection and protocol collision, thereby improving the detection efficiency.

[0061] The above steps are described in detail below, as shown below.

[0062] First, step 310 is involved. In the embodiment of the present application, the first password may be a login password of at least one application, or a login password of at least one application service in the application. The first password includes but is not limited to a first wrong password entered by a user when logging into the system, a second wrong password entered by a user when resetting a password, a stored password, and an initial setting password entered by a user in the front-end password setting interface.

[0063] The N scenarios in the embodiments of the present application include but are not limited to the following scenarios: user life scenarios, user work scenarios, user learning scenarios, and user medical scenarios. Furthermore, the user identification information for the user life scenarios includes but is not limited to the following information: user name, social account name, communication number, ID number, anniversary; the user identification information for the work scenario includes but is not limited to the following information: work nickname, work number, landline number, email address; the user identification information for the learning scenario includes but is not limited to the following information: the school you are attending or graduating from, student number, dormitory number; the user identification information for the user medical scenario includes the social security number.

[0064] Therefore, a weak password rule for the user can be constructed according to the user identification information of the user in different scenarios, so as to realize targeted detection of the second password set by the user, thereby avoiding the possibility that the user sets the second password for other scenarios through the user identification information in one scenario or the second password for a certain scenario is easily cracked through the user identification information in that scenario. By obtaining the user identification information in more scenarios, the weak password rule can be determined more accurately, thereby improving the accuracy and security of the detection of the second password set by the user.

[0065] In some embodiments of the present application, step 310 may specifically include:

[0066] The user identification information is obtained from a user dictionary corresponding to the user; wherein the user dictionary includes at least one of the following: a rule dictionary and a user-defined dictionary.

[0067] The dictionary may include at least one of the following: a rule dictionary and a user defined dictionary. Furthermore, the rule dictionary may provide more general information such as date, email address, dormitory number, etc., while the user defined dictionary may provide more user-specific information such as communication number, ID number, landline number, student number, anniversary, etc.

[0068] In this way, the accuracy of detecting whether the second characteristic item obtained after the first operation on the first characteristic item in the first password includes continuous numbers with specific meanings such as date, communication number, ID number, work number, landline number, email address, student number, dormitory number, etc. can be improved.

[0069] In addition, before step 310, the embodiment of the present application further provides a step of determining a first password. Based on this, the weak password detection method may further include steps 410 to 430.

[0070] Step 410, obtaining user behavior data.

[0071] Step 420, extract at least one of the following passwords from the user behavior data: the first incorrect password entered by the user when logging into the system, the second incorrect password entered by the user when resetting the password, the stored password, and the initial setting password entered by the user in the front-end password setting interface.

[0072] Step 430: determine the password as the first password.

[0073] Therefore, in the embodiment of the present application, the first password used to characterize the user's habits can be extracted based on the user behavior data, and combined with the user identification information that may be obtained by social engineers in N scenarios, the weak password rules corresponding to the user information can be determined to obtain more potential weak passwords that cannot be discovered by traditional weak password scanning methods but can be cracked under real social engineering conditions. In this way, the coverage of the weak password rules can be improved, thereby improving the accuracy and security of the detection of the second password set by the user.

[0074] Next, referring to step 320, the weak password detection method provided in the embodiment of the present application provides two ways to determine weak password rules based on user information, as shown below.

[0075] In some embodiments of the present application, step 320 may specifically include steps 3201 to 3203 .

[0076] Step 3201, divide the text characters in the first password to obtain a first feature item.

[0077] Among them, the following two methods of dividing the first password are provided in the embodiment of the present application, as shown below.

