Commercial password security automatic evaluation method

Abstract

The invention discloses a commercial password security automatic evaluation method, and belongs to the technical field of commercial password security evaluation, and the method comprises the following steps: S1, collecting a historical commercial password sample; s2, intercepting a plurality of passwords to form a character string; s3, calculating the correlation degree between character strings formed by the passwords; s4, acquiring an attacked historical commercial password sample; s5, intercepting a password composition character string which is the same as the plurality of password composition character strings; s6, calculating the risk degree of character strings formed by the passwords; s7, generating an expert database based on the character strings formed by the multiple passwords, the association degree between the character strings formed by the passwords and the risk degree of the character strings formed by the passwords; s8, intercepting the commercial password based on the password composition character strings in the expert database, and summing the risk degrees of the plurality of password composition character strings intercepted based on the commercial password to evaluate the security of the commercial password; according to the method, the commercial password of any combination can be evaluated, the application range is wide, meanwhile, the evaluation participation data volume can be reduced, and the evaluation efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of commercial password security assessment, and specifically relates to an automated commercial password security assessment method. Background Art

[0002] Commercial encryption refers to technologies, products and services that use specific transformation methods to encrypt and protect information that is not a state secret and provide security authentication.

[0003] Users generally need to set a commercial password when using commercial devices. The security of the commercial password can effectively regulate the use of commercial devices and effectively protect the user's information security. Therefore, when users set a commercial password, the commercial device will perform a security assessment on the commercial password.

[0004] Currently, when commercial equipment evaluates the security of commercial passwords, they generally only evaluate the security of pure digital commercial passwords as high risk, and the security of other combined commercial passwords as low risk. It is impossible to accurately evaluate the risk of the security of other combined commercial passwords, and the scope of application is small. Summary of the invention

[0005] To solve the problems raised in the above background technology, the present invention provides an automated commercial password security assessment method, which can assess any combination of commercial passwords, has a wide range of applications, and can reduce the amount of data involved in the assessment and improve the assessment efficiency.

[0006] To achieve the above object, the present invention provides the following technical solution: a method for automatically evaluating the security of commercial encryption, comprising the following steps:

[0007] S1: Collect historical commercial password samples;

[0008] S2: traverse the historical commercial password samples through the traversal algorithm and extract multiple passwords to form a string;

[0009] S3: calculating the correlation between the password component strings based on the connection between the intercepted multiple password component strings;

[0010] S4: Collect samples of historical commercial cryptographic codes that have been attacked;

[0011] S5: traverse the attacked historical commercial password samples based on the password component strings through a traversal algorithm, and extract the password component strings that are the same as the multiple password component strings;

[0012] S6: Calculate the risk level of each password component string based on the intercepted multiple password component strings;

[0013] S7: Generate an expert database based on the plurality of password component strings, the correlation between the password component strings, and the risk level of the password component strings;

[0014] S8: When the security of a commercial password is automatically assessed, the commercial password is intercepted based on the password component character string in the expert database, and the security of the commercial password is assessed and output based on the sum of the risk levels of multiple password component character strings intercepted from the commercial password.

[0015] Furthermore, the specific steps of step S2 include:

[0016] S21: Obtain two historical commercial password samples;

[0017] S22: traverse the character strings of the two historical commercial password samples through a traversal algorithm. If the two historical commercial password samples have the same character string, cut the front and back character strings of the same character string of the two historical commercial password samples respectively, delete any one of the same character strings in the two historical commercial password samples, and keep the other character strings. If the two historical commercial password samples do not have the same character string, obtain two historical commercial password samples again and repeat the above steps.

[0018] S23: This process is deduced in this way until the password component character strings of all historical commercial password samples are intercepted, that is, multiple password component character strings are intercepted.

[0019] Furthermore, the specific steps of step S3 include:

[0020] S31: If the intercepted multiple password component strings belong to the same historical commercial password, then there is an initial connection between the intercepted multiple password component strings, that is, there is an initial preset association value between the multiple password component strings; if the intercepted multiple password component strings do not belong to the same historical commercial password, then there is a subsequent connection between the intercepted multiple password component strings, that is, a preset association value is added to the initial preset association value between the multiple password component strings, and the association value is the association degree;

[0021] S32: This process is repeated in this way until all the character strings that make up the multiple passwords are associated.

[0022] Furthermore, the specific steps of step S6 include: the intercepted multiple password component character strings all have an initial preset risk value, and each password component character string is attacked once, that is, a preset increased risk value is added to the initial preset risk value, and the risk value is the risk degree.

[0023] Furthermore, in step S8, after the commercial password intercepts the first password component string, the second password component string is intercepted and first searched within the password component string that has a correlation with the first password component string. If not, search outside, and so on, until the last password component string is intercepted and stopped.

[0024] Compared with the prior art, the present invention has the following beneficial effects:

[0025] The present invention collects historical commercial password samples for traversal and interception to obtain multiple password component strings, then generates the correlation between each password component string based on the connection between the multiple password component strings, then collects attacked historical commercial password samples for traversal and interception to obtain multiple password component strings that are the same as the aforementioned password component strings, then generates the risk between each password component string based on the number of times the multiple password component strings have been attacked, generates an expert database based on the multiple password component strings, the correlation and the risk, then intercepts the commercial password to be evaluated based on the password component strings in the expert database, and performs risk assessment based on the risk of the intercepted multiple password component strings. The method can evaluate commercial passwords of any combination and has a wide range of applications. At the same time, the interception of the commercial password to be evaluated is to preferentially query within the password component string with a correlation with the previously intercepted password component string, which can reduce the amount of data involved in the evaluation and improve the evaluation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 The present invention is a flowchart of the method for automatically evaluating the security of commercial encryption. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] See also Figure 1 The present invention provides the following technical solution: a method for automatically evaluating the security of a commercial password, comprising the following steps:

