A weak password review system and method supporting multiple systems

Abstract

The present invention provides a weak password review system and method supporting multiple systems, which relates to the field of information security; the system of the present invention includes a scanning center, a ciphertext data management module, a service model management module, a scanning rule management module, a weak password scanner, and a report generator; the scanning center is responsible for managing the weak password review settings of users and controlling the weak password scanner to conduct reviews; the ciphertext data management module manages the service structured ciphertext data, the service model management module manages the service models corresponding to service systems, and the scanning rule management module manages the scanning rules defined by users; the weak password scanner conducts weak password scanning based on the service structured ciphertext data, service models, and scanning rules, and determines whether weak passwords exist; the present invention creatively uses service models to replace real service systems for weak password reviews, avoiding the problems brought by directly scanning service systems and improving the review efficiency and accuracy.

Description

Technical Field

[0001] The present invention relates to the field of information security, and particularly to a weak password review system and method supporting multiple systems. Background Art

[0002] When performing security detection on Web services, weak password scanning is a common means. Usually, security testers will use specialized weak password scanning tools, which are built with a large number of common username and password combination libraries. For example, common administrator usernames such as "admin" and "root", and some simple and easy-to-guess passwords such as "123456", "password", and "admin123".

[0003] During the scanning process, the tool will send a large number of username and password combinations to the login interface of the Web service to attempt to log in, and determine whether the login is successful by analyzing the login response, so as to discover whether there is a weak password vulnerability. If the login is successful, it indicates that the Web service has a weak password risk, and may be easily accessed by malicious attackers, which may lead to serious security problems such as data leakage and malicious operations.

[0004] However, this weak password scanning method has many disadvantages:

[0005] Low efficiency. Since a large number of username and password combinations need to be tried, especially in the face of a complex Web service environment or a relatively strict password policy, it may take a lot of time and computing resources, and it is not necessarily guaranteed to find all potential weak password situations.

[0006] It is easy to be detected and blocked. Web services usually set some security mechanisms, such as limiting the number of failed logins. A large number of weak password scanning attempts may trigger these security mechanisms, resulting in the IP address of the scanning tool being blocked, thus interrupting the scanning process and unable to continue with a comprehensive detection.

[0007] Limited accuracy. Even if the so-called "weak password" login is successfully detected by scanning, there may be false positives. For example, some special test environments or configurations may cause unexpected login responses to be misjudged as successful weak password logins, while in fact, it is not a real security vulnerability.

[0008] Incomplete scanning. Based on a guessing method, the tool can only perform qualitative scanning on common usernames or the collected usernames. There are still a large number of users in the system that cannot be enumerated, and there are still weak passwords.

[0009] Conventional weak password reviews are basically based on vulnerability scanning tools or brute-force cracking tools for targeted weak password blasting. This method has problems such as low efficiency and incomplete scanning when dealing with systems with a large number of users. For different systems, there may also be problems such as inability to scan and complex scanning configurations.

[0010] Therefore, the present invention provides a weak password review system and method supporting multiple systems to solve the problems of weak password scanning efficiency and scanning integrity. Summary of the Invention

[0011] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a weak password review system and method supporting multiple systems to solve the problems of weak password scanning efficiency and scanning integrity. The purpose of the present invention is achieved through the following technical solutions:

[0012] On the one hand, the present invention provides a weak password review system supporting multiple systems, including a scanning center, a ciphertext data management module, a business model management module, a scanning rule management module, a weak password scanner, and a report generator; wherein,

[0013] The scanning center is used to manage the weak password review settings of users and control the weak password scanner to conduct weak password reviews based on the weak password review settings; wherein, the weak password review settings include ciphertext data settings, business model settings, and scanning rule settings;

[0014] The ciphertext data management module is used to manage the business-structured ciphertext data submitted by users; the business model management module is used to manage the business models corresponding to the registered business systems; the scanning rule management module is used to manage the scanning rules defined and set by users;

[0015] The weak password scanner conducts weak password scanning based on the business-structured ciphertext data, business model, and scanning rules provided by the scanning center, and determines whether the corresponding weak password exists in the structured ciphertext data; the report generator obtains the scanning results of the weak password scanner and generates a corresponding weak password review report.

[0016] As a further solution, the business model management module registers business systems through business definition metadata, and the business definition metadata includes table structure information, algorithm information, salt addition information, confusion information, and offset information; wherein, the algorithm information includes general algorithm information, national cryptography algorithm information, and custom algorithm information.