[0078] In some embodiments of the present application, the text characters in the first password can be divided according to the semantics of the text characters. Among them, the semantic division of text characters refers to the process of grouping or segmenting the characters in the text according to their semantics, which helps to understand the overall meaning and structure of the first password. Specifically, the strategy-based segmentation method can be used to segment the text according to specific rules or patterns. For example, the (RecursiveCharacter Text Splitter) method provided by the large model application development framework can be used to define multi-level separators to achieve text segmentation. In addition, based on the segmentation method of deep learning, a deep learning model can be used to identify semantic units in the text. For example, the subword segmentation algorithm (Byte Pair Encoding, BPE) or the WordPiece algorithm of natural language processing is used to decompose the text into smaller units.

[0079] In some other embodiments of the present application, the text characters in the first password can be divided according to the user identification information provided by the dictionary to obtain at least one first feature item. Here, the at least one first feature item can include at least one of the following roots: word library roots, pinyin roots, date roots, certificate number roots, and communication number roots. Among them, the certificate number root can include at least one of the following roots: identity card number, student number, social security number, and medical insurance number.

[0080] It should be noted that the number of the first characteristic items may be at least one. For example, the first password is the first password: one996@zw, which can be divided into three first characteristic items: "one996", "@" and "zw".

[0081] In this way, the overall meaning and structure of the first password can be more comprehensively understood, so as to convert the first password and expand the number of passwords, increase the coverage of weak passwords, and improve the accuracy of generating weak password rules.

[0082] Step 3202: Perform a first operation on the first feature item to obtain a second feature item, wherein the first operation includes at least one of the following items: a character deformation operation and a character type conversion operation. Here, when the number of the first feature items is at least two, the first operation is performed on each of the at least two first feature items.

[0083] Step 3203: Determine a weak password rule based on the matching result between the second feature item and the user identification information.

[0084] For example, if the first password is: one996@zw; user identification information: birthday 1996.1.1, name Zhang Wang, zhangwang; the conversion result information includes 1996@zw, which is matched with the user identification information to see if it is a hit. If it is a hit, it means that the user is accustomed to using the year of his birthday as his password, and the user is accustomed to converting the first digit of the year of his birthday into English as his password. Then, the weak password rules include at least one of the following: using the year of his birthday (number) as his password, and converting the first digit of the year of his birthday into an English word as his password.

[0085] Therefore, by replacing the enumeration dictionary in the prior art with weak password rules, the coverage of weak passwords is increased. At the same time, since the weak password rules are smaller in size than the massive preset weak passwords enumerated in the dictionary, the storage space can be reduced. In addition, for the process of detecting the second password through the weak password rules, there is no need for network connection and protocol collision, and the second password set by the local user can be detected according to the weak password rules, thereby improving the detection efficiency.

[0086] Furthermore, since the first operation in the embodiment of the present application is diverse, the method of determining the second characteristic item and the obtained second characteristic item will be different if the first operation is different. Therefore, the above step 3202 is described in detail below based on different first operations.

[0087] In some embodiments, a character deformation operation may be performed on the first feature item, that is, the first feature item includes a first character, and the first operation includes a character deformation operation. Based on this, step 3202 may specifically include step 32021 and step 32022.

[0088] Step 32021, performing a character deformation operation on the first character to obtain a second character; wherein the second character is at least one of the following characters: a character after the shape of the first character is changed, and a character after the first character is converted into uppercase and lowercase characters.

[0089] Exemplarily, if the first character is a, a character deformation operation is performed on the first character to obtain a character after shape change, such as q, @, 0; and a character after case conversion, such as A.

[0090] It should be noted here that the character type of the second character can be the same as the character type of the first character, such as both are letters, or it can be different from the character type of the first character, such as the first character is a letter and the second character is the number 0 or the symbol @.

[0091] Step 32022: reconstruct a second feature item corresponding to the first feature item based on the second character.

[0092] Exemplarily, a in the first feature item can be replaced by q to obtain a second feature item 1 corresponding to the first feature item, a in the first feature item can be replaced by @ to obtain a second feature item 2 corresponding to the first feature item, a in the first feature item can be replaced by 0 to obtain a second feature item 3 corresponding to the first feature item, and a in the first feature item can be replaced by A to obtain a second feature item A corresponding to the first feature item.

