Weak password identification method and device, computer equipment, computer readable storage medium and computer program product

Abstract

The invention relates to a weak password identification method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a large batch of structured query language data, and segmenting the large batch of structured query language data into a plurality of single structured query statements; determining a statement type to which each structured query statement belongs; extracting password information from the structured query statement of which the statement type is a target type, wherein the target type represents a statement type related to a database account password; and verifying the password strength of the password information to obtain a weak password identification result corresponding to the password information. By the adoption of the method, batch processing of the structured query statements can be achieved by segmenting a large batch of data, the objects needing weak password recognition are screened through the statement types, and therefore the weak password recognition efficiency is greatly improved.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a weak password identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In today's database management systems, users can easily use Structured Query Language (SQL) to perform some data operations. However, if the account password used by the user in SQL is a weak password with a low data security factor, it is easy to be cracked by illegal users. This will cause the database management system to crash or even cause serious consequences such as data leakage. Therefore, it is necessary to manually check or periodically scan weak passwords in database account passwords.

[0003] However, since the manual inspection and periodic scanning methods in traditional technologies can only process one piece of data at a time and often take a long time, there is an urgent need for a more efficient weak password identification method. Summary of the invention

[0004] Based on this, it is necessary to provide a more efficient weak password identification method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0005] In a first aspect, the present application provides a method for identifying a weak password, comprising:

[0006] Acquire a large batch of structured query language data, and divide the large batch of structured query language data into a plurality of single structured query statements;

[0007] Determining the statement type to which each of the structured query statements belongs;

[0008] Extracting password information from a structured query statement whose statement type is a target type, wherein the target type represents a statement type involving a database account password;

[0009] The password strength of the password information is verified to obtain a weak password identification result corresponding to the password information.

[0010] In one embodiment, determining the statement type of each structured query statement includes:

[0011] Performing lexical analysis on each of the structured query statements to obtain morphemes in each of the structured query statements;

[0012] Performing grammatical analysis on each of the structured query statements according to the morphemes to obtain grammatical rules matching each of the structured query statements;

[0013] According to the correspondence between the preset grammatical rules and the statement types, the statement type corresponding to the grammatical rule of each structured query statement is determined.

[0014] In one embodiment, the lexical analysis is performed on each structured query statement to obtain morphemes in each structured query statement, and the syntax analysis is performed on each structured query statement according to the morphemes to obtain syntax rules matching each structured query statement, including:

[0015] Determine a data source corresponding to each of the structured query statements;

[0016] Using a lexical analyzer corresponding to the data source to perform lexical analysis on each of the structured query statements to obtain morphemes in each of the structured query statements;

[0017] A syntax parser corresponding to the data source is used to perform syntax parsing on each of the structured query statements according to the morphemes to obtain a syntax rule matching each of the structured query statements.

[0018] In one embodiment, the step of obtaining a large batch of structured query language data and dividing the large batch of structured query language data into a plurality of single structured query statements includes:

[0019] Determining the number of characters in the large batch of structured query language data;

[0020] When the number of characters is less than a preset character threshold, segmenting the large batch of structured query language data to obtain a large batch of structured query statements;

[0021] When the number of the large batch of structured query statements is less than the preset number of statements, a subsequent operation of determining the statement type to which each structured query statement belongs is performed on each single structured query statement.

[0022] In one embodiment, the checking the password strength of the password information to obtain a weak password identification result corresponding to the password information includes:

[0023] Determining the password length of the password information and the character data used in the password information;

[0024] Generate a length verification result corresponding to the password information according to a comparison result between the password length and a preset length threshold;

[0025] Generating a character verification result corresponding to the password information according to the character type, arrangement order and number of repetitions of the character data;

[0026] The weak password recognition result is obtained according to the length check result and the character check result.