[0017] As a further solution, a user data preprocessing module is also provided; wherein, the user data preprocessing module is used to remove unnecessary fields from the business-structured ciphertext data; wherein, it includes redundant fields, duplicate fields, and invalid fields.

[0018] As a further solution, the weak password scanner includes a weak password library, a weak password feature library, and a weak password comparison module; wherein, a number of weak passwords are stored in the weak password library, and a number of weak password features are stored in the weak password feature library; the weak password features are generated and set according to the corresponding weak passwords, business systems, and scanning rules; the weak password comparison module determines whether the corresponding weak password exists in the structured ciphertext data by comparing whether the weak password features appear in the structured ciphertext data.

[0019] As a further solution, the scanning center conducts information interaction with users through a graphical interaction page, including a business system registration page, a scanning rule setting page, a ciphertext data submission page, a weak password review setting page, and a review report display page; wherein, the business system registration page is used to obtain business structured ciphertext data, the scanning rule setting page is used to obtain the scanning rules defined and set by users, the ciphertext data submission page is used to obtain business structured ciphertext data, the weak password review setting page is used for users to obtain weak password review settings, and the review report display page is used to display the weak password review report to users.

[0020] As a further solution, the scanning rules include default scanning rules and custom scanning rules; wherein, the default scanning rules include table structure rules, algorithm rules, salting rules, obfuscation rules, and offset rules; the custom scanning rules include custom password header data, password tail data, and password repetition times.

[0021] As a further solution, the weak password review report includes weak password user information, weak password information, and weak password type information; wherein, the weak password information includes original password information and encrypted password information, and the weak password type information includes simple weak passwords, repeated weak passwords, and initial weak passwords.

[0022] On the other hand, a weak password review method for supporting multiple systems according to the present invention is applied to a weak password review system for supporting multiple systems as described in any one of the above, and the weak password review of the business system is performed through the following steps:

[0023] Step 1: The scanning center obtains the weak password review settings of the user; wherein, it includes ciphertext data settings, business model settings, and scanning rule settings;

[0024] Step 2: The scanning center retrieves the corresponding business structured ciphertext data according to the ciphertext data settings, retrieves the corresponding business model according to the business model settings, and retrieves the scanning rules defined and set by the user according to the scanning rule settings;

[0025] Step 3: Preprocess the business structured ciphertext data, and send the business structured ciphertext data, business model, and scanning rules to the weak password scanner;

[0026] Step 4: The weak password scanner obtains each weak password stored in the weak password library, and converts the weak password into the corresponding weak password feature according to the business model and scanning rules;

[0027] Step 5: Store each weak password feature in the weak password feature library; repeat Step 4, and after all weak password features are converted, execute Step 6;

[0028] Step 6: The weak password scanner compares the structured ciphertext data with each weak password feature in the weak password feature library respectively; if the data matches, output the corresponding weak password matching data item; otherwise, continue the data comparison until all structured ciphertext data is compared;

[0029] Step 7: The report generator obtains the scanning result of the weak password scanner, and parses the content of the weak password matching data item to generate the corresponding weak password review report;

[0030] Step 8: The scanning center displays the weak password review report to the user to complete a weak password review.

[0031] Compared with the related technologies, a weak password review system and method supporting multiple systems provided by the present invention have the following advantages:

[0032] The system of the present invention includes a scanning center, a ciphertext data management module, a business model management module, a scanning rule management module, a weak password scanner, and a report generator. The scanning center is responsible for managing the weak password review settings of users and controlling the weak password scanner to conduct reviews. The ciphertext data management module manages the business structured ciphertext data, the business model management module manages the business models corresponding to business systems, and the scanning rule management module manages the scanning rules defined by users. The weak password scanner conducts weak password scanning according to the business structured ciphertext data, business model, and scanning rules, and judges whether there is a weak password. The report generator obtains the scanning result and generates a review report; the present invention creatively uses a business model to replace the real business system for weak password review, avoiding the problems brought by directly scanning the business system, improving the review efficiency and accuracy; the system also simplifies the review process through cloud services, and improves the scanning efficiency through the user data preprocessing module. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic structural diagram of a weak password review system supporting multiple systems provided by the present invention;

[0034] Figure 2Schematic diagram of the steps of a weak password review method supporting multiple systems provided by the present invention. Detailed implementation manners

[0035] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. Components of the embodiments of the present invention generally described and illustrated in the drawings herein may be arranged and designed in a variety of different configurations.