[0093] In other embodiments, a character type conversion operation may be performed on the first feature item, that is, the first feature item includes a third character, and the first operation includes a character type conversion operation. Based on this, step 3202 may specifically include step 32023 and step 32024.

[0094] Step 32023, perform a character type conversion operation on the third character to obtain a fourth character, wherein the character meaning expressed by the fourth character is the same as the character meaning expressed by the third character, and the character type of the fourth character is different from that of the third character. The character type includes letters, numbers or symbols.

[0095] For example, the third character is "one996", and the character type conversion operation is performed on the third character to obtain the fourth character "1996". At this time, the character meaning expressed by the fourth character and the character meaning expressed by the third character are both the year 1996. Alternatively, the third character is "dawei", and the character type conversion operation is performed on the third character to obtain the fourth character "David". At this time, the character meaning expressed by the fourth character and the character meaning expressed by the third character are both names, but one is expressed in pinyin and the other is expressed in English.

[0096] Step 32024, based on the fourth character, reconstruct the second feature item corresponding to the first feature item.

[0097] For example, one996 in the first feature item may be replaced by 1996 to obtain a second feature item 4 corresponding to the first feature item, or dawei in the first feature item may be replaced by David to obtain a second feature item 5 corresponding to the first feature item.

[0098] Furthermore, the embodiment of the present application can generate a weak password rule by matching the second feature item with the user identification information. Based on this, the above-mentioned step 3203 may specifically include step 32031 and step 32032.

[0099] Step 32031, match the second feature item with the user identification information to obtain a matching result.

[0100] Exemplarily, the second feature item may include at least one of the following items: a word feature item, a pinyin feature item, a date feature item, an ID number feature item, and a communication number feature item. Based on these feature items, a match is performed with the user identification information. If a match is found, a weak password rule can be generated by hitting the first target feature item.

[0101] In this way, the accuracy of detecting whether the second characteristic item obtained after the first operation on the first characteristic item in the first password includes continuous numbers with specific meanings such as date, communication number, ID number, work number, landline number, email address, student number, dormitory number, etc. can be improved.

[0102] Step 32032: When the matching result indicates that the second feature item includes the first target feature item that matches the user identification information, a weak password rule is generated based on the first target feature item.

[0103] Specifically, step 32032 may include step 320321 and step 320322.

[0104] Step 320321, based on the first target feature item, extract the second target feature item corresponding to the first target feature item from the first password.

[0105] Step 320322, construct a weak password rule based on the first target feature item, the second target feature item, the conversion identification information of the character type from the first target feature item to the second target feature item, and the operation identification of the corresponding operation from the second target feature item to the first target feature item.

[0106] For example, the weak password rule may be as follows: Figure 4 As shown, the first target feature item can be @, and the second target feature item can be a, thereby, the character type is converted from a symbol (SYMBOL) to a letter (LETTER), and at this time, the conversion identification information can be SYMBOL-LETTER. The conversion identification information of the character type is a character deformation operation (Transcription). Alternatively, the first target feature item can be ph, and the second target feature item can be f, thereby, the character type is converted from a letter (LETTER) to a letter (LETTER), and at this time, the conversion identification information can be LETTER-LETTER. The conversion identification information of the character type is a character type conversion operation (Transliteration). In some embodiments of the present application, the first password is at least one of the following incorrect passwords: a first incorrect password entered when a user logs into the system, and a second incorrect password entered when a user resets the password. Based on this, the weak password rule can be determined in combination with the rule identification of the error cause of the incorrect password. In this way, step 320 can specifically include:

[0107] Based on the user identification information and the rule identification of the error reason of the incorrect password, a weak password rule corresponding to the user information is determined.

[0108] For example, if the error reason of the wrong password is that the user edited "one996" into "1996", then the rule identifier may be from LETTER_NUMBER, and the rule identifier may be "Transcription".

[0109] Specifically, step 320 may include steps 3204 to 3206.