[0027] In one embodiment, the method further comprises:

[0028] Intercepting the large batch of structured query language data sent by the client;

[0029] In the case where the weak password identification result is confirmed as a weak password, the execution of the structured query statement corresponding to the weak password identification result is blocked, and weak password risk prompt information corresponding to the structured query statement is returned to the client.

[0030] In a second aspect, the present application also provides a weak password identification device, comprising:

[0031] A data acquisition module, used to acquire a large batch of structured query language data, and divide the large batch of structured query language data into a plurality of single structured query statements;

[0032] A type identification module, used to determine the statement type to which each structured query statement belongs;

[0033] A password extraction module, used to extract password information from a structured query statement whose statement type is a target type, wherein the target type represents a statement type involving a database account password;

[0034] The strength verification module is used to verify the password strength of the password information and obtain a weak password identification result corresponding to the password information.

[0035] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for identifying weak passwords as described in any one of the embodiments of the first aspect is implemented.

[0036] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for identifying weak passwords described in any one of the embodiments of the first aspect above is implemented.

[0037] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the method for identifying weak passwords described in any one of the embodiments of the first aspect above is implemented.

[0038] The above-mentioned weak password identification method, device, computer equipment, computer-readable storage medium and computer program product obtain a large amount of structured query language data, divide the large amount of structured query language data into multiple single structured query statements; determine the statement type to which each structured query statement belongs; extract password information from the structured query statement whose statement type is a target type, and the target type represents the statement type involving the database account password; verify the password strength of the password information to obtain a weak password identification result corresponding to the password information, and can realize batch processing of structured query statements by dividing large amounts of data, and screen objects that need to be weak password identified by statement type, thereby greatly improving the efficiency of weak password identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A diagram of an application environment of a weak password identification method in an embodiment;

[0041] Figure 2 A schematic diagram of a weak password identification method in one embodiment;

[0042] Figure 3 A schematic diagram of a flow chart of a statement type determination step in one embodiment;

[0043] Figure 4 A flowchart of lexical analysis and grammatical parsing steps in one embodiment;

[0044] Figure 5 A schematic diagram of a flow chart of a structured query language data segmentation step in one embodiment;

[0045] Figure 6 A schematic diagram of a process for generating a weak password identification result in one embodiment;

[0046] Figure 7 A schematic diagram of a flow chart of a weak password identification method in another embodiment;

[0047] Figure 8 is a structural block diagram of a weak password identification device 800 in one embodiment;

[0048] Fig. 9FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In today's database management systems, the following problems are often prone to occur:

[0050] 1. Weak password security risk. Existing database management systems usually lack real-time weak password detection mechanisms. When users create or change database users, if they use weak passwords, it is easy to cause data leakage, tampering or other security issues.

[0051] 2. Lack of efficient password strength detection. Current weak password identification methods usually rely on manual checking or periodic scanning by users. However, manual checking is inefficient and time-consuming. Periodic scanning takes up a lot of resources and easily affects the data processing efficiency of computer equipment. Once the scanning service is abnormal, weak password problems will still occur. As a result, the generation of weak passwords cannot be prevented in time.

[0052] 3. Parsing of complex and diverse structured query statements. In large-scale database systems, database structured query statements submitted by users may contain a large number of commands involving user account operations. In the prior art, such as the database development tool Oracle SQL Developer, because it mainly interacts with the database Oracle, there is a problem of lack of extensive support for common structured query statements of other data sources. Or, for example, the dynamic data management framework Apache Calcite, which is mainly used for database query optimization and execution, but its static analysis of security is insufficient.

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0055] The weak password identification method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Specifically, the server 104 can establish data communication with the terminal 102, obtain a large amount of structured query language data sent by the terminal 102 from the data communication, and divide the large amount of structured query language data into multiple single structured query statements. The server 104 can determine the statement type to which each structured query statement belongs. The server 104 can extract password information from the structured query statement whose statement type is the target type, wherein the target type can be used to characterize the statement type involving the database account password. The server 104 can verify the password strength of the password information and obtain a weak password identification result corresponding to the password information. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. The portable wearable device may be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device may be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0056] In an exemplary embodiment, Figure 2 As shown, a weak password identification method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps S202 to S208. Among them:

[0057] Step S202: obtaining a large batch of structured query language data, and dividing the large batch of structured query language data into a plurality of single structured query statements.