[0036] Please refer to Figure 1 , the present invention provides a weak password review system supporting multiple systems, including a scanning center, a ciphertext data management module, a service model management module, a scanning rule management module, a weak password scanner, and a report generator; wherein,

[0037] The scanning center is used to manage the weak password review settings of users and control the weak password scanner to perform weak password review based on the weak password review settings; wherein, the weak password review settings include ciphertext data settings, service model settings, and scanning rule settings;

[0038] The ciphertext data management module is used to manage the service-structured ciphertext data submitted by users; the service model management module is used to manage the service models corresponding to the registered service systems; the scanning rule management module is used to manage the scanning rules defined and set by users;

[0039] The weak password scanner performs weak password scanning based on the service-structured ciphertext data, service model, and scanning rules provided by the scanning center, and determines whether the corresponding weak password exists in the structured ciphertext data; the report generator obtains the scanning results of the weak password scanner and generates a corresponding weak password review report.

[0040] It should be noted that: the traditional weak password review method directly performs weak password scanning on the service system. This method will increase the working burden of the service system, and since there are many other mechanisms in the real service system, it may lead to the situation that we may not be able to achieve weak password scanning, or even if we can scan, we may not be able to find potential weak password situations.

[0041] In addition, since the review process involves frequent read and write interactions of password information, it may also trigger the protection mechanism of the business system, resulting in the review system being blocked or restricted by the business system; the scanning process is also based on guesswork and can only qualitatively scan common user names or the collected user names. There are still a large number of users in the system that cannot be enumerated, and there are still weak passwords; moreover, sometimes, due to some unclear mechanisms, the test environment or configuration may cause an unexpected login response to be misjudged as a successful login with a weak password, while in fact, it is not a real security vulnerability.

[0042] Therefore, in this embodiment, the method of registering the business system as a business model is adopted. The business model is used to replace the real business system to cooperate with the weak password review, thus avoiding many problems of directly scanning the weak password for the business system; the business system is manually filled in by the user to declare the main features of the business password data (the filled features can be streamlined into the most important features. We can judge whether there are missing features or extra features by testing whether the features can complete the mapping feedback of the real business system, and continuously adjust to obtain the most important features), and stored in the database in the form of a form, including the table structure field information of the ciphertext data, as well as the algorithm of the encryption information, the salt field, the corresponding obfuscation information, the offset, and other key information. After filling in, the scanning center determines the business system that conforms to the rule according to the declared rule.

[0043] Through the above process, we obtain the most important features (i.e., the business model) that can truly reflect the business system's processing of ciphertext data. In specific implementation, the business model management module registers the business system through business definition metadata, and the business definition metadata includes table structure information, algorithm information, salt information, obfuscation information, and offset information; among them, the algorithm information includes general algorithm information, national cryptography algorithm information, and custom algorithm information.

[0044] At this time, we still cannot directly scan the business model because the business model at this time only describes the ciphertext processing paradigm of the corresponding business system. We still need to combine specific ciphertext data (weak password) and scanning rules to obtain the real feature data corresponding to the ciphertext (weak password); then compare the weak password features corresponding to the weak password with the actual business structured ciphertext data to find out whether there is ciphertext data that conforms to the weak password features in the business structured ciphertext data (i.e., there is a weak password).

[0045] Note: The business structured ciphertext data here can be exported by users in the business system background. They usually do not exist in plaintext form, so they cannot be directly scanned for weak passwords. Instead, the weak passwords need to be converted into corresponding weak password features before matching to find out whether there are weak passwords in the business structured ciphertext data. Among them, the business structured ciphertext data can be understood as a user-password (non-plaintext) comparison table, represented in the form of csv or xsls.

[0046] For example, in an actual business scenario, common methods encapsulated in the development language can be directly referenced. For example, the simplest and most commonly used md5 algorithm is used to encrypt the weak password 123456. Using the Python development language, the following steps are taken:

[0047] import hashlib

[0048] # Create an MD5 object

[0049] md5 = hashlib.md5()

[0050] # The string to be encrypted, here it is '123456', which needs to be converted to byte type (because the encryption function requires an input byte stream)

[0051] data = '123456'.encode('utf-8')

[0052] # Use the update method to pass the data into the MD5 object for encryption

[0053] md5.update(data)

[0054] # Get the final MD5 encryption result, presented in the form of a hexadecimal string

[0055] encrypted_result = md5.hexdigest()

[0056] print(encrypted_result)

[0057] # The ciphertext result output by encrypted_result is the weak password feature of '123456' under the md5 algorithm.