[0110] Here, step 3204 may refer to step 3201, and step 3205 may refer to step 3202, which will not be repeated here.

[0111] Step 3206: Correct the matching result between the second feature item and the user identification information through rule identification to obtain a weak password rule.

[0112] Exemplarily, still taking the example in the above steps as an example, a weak password rule corresponding to the user information can be generated based on the rule identifier, the above-mentioned conversion identifier information and the operation identifier.

[0113] Therefore, weak password rules can be obtained through the collaboration of multiple factors to improve the accuracy of determining weak password rules.

[0114] Then, involving step 330, the embodiment of the present application can detect the password already stored in the background through the weak password rule, or can detect the password initially set by the user in the foreground password setting interface through the password rule. The above example is described in detail below.

[0115] In some embodiments of the present application, the second password is a password corresponding to the first system stored in the background, and the second password is a password encrypted by an encryption algorithm corresponding to the first system. Based on this, step 330 can specifically include steps 3301 to 3303.

[0116] Step 3301: Generate a first weak password corresponding to the weak password rule according to the weak password rule.

[0117] For example, if the weak password rules include using the year (number) of the birthday as the password and converting the first digit of the year of the birthday into an English word as the password, then based on the aforementioned weak password rules, a first weak password is generated, such as "1996", "one996".

[0118] Step 3302: encrypt the first weak password using an encryption algorithm to obtain a first encrypted weak password.

[0119] Among them, the encryption algorithm includes but is not limited to the following encryption algorithms: symmetric encryption algorithm, asymmetric encryption algorithm, and hash algorithm.

[0120] Step 3303, compare the first encrypted weak password with the second password.

[0121] Exemplarily, the encrypted weak password may be compared with the encrypted second password in an encrypted environment to check whether the two are identical.

[0122] In this way, the accuracy of weak password detection can be effectively improved during the weak password encryption process.

[0123] Based on this, after step 3303, the weak password detection method provided in the embodiment of the present application may further include:

[0124] When the first encrypted weak password is the same as the second password, a warning message is displayed, and the warning message is used to prompt the user to change the second password.

[0125] Exemplarily, when the first encrypted weak password is the same as the second password, it indicates that the second password is a weak password, so as to prompt the user to adjust it.

[0126] This can prevent social workers from cracking passwords and reduce data security risks.

[0127] In some other embodiments of the present application, the second password is a password initially set by the user in the foreground password setting interface. Based on this, after step 330, the weak password detection method provided in the embodiment of the present application may further include:

[0128] When the second password matches the weak password rule, a warning message is displayed, and the warning message is used to prompt the user to change the second password.

[0129] Therefore, it is possible to avoid setting a weak password during the password setting stage, and to prevent the generation of weak passwords in advance, thereby improving the efficiency of weak password detection and reducing data security risks. Figure 5 Provide detailed explanation.

[0130] Figure 5 It is a structural diagram of a weak password detection device provided by an embodiment of the present application.

[0131] In some embodiments of the present application, Figure 5 The weak password detection device shown can be arranged in the embodiment of the present application as shown in Figure 1 The weak password detection system shown can also be set in the following example provided in this application: Figure 2 In the weak password detection system shown.

[0132] Based on this, Figure 5 As shown, the weak password detection device 50 may specifically include:

[0133] An acquisition module 501 is used to acquire user information of a user, where the user information includes a first password and user identification information of the user in each of N scenarios, where N is a positive integer;

[0134] A determination module 502, configured to determine a weak password rule corresponding to the user information based on the user information;

[0135] The detection module 503 is used to detect the second password set by the user according to the weak password rule.