[0058] Among them, Structured Query Language (SQL) is a database query and programming language that can be used to access data as well as query, update and manage relational database systems.

[0059] A structured query statement can be used to represent a single programming statement written in structured query language.

[0060] Exemplarily, the server may intercept a data communication request sent by the terminal, parse the data communication request to obtain a large batch of structured query language data, and divide the large batch of structured query language data into multiple single structured query statements.

[0061] Step S204: determine the statement type to which each structured query statement belongs.

[0062] Among them, statement types may include but are not limited to Data Definition Language (DDL, used to define database objects such as databases, tables, and fields), Data Manipulation Language (DML, used to add, delete, and modify data in database tables), Data Query Language (DQL, used to query records in tables in the database), Data Control Language (DCL, used to create database users and control database access permissions), etc.

[0063] Optionally, in some embodiments, the server may store function types corresponding to each statement type. According to the function name carried in each structured query statement, the statement type to which each structured query statement belongs is matched. Alternatively, in other embodiments, the server may also store character strings corresponding to each statement type. According to the matching between the characters in each structured query statement and the stored character strings, the statement type corresponding to each structured query statement is determined.

[0064] Step S206, extracting password information from a structured query statement whose statement type is a target type, where the target type represents a statement type involving a database account password.

[0065] For example, the server can pre-configure statement types involving database account passwords (such as data control language type DCL) as target types that require weak password identification. The following processing operations are performed on structured query statements belonging to the target type: identify the password field in the structured query statement, and extract the password information carried by the structured query statement from the password field.

[0066] Step S208, verifying the password strength of the password information to obtain a weak password identification result corresponding to the password information.

[0067] Exemplarily, the server may store weak password identification rules, including two categories: positive matching rules and negative matching rules. When the password strength of the password information is verified using the positive matching rule, if the password information hits the positive matching rule, it means that the password strength of the password information is low. When the password strength of the password information is verified using the negative matching rule, if the password information hits the negative matching rule, it means that the password strength of the password information is high. In the case where the password strength of the password information is low, the weak password identification result corresponding to the password information can be obtained as confirmed as a weak password, otherwise, the weak password identification result can be obtained as confirmed as a non-weak password.

[0068] In the above-mentioned weak password identification method, a large amount of structured query language data is obtained, and the large amount of structured query language data is divided into multiple single structured query statements; the statement type to which each structured query statement belongs is determined; password information is extracted from the structured query statement whose statement type is a target type, and the target type represents the statement type involving the database account password; the password strength of the password information is verified to obtain a weak password identification result corresponding to the password information. Batch processing of structured query statements can be achieved by segmenting large amounts of data, and objects that need to be weak password identified can be screened by statement type, thereby greatly improving the efficiency of weak password identification.

[0069] In an exemplary embodiment, Figure 3 As shown, step S204 includes steps S302 to S306. Among them:

[0070] Step S302: Perform lexical analysis on each structured query statement to obtain morphemes in each structured query statement.

[0071] Among them, morphemes can be used to represent the smallest meaningful basic unit in a structured query statement.

[0072] Exemplarily, the server may convert each structured query statement into a corresponding character sequence, and perform word segmentation processing on the character sequence corresponding to each structured query statement to obtain the morphemes in each structured query statement.

[0073] Step S304: perform grammatical analysis on each structured query statement according to the morphemes to obtain grammatical rules matching each structured query statement.

[0074] Among them, grammar rules can be used to define the program structure and organization of structured query statements.

[0075] For example, the server may perform top-down or top-down syntax analysis on each structured query statement according to the morphemes carried in each structured query statement, the positions of the morphemes, and the combinations between the morphemes, to obtain syntax rules matching each structured query statement.