[0058] From the above examples, it is not difficult for us to see that the weak password feature = business model + weak password + scanning rules for configuration. We use this processing logic to obtain the ciphertext data of the corresponding password to generate a weak password feature library, and then use the weak password feature library to quickly compare with the password ciphertext field in the form data submitted by the user through methods such as Memory-Mapping. The intersection part will meet the weak password feature, which is the weak password.

[0059] Since we have registered the business system before, the scanning center can normally parse the structured ciphertext data of the business, know the business model, including the table structure field information of the ciphertext data, as well as the algorithm of the encryption information, the salt field and the corresponding obfuscation information and offset and other key information. These key information will assemble a specific business so that the scanning center can identify, so as to quickly realize a business system declaration that needs to be scanned. This ensures that the ciphertext generated by the same plaintext is consistent, and can quickly realize the business declaration based on the algorithms already available in the system without the need to change the code layer, thereby increasing the generality of the review system and reducing the workload; before performing the scan, we also need to set the corresponding scanning rules, such as password complexity, custom password prefix and suffix, password length and other information, for configuring some personalized scans.

[0060] In addition, this embodiment can also provide a scanning center service in the cloud (such as set up using the C / S or B / S architecture), so that users do not need to configure a weak password scanning tool locally, thus greatly simplifying the review process and review work; during the implementation process, we also set up a user data preprocessing module to remove unnecessary fields in the business structured ciphertext data, thereby reducing the scanning workload and improving the scanning efficiency.

[0061] Please refer to Figure 2 , the present invention also provides a weak password review method supporting multiple systems, which is applied to a weak password review system supporting multiple systems as described in any one of the above, and performs a weak password review on the business system through the following steps:

[0062] Step 1: The scanning center obtains the weak password review settings of the user; among them, including ciphertext data settings, business model settings and scanning rule settings;

[0063] Step 2: The scanning center retrieves the corresponding business structured ciphertext data according to the ciphertext data settings, retrieves the corresponding business model according to the business model settings, and retrieves the scanning rules defined by the user according to the scanning rule settings;

[0064] Step 3: Perform a preprocessing operation on the business structured ciphertext data, and send the business structured ciphertext data, business model and scanning rules to the weak password scanner;

[0065] Step 4: The weak password scanner obtains each weak password stored in the weak password library, and converts the weak password into the corresponding weak password feature according to the service model and scanning rules;

[0066] Step 5: Store each weak password feature in the weak password feature library; repeat Step 4, and execute Step 6 after all weak password features are converted;

[0067] Step 6: The weak password scanner compares the structured ciphertext data with each weak password feature in the weak password feature library respectively; if the data matches, output the corresponding weak password matching data item; otherwise, continue the data comparison until all structured ciphertext data is compared;

[0068] Step 7: The report generator obtains the scanning result of the weak password scanner, parses the content of the weak password matching data item, and generates the corresponding weak password review report;

[0069] Step 8: The scanning center displays the weak password review report to the user to complete a weak password review.

[0070] It should be noted that: The weak password scanner combines based on three core data: the service model, the weak password library, and the custom rules. It will generate a weak password ciphertext set corresponding to the service according to the common weak password library (which contains many common weak passwords), the information configured by the custom weak password scanning rules, and the meta information during service registration, and then perform comparison scanning.

[0071] During scanning, based on the declared scanning service, the weak password library, and the custom rules, generate a set of information with weak password features and then perform scanning; because the comparison scanning method is adopted, compared with traditional scanning tools, it can completely enumerate the passwords of users in the system, avoid circular and guessing scanning, and greatly improve the scanning results and efficiency; the report generator outputs the final weak password audit result for the scanning result, including the weak password list and the corresponding user information, which is convenient for subsequent rectification.

[0072] The above embodiments only express relatively preferred implementation manners, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention patent. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of the present invention, several deformations and improvements can still be made, and these all belong to the protection scope of the present invention.