[0136] In this way, the weak password detection device in the embodiment of the present application can construct weak password rules for the user according to the user identification information of the user in different scenarios, so as to realize targeted detection of the second password set by the user, avoid the possibility that the user cross-sets the second password in other scenarios through the user identification information in one scenario or the user sets the second password in the scenario through the user identification information in a certain scenario, which is easy to be cracked, and improves the accuracy and security of the second password detection set by the user. In addition, by replacing the enumeration dictionary in the prior art with weak password rules, while increasing the coverage of weak passwords, since the weak password rules are smaller than the massive preset weak passwords enumerated in the issued dictionary, the storage space can be reduced. In addition, for the process of detecting the second password through the weak password rules, the second password set by the user in the local area can be detected according to the weak password rules without the need for network connection and protocol collision, thereby improving the detection efficiency.

[0137] The weak password detection device 50 in the embodiment of the present application is described in detail below.

[0138] In some embodiments of the present application, the determination module 502 may be specifically configured to divide the text characters in the first password to obtain the first feature item;

[0139] Performing a first operation on the first feature item to obtain a second feature item, wherein the first operation includes at least one of the following items: a character deformation operation and a character type conversion operation;

[0140] A weak password rule is determined based on a matching result between the second feature item and the user identification information.

[0141] In some embodiments of the present application, the determination module 502 may be specifically configured to, when the first feature item includes a first character and the first operation includes a character deformation operation, perform a character deformation operation on the first character to obtain a second character; wherein the second character is at least one of the following characters: a character after the shape of the first character is changed, and a character after the case of the first character is converted;

[0142] Based on the second character, a second feature item corresponding to the first feature item is reconstructed.

[0143] In some embodiments of the present application, the determination module 502 may be specifically configured to, when the first feature item includes a third character and the first operation includes a character type conversion operation, perform a character type conversion operation on the third character to obtain a fourth character, the character meaning expressed by the fourth character is the same as the character meaning expressed by the third character, and the character types of the fourth character and the third character are different;

[0144] Based on the fourth character, a second feature item corresponding to the first feature item is reconstructed.

[0145] In some embodiments of the present application, the determination module 502 may be specifically configured to match the second feature item with the user identification information to obtain a matching result;

[0146] When the matching result indicates that the second feature item includes the first target feature item matching the user identification information, a weak password rule is generated based on the first target feature item.

[0147] In some embodiments of the present application, the determination module 502 may be specifically configured to extract, based on the first target feature item, a second target feature item corresponding to the first target feature item from the first password;

[0148] A weak password rule is constructed according to the first target feature item, the second target feature item, the conversion identification information of the character type from the first target feature item to the second target feature item, and the operation identification of the corresponding operation from the second target feature item to the first target feature item.

[0149] In some embodiments of the present application, the acquisition module 501 may be specifically configured to acquire user identification information from a user dictionary corresponding to the user; wherein the user dictionary includes at least one of the following: a rule dictionary, a user-defined dictionary.

[0150] In some embodiments of the present application, the acquisition module 501 may also be used to acquire user behavior data;

[0151] The weak password detection device 50 in the embodiment of the present application may further include an extraction module for extracting at least one of the following passwords from the user behavior data: a first incorrect password entered by the user when logging into the system, a second incorrect password entered by the user when resetting the password, a stored password, and an initial setting password entered by the user in the front-end password setting interface;

[0152] The determination module 502 may also be configured to determine the password as the first password.

[0153] In some embodiments of the present application, the determination module 502 can be specifically used to determine the weak password rule corresponding to the user information based on the user identification information and the rule identifier of the error cause of the incorrect password when the first password is at least one of the following incorrect passwords: a first incorrect password entered when the user logs into the system, a second incorrect password entered when the user resets the password.

[0154] In some embodiments of the present application, the determination module 502 may be specifically configured to divide the text characters in the first password to obtain the first feature item;

[0155] Performing a first operation on the first feature item to obtain a second feature item, wherein the first operation includes at least one of the following items: a character deformation operation and a character type conversion operation;

[0156] Through rule identification, the matching result of the second feature item and the user identification information is corrected to obtain a weak password rule.