[0076] Step S306: Determine the statement type corresponding to the grammatical rule of each structured query statement according to the correspondence between the preset grammatical rules and the statement types.

[0077] Exemplarily, the server may pre-store grammar rules corresponding to each statement type. According to the correspondence between the preset grammar rules and statement types, and the grammar rules used by each structured query statement, the statement type to which each structured query statement belongs may be determined.

[0078] In this embodiment, the statement type to which each structured query statement belongs is determined by means of lexical analysis and syntax parsing, which can improve the efficiency and accuracy of determining the statement type.

[0079] In an exemplary embodiment, Figure 4 As shown, a method for implementing lexical analysis and grammatical parsing operations is also provided, including the following steps S402 to S406. Among them:

[0080] Step S402: determine the data source corresponding to each structured query statement.

[0081] Exemplarily, the server may store data types or data query ranges corresponding to a plurality of heterogeneous data sources. The data source corresponding to each structured query statement may be determined by matching the data type or data query range in each structured query statement with the data type or data query range corresponding to the data source.

[0082] Step S404: Use a lexical analyzer corresponding to the data source to perform lexical analysis on each structured query statement to obtain morphemes in each structured query statement.

[0083] Step S406: Use a syntax parser corresponding to the data source to perform syntax parsing on each structured query statement according to morphemes to obtain syntax rules matching each structured query statement.

[0084] Exemplarily, the server may store a custom configuration file of the structured query statement grammar corresponding to each data source, and the custom configuration file may include definition information and usage rules for grammatical rules and morphemes used. A lexical analyzer and a grammatical parser corresponding to each data source may be generated according to the custom configuration file. The server may use the lexical analyzer corresponding to the data source to perform lexical analysis on each structured query statement to obtain the morphemes in each structured query statement. The grammatical parser corresponding to the data source may be used to perform grammatical parsing on each structured query statement according to the morphemes to obtain grammatical rules matching each structured query statement.

[0085] In this embodiment, by determining the data source corresponding to each structured query statement, and using the lexical analyzer and syntax parser corresponding to the data source to perform lexical analysis and syntax parsing on each structured query statement, the weak password identification method can be adapted to a variety of heterogeneous data sources, thereby improving the flexibility and scalability of the weak password identification method.

[0086] In an exemplary embodiment, Figure 5 As shown, step S202 may include the following steps S502 to S506. Among them:

[0087] Step S502: determine the number of characters in the large batch of structured query language data.

[0088] Step S504 , when the number of characters is less than a preset character threshold, segmenting the large batch of structured query language data to obtain a large batch of structured query statements.

[0089] Exemplarily, a preset character threshold (e.g., 10,000) that can be processed by a single weak password identification operation may be stored in the server. The server may detect the number of characters in the large batch of structured query language data. The number of characters is compared with the preset character threshold. When the number of characters in the large batch of structured query language data is less than the preset character threshold, the large batch of structured query language data is segmented to obtain a large batch of structured query statements.

[0090] Step S506 , when the number of the large batch of structured query statements is less than the preset number of statements, a subsequent operation of determining the statement type to which each structured query statement belongs is performed on each single structured query statement.

[0091] Exemplarily, the server may store a preset number of single structured query statements that can be processed by a single weak password identification operation (e.g., 100). The number of statements in the large batch of structured query statements currently obtained by segmentation is counted. The number of statements is compared with the preset number of statements. When the number of statements in the large batch of structured query statements is less than the preset number of statements, a subsequent operation of determining the statement type to which each structured query statement belongs is performed on each single structured query statement.

[0092] Optionally, in some embodiments, when the number of characters in a large batch of structured query language data is greater than a preset character threshold, the large batch of structured query language data may be processed in batches according to the preset character threshold. Similarly, in other embodiments, when the number of sentences in a large batch of structured query sentences is greater than a preset sentence number, the large batch of structured query sentences may be processed in batches according to the preset sentence number.

