Weak password review system and method supporting multiple systems

Abstract

The invention provides a weak password review system and method supporting multiple systems, and relates to the field of information security. The system comprises a scanning center, a ciphertext data management module, a business model management module, a scanning rule management module, a weak password scanner and a report generator. The scanning center is responsible for managing weak password review setting of the user and controlling the weak password scanner to review; the ciphertext data management module manages service structured ciphertext data, the service model management module manages a service model corresponding to a service system, and the scanning rule management module manages a scanning rule defined by a user; the weak password scanner scans the weak password according to the business structured ciphertext data, the business model and the scanning rule, and judges whether the weak password exists or not; according to the invention, the business model is creatively adopted to replace a real business system to carry out weak password review, the problem caused by directly scanning the business system is avoided, and the review efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a weak password review system and method supporting multiple systems. Background Art

[0002] When performing security testing on Web services, weak password scanning is a common method. Usually, security testers use special weak password scanning tools, which have a large number of common username and password combination libraries built in, such as common administrator usernames such as "admin" and "root", and some simple and easy-to-guess passwords such as "123456", "password", "admin123", etc.

[0003] During the scanning process, the tool will send a large number of username and password combinations to the login interface of the Web service to try to log in, and analyze the login response to determine whether the login is successful, so as to find out whether there is a weak password vulnerability. If the login is successful, it means that the Web service has a weak password risk, which may be easily obtained by malicious attackers, which may lead to serious security issues such as data leakage and malicious operations.

[0004] However, this weak password scanning method has many disadvantages:

[0005] Inefficiency: Because a large number of username and password combinations need to be tried, especially in complex Web service environments or when password policies are strict, it may take a lot of time and computing resources, and it may not necessarily find all potential weak passwords.

[0006] Easy to be detected and blocked, Web services usually set some security mechanisms, such as limiting the number of failed logins, etc. A large number of weak password scanning attempts may trigger these security mechanisms, causing the IP address of the scanning tool to be blocked, thereby interrupting the scanning process and making it impossible to continue comprehensive detection.

[0007] The accuracy is limited, and even if the scan finds a so-called "weak password" login success, there may be false positives. For example, some special test environments or configurations may cause unexpected login responses to be mistakenly identified as weak password successful logins, which are not actually real security vulnerabilities.

[0008] The scan is incomplete. The tool is based on guesswork and can only perform qualitative scans on common usernames or collected usernames. There are a large number of users in the system that cannot be enumerated and there are still weak passwords.

[0009] Conventional weak password reviews are basically based on targeted weak password blasting using vulnerability scanning tools or brute force cracking tools. This method has problems such as low efficiency and incomplete scanning when applied to systems with a large number of users. It may also be impossible to scan different systems and the scanning configuration may be complex.

[0010] Therefore, the present invention provides a weak password review system and method that supports multiple systems to solve the problems of weak password scanning efficiency and scanning integrity. Summary of the invention

[0011] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a weak password review system and method supporting multiple systems to solve the problems of weak password scanning efficiency and scanning integrity; the purpose of the present invention is achieved through the following technical solutions:

[0012] On the one hand, the present invention provides a weak password review system supporting multiple systems, including a scanning center, a ciphertext data management module, a business model management module, a scanning rule management module, a weak password scanner and a report generator; wherein,

[0013] The scanning center is used to manage the user's weak password review settings, and control the weak password scanner to perform weak password review based on the weak password review settings; wherein the weak password review settings include ciphertext data settings, business model settings, and scanning rule settings;

[0014] The ciphertext data management module is used to manage the business structured ciphertext data submitted by users; the business model management module is used to manage the business models corresponding to the registered business systems; the scanning rule management module is used to manage the scanning rules defined by users;

[0015] The weak password scanner performs weak password scanning according to the business structured ciphertext data, business model and scanning rules provided by the scanning center to determine whether the corresponding weak password exists in the structured ciphertext data; the report generator obtains the scanning results of the weak password scanner and generates a corresponding weak password review report.

[0016] As a further solution, the business model management module registers the business system through business definition metadata, and the business definition metadata includes table structure information, algorithm information, salting information, obfuscation information and offset information; wherein, the algorithm information includes general algorithm information, national secret algorithm information and custom algorithm information.