[0157] In some embodiments of the present application, the detection module 503 may be specifically used to generate a first weak password corresponding to the weak password rule according to the weak password rule when the second password is a password corresponding to the first system stored in the background and the second password is a password encrypted by the encryption algorithm corresponding to the first system;

[0158] Encrypting the first weak password by using an encryption algorithm to obtain a first encrypted weak password;

[0159] Compare the first encrypted weak password with the second password.

[0160] In some embodiments of the present application, the weak password detection device 50 in the embodiments of the present application may also include a display module for displaying an alarm message when the first encrypted weak password is the same as the second password, and the alarm message is used to prompt the user to change the second password.

[0161] In some embodiments of the present application, the weak password detection device 50 in the application embodiments may also include a display module for displaying an alarm message when the second password is the password initially set by the user in the front-end password setting interface and the second password matches the weak password rule, wherein the alarm message is used to prompt the user to change the second password.

[0162] Based on the same inventive concept, the present application also provides a computer device. Figure 6 Provide detailed explanation.

[0163] Figure 6 It is a schematic diagram of the structure of a computer device provided by an embodiment of the present application.

[0164] like Figure 6 As shown, the computer device may include at least one of the following involved in the embodiments of the present application: a computer device at the user end, a computer device at the server end. The computer device may include a processor 601 and a memory 602 storing computer program instructions.

[0165] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (Application Specific Integrated Circuit (ASTC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0166] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 602 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory. In a specific embodiment, the memory 602 includes a solid-state storage (ROM). In appropriate cases, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM) or a flash memory or a combination of two or more of these.

[0167] The processor 601 implements any one of the weak password detection methods in the above embodiments by reading and executing computer program instructions stored in the memory 602 .

[0168] In one example, the computer device may further include a communication interface 603 and a bus 610. Figure 6 As shown, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 610 and communicate with each other.

[0169] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0170] Bus 610 includes hardware, software or both, and the parts of flow control device are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industry standard system (ETSA) bus, front side bus (FSB), hypertransport (HT) interconnection, industry standard system (TSA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel system (MCA) bus, peripheral component interconnection (PCT) bus, PCT-Express (PCT-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 610 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0171] The data processing device can execute the weak password detection method in the embodiment of the present application, thereby realizing the combination Figures 1 to 5 The present invention describes a method and device for detecting weak passwords.

[0172] In addition, in combination with the weak password detection method in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the weak password detection methods in the above embodiment is implemented.

[0173] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0174] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0175] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0176] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A weak password detection method, comprising: Obtaining user information of the user, the user information including a first password and user identification information of the user in each of N scenarios, where N is a positive integer; Based on the user information, determining a weak password rule corresponding to the user information; According to the weak password rule, the second password set by the user is detected.

2. The method according to claim 1, wherein: The determining, based on the user information, a weak password rule corresponding to the user information includes: Dividing the text characters in the first password to obtain a first feature item; Performing a first operation on the first feature item to obtain a second feature item, wherein the first operation includes at least one of the following items: a character deformation operation and a character type conversion operation; The weak password rule is determined according to a matching result between the second feature item and the user identification information.

3. The method according to claim 2, wherein: The first feature item includes a first character, the first operation includes the character deformation operation; and performing the first operation on the first feature item to obtain the second feature item includes: Performing a character deformation operation on the first character to obtain a second character; wherein the second character is at least one of the following characters: a character obtained by changing the shape of the first character, and a character obtained by converting the first character into uppercase and lowercase characters; Based on the second character, a second feature item corresponding to the first feature item is reconstructed.

4. The method according to claim 2 or 3, wherein: The first feature item includes a third character, the first operation includes the character type conversion operation; and performing the first operation on the first feature item to obtain the second feature item includes: Performing a character type conversion operation on the third character to obtain a fourth character, wherein the character meaning expressed by the fourth character is the same as the character meaning expressed by the third character, and the fourth character and the third character are of different character types; Based on the fourth character, a second feature item corresponding to the first feature item is reconstructed.