[0029] S1: Collect historical commercial password samples;

[0030] S2: traverse the historical commercial password samples through the traversal algorithm and extract multiple passwords to form a string;

[0031] S21: Obtain two historical commercial password samples;

[0032] S22: traverse the character strings of the two historical commercial password samples through a traversal algorithm. If the two historical commercial password samples have the same character string, cut the front and back character strings of the same character string of the two historical commercial password samples respectively, delete any one of the same character strings in the two historical commercial password samples, and keep the other character strings. If the two historical commercial password samples do not have the same character string, obtain two historical commercial password samples again and repeat the above steps.

[0033] S23: This process is repeated in this way until the password component character strings of all historical commercial password samples are intercepted, that is, multiple password component character strings are intercepted;

[0034] S3: calculating the correlation between the password component strings based on the connection between the intercepted multiple password component strings;

[0035] S31: If the intercepted multiple password component strings belong to the same historical commercial password, then there is an initial connection between the intercepted multiple password component strings, that is, there is an initial preset association value between the multiple password component strings; if the intercepted multiple password component strings do not belong to the same historical commercial password, then there is a subsequent connection between the intercepted multiple password component strings, that is, a preset association value is added to the initial preset association value between the multiple password component strings, and the association value is the association degree;

[0036] S32: This process is repeated until all the character strings that make up the multiple passwords are associated;

[0037] The initial preset correlation value and the preset increased correlation value are both manually set before the evaluation;

[0038] S4: Collect samples of historical commercial cryptographic codes that have been attacked;

[0039] S5: traverse the attacked historical commercial password samples based on the password component strings through a traversal algorithm, and extract the password component strings that are the same as the multiple password component strings;

[0040] S6: Calculate the risk level of each password component string based on the intercepted multiple password component strings;

[0041] The intercepted multiple password component strings all have an initial preset risk value. When each password component string is attacked once, the preset additional risk value is added to the initial preset risk value. The risk value is the risk degree.

[0042] The initial preset risk value and the preset increased risk value are both manually set before the assessment;

[0043] S7: Generate an expert database based on the plurality of password component strings, the correlation between the password component strings, and the risk level of the password component strings;

[0044] S8: When the security of a commercial password is automatically assessed, the commercial password is intercepted based on the password component character string in the expert database, and the security of the commercial password is assessed and output based on the sum of the risk levels of multiple password component character strings intercepted from the commercial password;

[0045] After intercepting the first password component string of the commercial password, the second password component string is intercepted by first searching within the password component string that has a correlation with the first password component string. If not found, it will search outside, and so on, until the last password component string is intercepted and stopped.

[0046] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for automatically evaluating the security of commercial encryption, characterized in that: The following steps are involved: S1: Collect historical commercial password samples; S2: traverse the historical commercial password samples through the traversal algorithm and extract multiple passwords to form a string; S3: calculating the correlation between the password component strings based on the connection between the intercepted multiple password component strings; S4: Collect historical commercial password samples that have been attacked; S5: traverse the historical commercial password samples attacked based on the password component strings through a traversal algorithm, and extract the password component strings that are the same as the multiple password component strings; S6: Calculate the risk level of each password component string based on the intercepted multiple password component strings; S7: Generate an expert database based on the plurality of password component strings, the correlation between the password component strings, and the risk level of the password component strings; S8: When the security of a commercial password is automatically assessed, the commercial password is intercepted based on the password component character string in the expert database, and the security of the commercial password is assessed and output based on the sum of the risk levels of multiple password component character strings intercepted from the commercial password.

2. The method for automated assessment of commercial password security according to claim 1, characterized in that: The specific steps of step S2 include: S21: Obtain two historical commercial password samples; S22: traverse the character strings of the two historical commercial password samples through a traversal algorithm. If the two historical commercial password samples have the same character string, cut the front and back character strings of the same character string of the two historical commercial password samples respectively, delete any one of the same character strings in the two historical commercial password samples, and keep the other character strings. If the two historical commercial password samples do not have the same character string, obtain two historical commercial password samples again and repeat the above steps. S23: This process is deduced in this way until the password component character strings of all historical commercial password samples are intercepted, that is, multiple password component character strings are intercepted.

3. The method for automated security assessment of commercial encryption according to claim 1, characterized in that: The specific steps of step S3 include: S31: If the intercepted multiple password component strings belong to the same historical commercial password, then there is an initial connection between the intercepted multiple password component strings, that is, there is an initial preset association value between the multiple password component strings; if the intercepted multiple password component strings do not belong to the same historical commercial password, then there is a subsequent connection between the intercepted multiple password component strings, that is, a preset association value is added to the initial preset association value between the multiple password component strings, and the association value is the association degree; S32: This process is repeated in this way until all the character strings that make up the multiple passwords are associated.

4. The method for automated assessment of commercial password security according to claim 1, characterized in that: The specific steps of step S6 include: the intercepted multiple password component character strings all have an initial preset risk value, and each password component character string is attacked once, that is, a preset increased risk value is added to the initial preset risk value, and the risk value is the risk degree.

5. The method for automated security assessment of commercial encryption according to claim 1, characterized in that: In step S8, after the commercial password intercepts the first password component string, the second password component string is intercepted and first searched within the password component string that has a correlation with the first password component string. If not, search outside, and so on, until the last password component string is intercepted and stopped.

Images