[0093] In this embodiment, the amount of data that can be processed at one time is limited by presetting a character threshold and a preset number of statements, which can prevent excessive structured query data in extreme cases from causing a long parsing time, thereby ensuring the execution efficiency and timely response of weak password identification.

[0094] In an exemplary embodiment, Figure 6 As shown, step S208 may include the following steps S602 to S608. Among them:

[0095] Step S602, determining the password length of the password information and the character data used in the password information.

[0096] Step S604: Generate a length verification result corresponding to the password information according to the comparison result between the password length and the preset length threshold.

[0097] Exemplarily, the server may store a shortest preset length threshold. The password length of the password information is compared with the shortest preset length threshold. When the password length is less than the shortest preset length threshold, the length check result corresponding to the generated password information is confirmed as a weak password, otherwise, the length check result corresponding to the generated password information is confirmed as a non-weak password.

[0098] Optionally, in some embodiments, the server may further store a longest preset length threshold. The password length of the password information is compared with the longest preset length threshold. When the password length is greater than the longest preset length threshold, the length check result corresponding to the password information is generated as abnormal password length.

[0099] Step S606, generating a character verification result corresponding to the password information according to the character type, arrangement order and number of repetitions of the character data.

[0100] Exemplarily, the server may store a preset number of types corresponding to character types. When the character types of the character data in the password information are less than the preset number of types, the character verification result corresponding to the generated password information is confirmed as a weak password, otherwise, the generated character verification result is confirmed as a non-weak password.

[0101] The server may store a continuity check rule corresponding to the arrangement order. According to the sorting order of the character data, the continuous characters in the password information are determined. If the continuous characters do not meet the continuity check rule, the character check result corresponding to the generated password information is confirmed as a weak password, otherwise, the character check result is generated as a confirmation as a non-weak password.

[0102] The server may store a maximum preset number threshold corresponding to a single character. The server may determine the repeated characters in the password information according to the number of repetitions of the character data. When the number of repetitions of the repeated characters is greater than the preset number threshold, or when the repeated characters appear continuously, the character verification result corresponding to the generated password information is confirmed as a weak password, otherwise, the generated character verification result is confirmed as a non-weak password.

[0103] Step S608, obtaining a weak password identification result according to the length check result and the character check result.

[0104] Exemplarily, the server may obtain a weak password identification result corresponding to the structured query statement as a weak password if either the length check result or the character check result is confirmed as a weak password; otherwise, the server obtains a corresponding weak password identification result as a non-weak password.

[0105] Optionally, in some embodiments, the server may further store a weak password dictionary. The character data of the password information is matched with the weak password dictionary. When it is determined that the character data hits any data in the weak password dictionary, a weak password recognition result is generated to confirm that the password is a weak password; otherwise, a corresponding weak password recognition result is obtained to confirm that the password is not a weak password.

[0106] In this embodiment, by implementing password strength verification on password information according to password length and character data, the accuracy of weak password recognition results can be improved.

[0107] In an exemplary embodiment, the provided weak password identification method may also include: intercepting large quantities of structured query language data sent by the client; when the weak password identification result is confirmed as a weak password, preventing the execution of the structured query statement corresponding to the weak password identification result, and returning weak password risk warning information corresponding to the structured query statement to the client.

[0108] Exemplarily, the server may intercept a large batch of structured query language data sent by the client, and adopt the method for generating weak password identification results provided in the above embodiment to obtain a weak password identification result corresponding to a single structured query statement in the large batch of structured query language data. If the weak password identification result is confirmed as a weak password, the execution of the structured query statement corresponding to the weak password identification result is blocked, and weak password risk warning information corresponding to the structured query statement is returned to the client.

[0109] Optionally, in some implementations, when the weak password identification result is confirmed as a non-weak password, the server may continue to execute the structured query statement and return a data query result corresponding to the structured query statement to the client.