5. The method according to claim 2, wherein: The determining the weak password rule according to the matching result between the second feature item and the user identification information includes: Matching the second feature item with the user identification information to obtain a matching result; In a case where the matching result indicates that the second feature item includes a first target feature item matching the user identification information, the weak password rule is generated based on the first target feature item.

6. The method according to claim 5, wherein: The generating the weak password rule based on the first target feature item includes: Based on the first target feature item, extracting a second target feature item corresponding to the first target feature item from the first password; The weak password rule is constructed according to the first target feature item, the second target feature item, the conversion identification information of the character type from the first target feature item to the second target feature item, and the operation identification of the corresponding operation from the second target feature item to the first target feature item.

7. The method according to claim 1, wherein: The obtaining of user information of the user includes: The user identification information is obtained from a user dictionary corresponding to the user; wherein the user dictionary includes at least one of the following: a rule dictionary, a user-defined dictionary.

8. The method according to claim 1, wherein: Before obtaining the user information of the user, the method further includes: Obtain user behavior data; Extracting at least one of the following passwords from the user behavior data: a first incorrect password entered by the user when logging into the system, a second incorrect password entered by the user when resetting the password, a stored password, and an initial setting password entered by the user in the front-end password setting interface; The password is determined as the first password.

9. The method according to claim 1, wherein: The first password is at least one of the following incorrect passwords: a first incorrect password entered by a user when logging into the system, a second incorrect password entered by a user when resetting a password; The determining, based on the user information, a weak password rule corresponding to the user information includes: Based on the user identification information and the rule identifier of the error reason of the incorrect password, a weak password rule corresponding to the user information is determined.

10. The method according to claim 9, wherein: The step of determining a weak password rule corresponding to the user information based on the user identification information and the rule identification of the error cause of the incorrect password includes: Dividing the text characters in the first password to obtain a first feature item; Performing a first operation on the first feature item to obtain a second feature item, wherein the first operation includes at least one of the following items: a character deformation operation and a character type conversion operation; The matching result between the second feature item and the user identification information is corrected through the rule identifier to obtain the weak password rule.

11. The method according to claim 1, wherein: The second password is a password corresponding to the first system stored in the background, and the second password is a password encrypted by an encryption algorithm corresponding to the first system; The detecting the second password set by the user according to the weak password rule includes: According to the weak password rule, generating a first weak password corresponding to the weak password rule; Encrypting the first weak password by using the encryption algorithm to obtain a first encrypted weak password; The first encrypted weak password is compared with the second password.

12. The method according to claim 11, wherein: After comparing the first encrypted weak password with the second password, the method further includes: When the first encrypted weak password is the same as the second password, a warning message is displayed, where the warning message is used to prompt the user to change the second password.

13. The method according to claim 1, wherein: The second password is the password initially set by the user in the front-end password setting interface; After detecting the second password set by the user according to the weak password rule, the method further includes: When the second password matches the weak password rule, a warning message is displayed, where the warning message is used to prompt the user to change the second password.

14. A weak password detection system, comprising a user end and a server end; wherein: The server is used to obtain user information of the user from the user, the user information including a first password and user identification information of the user in each of N scenarios, where N is a positive integer; based on the user information, determine a weak password rule corresponding to the user information; Sending the weak password rule to the user terminal; The user terminal is used to receive the weak password rule sent by the server; and detect the second password set by the user in the user terminal according to the weak password rule.

15. A weak password detection device, comprising: An acquisition module, used to acquire user information of the user, wherein the user information includes a first password and user identification information of the user in each of N scenarios, where N is a positive integer; A determination module, configured to determine a weak password rule corresponding to the user information based on the user information; The detection module is used to detect the second password set by the user according to the weak password rule.

16. A computer device, the device comprising: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the steps of the weak password detection method as described in any one of claims 1-13 are implemented.

17. A storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the steps of the weak password detection method according to any one of claims 1 to 13.

18. A computer program product, characterized in that The program product is stored in a storage medium, and the program product is executed by at least one processor to implement the steps of the weak password detection method according to any one of claims 1 to 13.

Images