[0017] As a further solution, a user data preprocessing module is also provided; wherein, the user data preprocessing module is used to remove non-essential fields in the business structured ciphertext data; wherein, the non-essential fields include redundant fields, repeated fields and invalid fields.

[0018] As a further solution, the weak password scanner includes a weak password library, a weak password feature library and a weak password comparison module; wherein, the weak password library stores a number of weak passwords, and the weak password feature library stores a number of weak password features; the weak password features are generated and set according to the corresponding weak passwords, business systems and scanning rules; the weak password comparison module determines whether the corresponding weak password exists in the structured ciphertext data by comparing whether the weak password features appear in the structured ciphertext data.

[0019] As a further solution, the scanning center interacts with users through graphical interactive pages, including a business system registration page, a scanning rule setting page, a ciphertext data submission page, a weak password review setting page and a review report display page; wherein, the business system registration page is used to obtain business structured ciphertext data, the scanning rule setting page is used to obtain user-defined scanning rules, the ciphertext data submission page is used to obtain business structured ciphertext data, the weak password review setting page allows users to obtain weak password review settings, and the review report display page is used to display weak password review reports to users.

[0020] As a further solution, the scanning rules include default scanning rules and custom scanning rules; wherein, the default scanning rules include table structure rules, algorithm rules, salting rules, obfuscation rules and offset rules; the custom scanning rules include custom password header data, password tail data and password repetition times.

[0021] As a further solution, the weak password review report includes weak password user information, weak password password information, and weak password type information; wherein the weak password password information includes original password information and encrypted password information, and the weak password type information includes simple weak passwords, repeated weak passwords, and initial weak passwords.

[0022] On the other hand, the present invention provides a weak password review method supporting multiple systems, which is applied to a weak password review system supporting multiple systems as described in any one of the above items, and performs weak password review on the business system through the following steps:

[0023] Step 1: The scanning center obtains the user's weak password review settings, including ciphertext data settings, business model settings, and scanning rule settings;

[0024] Step 2: The scanning center retrieves the corresponding business structured ciphertext data according to the ciphertext data settings, retrieves the corresponding business model according to the business model settings, and retrieves the user-defined scanning rules according to the scanning rule settings;

[0025] Step 3: Preprocess the business structured ciphertext data, and send the business structured ciphertext data, business model and scanning rules to the weak password scanner;

[0026] Step 4: The weak password scanner obtains each weak password stored in the weak password database, and converts the weak password into corresponding weak password features according to the business model and scanning rules;

[0027] Step 5: Store each weak password feature in the weak password feature library; repeat step 4, and execute step 6 after completing the conversion of all weak password features;

[0028] Step 6: The weak password scanner compares the structured ciphertext data with each weak password feature in the weak password feature library; if the data matches, the corresponding weak password matching data item is output; otherwise, the data comparison is continued until the data comparison of all structured ciphertext data is completed;

[0029] Step 7: The report generator obtains the scan results of the weak password scanner, performs content analysis on the weak password matching data items, and generates a corresponding weak password review report;

[0030] Step 8: The scanning center displays the weak password review report to the user, completing a weak password review.

[0031] Compared with the related art, the weak password review system and method supporting multiple systems provided by the present invention has the following advantages:

[0032] The system of the present invention includes a scanning center, a ciphertext data management module, a business model management module, a scanning rule management module, a weak password scanner and a report generator. The scanning center is responsible for managing the user's weak password review settings and controlling the weak password scanner to conduct reviews. The ciphertext data management module manages business structured ciphertext data, the business model management module manages the business model corresponding to the business system, and the scanning rule management module manages user-defined scanning rules. The weak password scanner scans weak passwords according to the business structured ciphertext data, the business model and the scanning rules, and determines whether the weak password exists. The report generator obtains the scanning results and generates a review report; the present invention creatively uses a business model to replace the real business system for weak password review, avoiding the problems caused by directly scanning the business system and improving the review efficiency and accuracy; the system also simplifies the review process through cloud services and improves the scanning efficiency through the user data preprocessing module. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of the structure of a weak password review system supporting multiple systems provided by the present invention;