[0110] In this embodiment, by intercepting large quantities of structured query language data sent by the client, preventing the execution of structured query statements carrying weak passwords, and returning weak password risk warning information to the client, the successful execution of structured query operations carrying weak passwords can be avoided, effectively ensuring the data security of database account passwords.

[0111] In an exemplary embodiment, Figure 7 As shown, a method for identifying weak passwords is also provided, including the following steps S702 to S718. Among them:

[0112] Step S702: intercepting a large amount of structured query language data sent by the client.

[0113] Exemplarily, the server may be deployed with a full-duplex communication (WebSocket) connection layer. Before the client shakes hands with the server, the full-duplex communication connection layer is used to intercept the full-duplex communication request sent by the client and set the user context. After the connection between the client and the server is established, the user context is set in the context information of the current session, and the instance validity of the user context is verified. In the case of an instance validity exception or a user login exception, an exception message is sent to the client and the current session is terminated. When the instance is verified to exist and has a valid user login status, the transmission of a large amount of structured query language data sent by the client to the parser (ANTLR) parsing layer is completed.

[0114] Step S704 , when the number of characters in the large batch of structured query language data is less than a preset character threshold, the large batch of structured query language data is segmented to obtain a large batch of structured query statements.

[0115] Exemplarily, the server may be deployed with a syntax analyzer (ANTLR) parsing layer. When it is determined that the number of characters in the large batch of structured query language data is less than a preset character threshold (e.g., 10,000), the syntax analyzer parsing layer is used to segment the large batch of structured query language data to obtain a large batch of structured query statements.

[0116] Step S706, when the number of the large batch of structured query statements is less than the preset number of statements, determine the data source corresponding to each single structured query statement.

[0117] Step S708: Use a lexical analyzer corresponding to the data source to perform lexical analysis on each structured query statement to obtain morphemes in each structured query statement.

[0118] Step S710: Use a syntax parser corresponding to the data source to perform syntax parsing on each structured query statement according to morphemes to obtain syntax rules matching each structured query statement.

[0119] Step S712: Determine the statement type corresponding to the grammatical rule of each structured query statement according to the correspondence between the preset grammatical rules and the statement type.

[0120] Step S714, extracting password information from a structured query statement whose statement type is a target type, where the target type represents a statement type involving a database account password.

[0121] Exemplarily, when the number of statements in a large batch of structured query statements is less than the preset number of statements (e.g., 100), the server can use the parsing layer of the grammar analyzer to adapt the data source type of each single structured query statement from the code level to determine the data source corresponding to each single structured query statement. The lexical analyzer corresponding to the data source is used to perform lexical analysis, and the grammar parser corresponding to the data source is used to perform grammar parsing based on the morphemes obtained from the lexical analysis to obtain grammar rules that match each structured query statement. According to the correspondence between the preset grammar rules and the statement type, the statement type corresponding to the grammar rule of each structured query statement is determined. Furthermore, the password information is extracted from the "password" field in the structured query statement whose statement type is the target type (such as the data control language type DCL), and the target type represents the statement type involving the database account password.

[0122] Step S716, verifying the password strength of the password information according to the password length and character data of the password information, and obtaining a weak password identification result corresponding to the password information.

[0123] Exemplarily, the server may be deployed with a password security policy (PASSAY) verification layer. The server may use the password security policy verification layer to read the minimum password length (e.g., 8) and the password strength configuration (e.g., configuration information that divides the password strength from weak to strong into 0, 1, and 2). The minimum password length is used as the preset length threshold to verify the password length of the password information and obtain the length verification result of the password information. The character data used in the password information is verified by using regular expression check, number of character types, continuous character check, repeated character check, and common weak password dictionary check methods to obtain the character verification result of the password information. According to the length verification result and the character verification result, the password information of multiple single structured query statements is divided into three levels of 0, 1, and 2 from weak to strong. When the strength level of the password information is 0, the weak password recognition result is confirmed as a weak password, otherwise, the weak password recognition result is confirmed as a non-weak password.