Claims

1. A weak password review system supporting multiple systems, characterized in that, It includes a scanning center, a ciphertext data management module, a business model management module, a scanning rule management module, a weak password scanner, and a report generator; among them, the scanning center is used to manage the weak password review settings of users and control the weak password scanner to conduct weak password reviews based on the weak password review settings; among them, the weak password review settings include ciphertext data settings, business model settings, and scanning rule settings; the ciphertext data management module is used to manage the business structured ciphertext data submitted by users; the business model management module is used to manage the business models corresponding to the registered business systems; the scanning rule management module is used to manage the scanning rules defined and set by users; the weak password scanner conducts weak password scans based on the business structured ciphertext data, business models, and scanning rules provided by the scanning center, and judges whether the corresponding weak password exists in the structured ciphertext data; the report generator obtains the scan results of the weak password scanner and generates the corresponding weak password review report.

2. The weak password review system supporting multiple systems according to claim 1, characterized in that, The business model management module registers business systems through business definition metadata, and the business definition metadata includes table structure information, algorithm information, salt addition information, confusion information, and offset information; among them, the algorithm information includes general algorithm information, national cryptography algorithm information, and custom algorithm information.

3. The weak password review system supporting multiple systems according to claim 1, characterized in that, A user data preprocessing module is also provided; among them, the user data preprocessing module is used to remove unnecessary fields from the business structured ciphertext data; among them, it includes redundant fields, duplicate fields, and invalid fields.

4. A weak password review system supporting multiple systems according to claim 1, characterized in that, The weak password scanner includes a weak password library, a weak password feature library, and a weak password comparison module; among them, several weak passwords are stored in the weak password library, and several weak password features are stored in the weak password feature library; the weak password features are generated and set according to the corresponding weak passwords, business systems, and scanning rules; the weak password comparison module judges whether the corresponding weak password exists in the structured ciphertext data by comparing whether the weak password features appear in the structured ciphertext data.

5. The weak password review system supporting multiple systems according to claim 1, characterized in that, The scanning center conducts information interaction with users through a graphical interaction page, including a business system registration page, a scanning rule setting page, a ciphertext data submission page, a weak password review setting page, and a review report display page; among them, the business system registration page is used to obtain business structured ciphertext data, the scanning rule setting page is used to obtain the scanning rules defined and set by users, the ciphertext data submission page is used to obtain business structured ciphertext data, the weak password review setting page is used for users to obtain weak password review settings, and the review report display page is used to display the weak password review report to users.

6. The weak password review system supporting multiple systems according to claim 1, characterized in that, The scanning rules include default scanning rules and custom scanning rules; among them, the default scanning rules include table structure rules, algorithm rules, salt addition rules, confusion rules, and offset rules; the custom scanning rules include custom password header data, password tail data, and password repetition times.

7. A weak password review system supporting multiple systems according to claim 1, characterized in that, The weak password review report includes weak password user information, weak password information, and weak password type information; among them, the weak password information includes original password information and encrypted password information, and the weak password type information includes simple weak passwords, repeated weak passwords, and initial weak passwords.

8. A weak password review method supporting multiple systems, which is applied to a weak password review system supporting multiple systems as described in any one of claims 1 to 7, characterized in that, The weak password review of the business system is carried out through the following steps: Step 1: The scanning center obtains the weak password review settings of the user; among them, it includes ciphertext data settings, business model settings, and scanning rule settings; Step 2: The scanning center retrieves the corresponding business structured ciphertext data according to the ciphertext data settings, retrieves the corresponding business model according to the business model settings, and retrieves the scanning rules defined by the user according to the scanning rule settings; Step 3: Perform preprocessing operations on the business structured ciphertext data, and send the business structured ciphertext data, business model, and scanning rules to the weak password scanner; Step 4: The weak password scanner obtains each weak password stored in the weak password library, and converts the weak password into the corresponding weak password feature according to the business model and scanning rules; Step 5: Store each weak password feature in the weak password feature library; repeat Step 4, and execute Step 6 after all weak password feature conversions are completed; Step 6: The weak password scanner compares the structured ciphertext data with each weak password feature in the weak password feature library respectively; if the data matches, output the corresponding weak password matching data item; otherwise, continue to perform the data comparison until all structured ciphertext data comparisons are completed; Step 7: The report generator obtains the scanning results of the weak password scanner, and parses the content of the weak password matching data item to generate the corresponding weak password review report; Step 8: The scanning center displays the weak password review report to the user, completing one weak password review.

Images