[0034] Figure 2A schematic diagram of the steps of a weak password review method supporting multiple systems provided by the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0036] See also Figure 1 The present invention provides a weak password review system supporting multiple systems, including a scanning center, a ciphertext data management module, a business model management module, a scanning rule management module, a weak password scanner and a report generator; wherein,

[0037] The scanning center is used to manage the user's weak password review settings, and control the weak password scanner to perform weak password review based on the weak password review settings; wherein the weak password review settings include ciphertext data settings, business model settings, and scanning rule settings;

[0038] The ciphertext data management module is used to manage the business structured ciphertext data submitted by users; the business model management module is used to manage the business models corresponding to the registered business systems; the scanning rule management module is used to manage the scanning rules defined by users;

[0039] The weak password scanner performs weak password scanning according to the business structured ciphertext data, business model and scanning rules provided by the scanning center to determine whether the corresponding weak password exists in the structured ciphertext data; the report generator obtains the scanning results of the weak password scanner and generates a corresponding weak password review report.

[0040] It should be noted that the traditional weak password review method is to directly scan the business system for weak passwords. This method will increase the workload of the business system, and because there are many other mechanisms in the real business system, we may not be able to implement weak password scanning. Even if we can scan, we may not be able to find potential weak passwords.

[0041] In addition, since the review process involves frequent password information reading and writing interactions, it may also trigger the protection mechanism of the business system, causing the review system to be banned or restricted by the business system; the scanning process is also based on guesswork, and can only perform qualitative scanning on common user names or collected user names. There are a large number of users in the system that cannot be enumerated, and there are still weak passwords; and sometimes, due to some unclear mechanisms, the test environment or configuration may cause unexpected login responses to be misjudged as successful logins with weak passwords, which are not actually real security vulnerabilities.

[0042] To this end, this embodiment adopts a method of registering a business system as a business model, and uses a business model to replace the real business system to cooperate with weak password review, thereby avoiding many problems of directly scanning the business system for weak passwords; the business system is manually filled in by the user to declare the main features of the business password data (the filled in features can be simplified to the most important features. We can determine whether there are missing features or over-written features by testing whether the features can complete the mapping feedback of the real business system, and continuously adjust to obtain the most important features), and store them in the database in the form of a form, including the table structure field information of the ciphertext data, as well as the encryption information algorithm, the salt field and the corresponding obfuscation information and offset and other key information. After filling in, the scanning center determines that the system complies with the rules according to the declared rules.

[0043] Through the above process, we have obtained the most important feature (i.e., business model) that can truly feedback the business system's processing of encrypted data. In the specific implementation, the business model management module registers the business system through the business definition metadata. The business definition metadata includes table structure information, algorithm information, salting information, obfuscation information, and offset information; among them, the algorithm information includes general algorithm information, national secret algorithm information, and custom algorithm information.

[0044] At this point, we cannot directly scan the business model, because the business model at this point only describes the ciphertext processing paradigm of the corresponding business system. We also need to combine the specific ciphertext data (weak password) and scanning rules to obtain the real feature data that can reflect the ciphertext (weak password); then compare the weak password features corresponding to the weak password with the actual business structured ciphertext data to find out whether there is ciphertext data that meets the weak password features in the business structured ciphertext data (that is, there is a weak password).

[0045] Note: The business structured ciphertext data here can be exported by users in the business system background. They are usually not in plain text, so weak passwords cannot be scanned directly. Instead, weak passwords need to be converted into corresponding weak password features. Only then can the weak password features be matched to find out whether there are weak passwords in the business structured ciphertext data. Among them, the business structured ciphertext data can be understood as a user-password (non-plain text) comparison table, which is expressed in csv or xsls format.

[0046] For example, in an actual business scenario, the common methods encapsulated by the development language can be directly referenced, such as the simplest and most commonly used md5 algorithm, which encrypts the weak password 123456 using the python development language and the following steps:

[0047] import hashlib

[0048] #Create an MD5 object

[0049] md5 = hashlib.md5()

[0050] #The string to be encrypted, here is '123456', which needs to be converted to byte type (because the encryption function requires input byte stream)

[0051] data='123456'.encode('utf-8')

[0052] #Use the update method to pass data into the MD5 object for encryption

[0053] md5.update(data)

[0054] #Get the final MD5 encryption result, presented in the form of a hexadecimal string

[0055] encrypted_result=md5.hexdigest()

[0056] print(encrypted_result)

[0057] #The ciphertext output by encrypted_result is '123456', which is a weak password feature under the md5 algorithm.