[0124] Optionally, in some embodiments, when the password length of the password information is less than the minimum password length, or the character data of the password information belongs to less than three types of characters, or the character data of the password information matches a weak password dictionary, the weak password identification result is confirmed as a weak password.

[0125] Optionally, in some implementations, the server may also obtain a password verification policy customized according to user needs, and use the password verification policy to update the weak password identification rules of the password security policy verification layer.

[0126] Step S718: When the weak password identification result is confirmed as a weak password, the execution of the structured query statement corresponding to the weak password identification result is blocked, and weak password risk prompt information corresponding to the structured query statement is returned to the client.

[0127] Exemplarily, when the weak password identification result is confirmed as a weak password, the server may prevent the execution of the structured query statement corresponding to the weak password identification result, and simultaneously transmit the weak password risk warning information in the structured query statement communication link to the client through the full-duplex communication connection layer to ensure the normal execution of the remaining structured query statements.

[0128] In this embodiment, by intercepting a large amount of structured query language data sent by the client, the data volume of a single weak password identification is determined according to a preset character threshold and a preset number of statements to avoid a long structured query language data parsing time. By using a lexical analyzer and a syntax parser corresponding to the data source to identify the statement type of the structured query statement, the structured query statement under the target type involving the database account password is intercepted for processing. This can not only adapt to a variety of heterogeneous data sources and improve the flexibility and scalability of weak password identification, but also reduce the data volume of weak password identification. By verifying the password strength according to the password length and character data, the accuracy of weak password identification can be improved, and the generation of weak password accounts can be eliminated from the bottom layer, thereby greatly improving the security of the database.

[0129] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the indications of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0130] Based on the same inventive concept, the embodiment of the present application also provides a weak password identification device for implementing the weak password identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more weak password identification device embodiments provided below can refer to the limitations of the weak password identification method above, and will not be repeated here.

[0131] In an exemplary embodiment, Figure 8 As shown, a weak password identification device 800 is provided, comprising: a data acquisition module 802, a type identification module 804, a password extraction module 806 and a strength verification module 808, wherein:

[0132] The data acquisition module 802 is used to acquire a large batch of structured query language data and divide the large batch of structured query language data into multiple single structured query statements.

[0133] The type identification module 804 is used to determine the statement type to which each structured query statement belongs.

[0134] The password extraction module 806 is used to extract password information from a structured query statement whose statement type is a target type, where the target type represents a statement type involving a database account password.

[0135] The strength verification module 808 is used to verify the password strength of the password information and obtain a weak password identification result corresponding to the password information.

[0136] In an exemplary embodiment, the type identification module 804 is used to: perform lexical analysis on each structured query statement to obtain morphemes in each structured query statement; perform grammatical analysis on each structured query statement based on the morphemes to obtain grammatical rules that match each structured query statement; and determine the statement type corresponding to the grammatical rules of each structured query statement based on the correspondence between preset grammatical rules and statement types.

[0137] In an exemplary embodiment, the type identification module 804 is also used to: determine the data source corresponding to each structured query statement; use the lexical analyzer corresponding to the data source to perform lexical analysis on each structured query statement to obtain the morphemes in each structured query statement; use the syntax parser corresponding to the data source to perform syntax analysis on each structured query statement according to the morphemes to obtain the syntax rules that match each structured query statement.

[0138] In an exemplary embodiment, the data acquisition module 802 is used to: determine the number of characters in a large batch of structured query language data; when the number of characters is less than a preset character threshold, segment the large batch of structured query language data to obtain a large batch of structured query statements; when the number of statements in the large batch of structured query statements is less than a preset number of statements, perform a subsequent operation of determining the statement type to which each structured query statement belongs on each single structured query statement.