[0058] From the above example, it is not difficult to see that weak password characteristics = business model + weak password + scanning rule configuration. We use this processing logic to obtain the ciphertext data of the corresponding password to generate a weak password feature library, and then use the weak password feature library and the password ciphertext field in the form data submitted by the user to perform a quick comparison through methods such as Memory-Mapping. The intersection part will meet the weak password characteristics, that is, the weak password.

[0059] Since we have registered the business system before, the scanning center can parse the structured ciphertext data of the business normally, and know the business model, including the table structure field information of the ciphertext data, as well as the encryption information algorithm, the salt field and the corresponding obfuscation information and offset and other key information. These key information will assemble a specific business so that the scanning center can recognize it, so as to quickly realize a business system declaration that needs to be scanned. This ensures that the ciphertext generated by the same plaintext is consistent, and can realize fast business declaration based on the algorithm that the system already has, without making changes at the code level, thereby increasing the versatility of the review system and reducing the workload; before performing the scan, we also need to set the corresponding scanning rules, such as password complexity, custom password prefixes and suffixes, password length and other information, to configure some personalized scans.

[0060] In addition, this embodiment can also provide a scanning center service in the cloud (such as using a C / S or B / S architecture), so that users do not need to configure weak password scanning tools locally, thereby greatly simplifying the review process and review work; during the implementation process, we also set up a user data preprocessing module to remove non-essential fields in the business structured ciphertext data, thereby reducing the scanning workload and improving scanning efficiency.

[0061] See also Figure 2 The present invention also provides a weak password review method supporting multiple systems, which is applied to a weak password review system supporting multiple systems as described in any of the above items, and performs weak password review on the business system through the following steps:

[0062] Step 1: The scanning center obtains the user's weak password review settings, including ciphertext data settings, business model settings, and scanning rule settings;

[0063] Step 2: The scanning center retrieves the corresponding business structured ciphertext data according to the ciphertext data settings, retrieves the corresponding business model according to the business model settings, and retrieves the user-defined scanning rules according to the scanning rule settings;

[0064] Step 3: Preprocess the business structured ciphertext data, and send the business structured ciphertext data, business model and scanning rules to the weak password scanner;

[0065] Step 4: The weak password scanner obtains each weak password stored in the weak password database, and converts the weak password into corresponding weak password features according to the business model and scanning rules;

[0066] Step 5: Store each weak password feature in the weak password feature library; repeat step 4, and execute step 6 after completing the conversion of all weak password features;

[0067] Step 6: The weak password scanner compares the structured ciphertext data with each weak password feature in the weak password feature library; if the data matches, the corresponding weak password matching data item is output; otherwise, the data comparison is continued until the data comparison of all structured ciphertext data is completed;

[0068] Step 7: The report generator obtains the scan results of the weak password scanner, performs content analysis on the weak password matching data items, and generates a corresponding weak password review report;

[0069] Step 8: The scanning center displays the weak password review report to the user, completing a weak password review.

[0070] It should be noted that the weak password scanner is based on a combination of three core data: business model, weak password library, and custom rules. It will generate a weak password ciphertext set that corresponds to the business based on the common weak password library (which contains many common weak passwords) and the information configured by the custom weak password scanning rules as well as the meta-information during business registration, and then perform a comparison scan.

[0071] During scanning, based on the declared scanning business, weak password library, and custom rules, an information set with weak password characteristics is generated for scanning; because of the comparison scanning method, compared with traditional scanning tools, it can completely enumerate the passwords of users in the system, avoid circular and guesswork scanning, and greatly improve scanning results and efficiency; the report generator outputs the final weak password audit results based on the scanning results, including a weak password list and corresponding user information, to facilitate subsequent rectification.

[0072] The above embodiments only express preferred implementation modes, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention.