[0139] In an exemplary embodiment, the strength verification module 808 is used to: determine the password length of the password information and the character data used in the password information; generate a length verification result corresponding to the password information based on the comparison result of the password length and a preset length threshold; generate a character verification result corresponding to the password information based on the character type, arrangement order and number of repetitions of the character data; and obtain a weak password identification result based on the length verification result and the character verification result.

[0140] In an exemplary embodiment, the weak password identification device 800 also includes an information feedback module for intercepting large quantities of structured query language data sent by the client; when the weak password identification result is confirmed as a weak password, the execution of the structured query statement corresponding to the weak password identification result is blocked, and weak password risk warning information corresponding to the structured query statement is returned to the client.

[0141] Each module in the weak password identification device 800 can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0142] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store large quantities of structured query language data, single structured query statements, statement types, password information, weak password identification results and other data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a weak password identification method is implemented.

[0143] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0144] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0145] In an exemplary embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0146] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0147] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0148] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0149] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying weak passwords, characterized in that: The method comprises: Acquire a large batch of structured query language data, and divide the large batch of structured query language data into a plurality of single structured query statements; Determining the statement type to which each of the structured query statements belongs; Extracting password information from a structured query statement whose statement type is a target type, wherein the target type represents a statement type involving a database account password; The password strength of the password information is verified to obtain a weak password identification result corresponding to the password information.

2. The method according to claim 1, characterized in that Determining the statement type to which each structured query statement belongs includes: Performing lexical analysis on each of the structured query statements to obtain morphemes in each of the structured query statements; Performing grammatical analysis on each of the structured query statements according to the morphemes to obtain grammatical rules matching each of the structured query statements; According to the correspondence between the preset grammatical rules and the statement types, the statement type corresponding to the grammatical rule of each structured query statement is determined.

3. The method according to claim 2, characterized in that The step of performing lexical analysis on each structured query statement to obtain morphemes in each structured query statement, and performing grammatical analysis on each structured query statement according to the morphemes to obtain grammatical rules matching each structured query statement includes: Determine a data source corresponding to each of the structured query statements; Using a lexical analyzer corresponding to the data source to perform lexical analysis on each of the structured query statements to obtain morphemes in each of the structured query statements; A syntax parser corresponding to the data source is used to perform syntax parsing on each of the structured query statements according to the morphemes to obtain a syntax rule matching each of the structured query statements.

4. The method according to claim 1, characterized in that: The step of obtaining a large batch of structured query language data and dividing the large batch of structured query language data into a plurality of single structured query statements includes: Determining the number of characters in the large batch of structured query language data; When the number of characters is less than a preset character threshold, segmenting the large batch of structured query language data to obtain a large batch of structured query statements; When the number of the large batch of structured query statements is less than the preset number of statements, a subsequent operation of determining the statement type to which each structured query statement belongs is performed on each single structured query statement.

5. The method according to claim 1, characterized in that The verifying the password strength of the password information to obtain a weak password identification result corresponding to the password information includes: Determining the password length of the password information and the character data used in the password information; Generate a length verification result corresponding to the password information according to a comparison result between the password length and a preset length threshold; Generating a character verification result corresponding to the password information according to the character type, arrangement order and number of repetitions of the character data; The weak password recognition result is obtained according to the length check result and the character check result.

6. The method according to claim 1, characterized in that The method further comprises: Intercepting the large batch of structured query language data sent by the client; In the case where the weak password identification result is confirmed as a weak password, the execution of the structured query statement corresponding to the weak password identification result is blocked, and weak password risk prompt information corresponding to the structured query statement is returned to the client.

7. A weak password identification device, characterized in that: The device comprises: A data acquisition module, used to acquire a large batch of structured query language data, and divide the large batch of structured query language data into a plurality of single structured query statements; A type identification module, used to determine the statement type to which each structured query statement belongs; A password extraction module, used to extract password information from a structured query statement whose statement type is a target type, wherein the target type represents a statement type involving a database account password; The strength verification module is used to verify the password strength of the password information and obtain a weak password identification result corresponding to the password information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images