Claims

1. A weak password review system supporting multiple systems, characterized in that: It includes scanning center, ciphertext data management module, business model management module, scanning rule management module, weak password scanner and report generator; among them, The scanning center is used to manage the user's weak password review settings, and control the weak password scanner to perform weak password review based on the weak password review settings; wherein the weak password review settings include ciphertext data settings, business model settings, and scanning rule settings; The ciphertext data management module is used to manage the business structured ciphertext data submitted by users; the business model management module is used to manage the business models corresponding to the registered business systems; the scanning rule management module is used to manage the scanning rules defined by users; The weak password scanner performs weak password scanning according to the business structured ciphertext data, business model and scanning rules provided by the scanning center to determine whether the corresponding weak password exists in the structured ciphertext data; the report generator obtains the scanning results of the weak password scanner and generates a corresponding weak password review report.

2. According to claim 1, a weak password review system supporting multiple systems is characterized in that: The business model management module registers the business system through business definition metadata, and the business definition metadata includes table structure information, algorithm information, salting information, obfuscation information and offset information; wherein the algorithm information includes general algorithm information, national secret algorithm information and custom algorithm information.

3. According to claim 1, a weak password review system supporting multiple systems is characterized in that: A user data preprocessing module is also provided, wherein the user data preprocessing module is used to remove non-essential fields in the business structured ciphertext data, including redundant fields, repeated fields and invalid fields.

4. According to claim 1, a weak password review system supporting multiple systems is characterized in that: The weak password scanner includes a weak password library, a weak password feature library and a weak password comparison module; wherein, the weak password library stores a number of weak passwords, and the weak password feature library stores a number of weak password features; the weak password features are generated and set according to the corresponding weak passwords, business systems and scanning rules; the weak password comparison module determines whether the corresponding weak password exists in the structured ciphertext data by comparing whether the weak password features appear in the structured ciphertext data.

5. According to the weak password review system supporting multiple systems as described in claim 1, it is characterized in that: The scanning center interacts with users through graphical interactive pages, including a business system registration page, a scanning rule setting page, a ciphertext data submission page, a weak password review setting page and a review report display page; wherein the business system registration page is used to obtain business structured ciphertext data, the scanning rule setting page is used to obtain user-defined scanning rules, the ciphertext data submission page is used to obtain business structured ciphertext data, the weak password review setting page allows users to obtain weak password review settings, and the review report display page is used to display weak password review reports to users.

6. A weak password review system supporting multiple systems according to claim 1, characterized in that: The scanning rules include default scanning rules and custom scanning rules; wherein the default scanning rules include table structure rules, algorithm rules, salting rules, obfuscation rules and offset rules; the custom scanning rules include custom password header data, password tail data and password repetition times.

7. A weak password review system supporting multiple systems according to claim 1, characterized in that: The weak password review report includes weak password user information, weak password password information, and weak password type information; wherein the weak password password information includes original password information and encrypted password information, and the weak password type information includes simple weak passwords, repeated weak passwords, and initial weak passwords.

8. A weak password review method supporting multiple systems, applied to a weak password review system supporting multiple systems as claimed in any one of claims 1 to 7, characterized in that: Perform weak password review on the business system through the following steps: Step 1: The scanning center obtains the user's weak password review settings, including ciphertext data settings, business model settings, and scanning rule settings; Step 2: The scanning center retrieves the corresponding business structured ciphertext data according to the ciphertext data settings, retrieves the corresponding business model according to the business model settings, and retrieves the user-defined scanning rules according to the scanning rule settings; Step 3: Preprocess the business structured ciphertext data, and send the business structured ciphertext data, business model and scanning rules to the weak password scanner; Step 4: The weak password scanner obtains each weak password stored in the weak password database, and converts the weak password into corresponding weak password features according to the business model and scanning rules; Step 5: Store each weak password feature in the weak password feature library; repeat step 4, and execute step 6 after completing the conversion of all weak password features; Step 6: The weak password scanner compares the structured ciphertext data with each weak password feature in the weak password feature library; if the data matches, the corresponding weak password matching data item is output; otherwise, the data comparison is continued until the data comparison of all structured ciphertext data is completed; Step 7: The report generator obtains the scan results of the weak password scanner, performs content analysis on the weak password matching data items, and generates a corresponding weak password review report; Step 8: The scanning center displays the weak password review report to the user, completing a weak password review.

Images