Management system and method for weak password of account
By designing a weak password management system for account and using automated detection and repair mechanisms, the problem of operation and maintenance personnel manually repairing weak passwords is solved, and efficient and thorough repair of weak passwords for account is achieved.
Patent Information
- Application Number
- CN202510008874.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-02
- Publication Date
- 2025-04-25
AI Technical Summary
In the prior art, operation and maintenance personnel manually repairing weak passwords for account numbers may be time-consuming and laborious, and may lead to incomplete repairs, causing new weak password problems.
An account weak password management system is designed, including asset acquisition module, weak password detection module, weak password dictionary module, weak password asset analysis module, simulated account login module, strong password strategy module and weak password reinforcement module. Through automated detection and repair mechanisms, automated management of weak passwords of accounts can be realized.
It improves the efficiency of repairing weak passwords for account accounts, ensures the complete repair of weak passwords for account accounts, and avoids new problems caused by manual repair.
Smart Images
Figure CN119892436A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a management system and method for weak account passwords. Background Art
[0002] With the penetration of various information systems in various fields, account passwords are the first line of defense for various information systems. If the security level of account passwords is set too low, they are easily detected by attackers or cracked by cracking tools, thus posing a threat to the security of various information systems. Therefore, the management of weak account passwords is crucial.
[0003] At present, the existing technology uses password scanning tools to scan weak account passwords to form a list of weak account passwords, and operation and maintenance personnel manually repair weak account passwords based on the list of weak account passwords.
[0004] However, manually repairing weak account passwords by operation and maintenance personnel is time-consuming and labor-intensive, which reduces the efficiency of repairing weak account passwords. On the other hand, manual repair may bring new weak account passwords, resulting in incomplete repair of weak account passwords. Summary of the invention
[0005] The embodiments of the present application provide a management system and method for weak account passwords, so as to improve the efficiency of repairing weak account passwords and achieve the effect of completely repairing weak account passwords.
[0006] In a first aspect, an embodiment of the present application provides a management system for weak passwords of accounts, including: an asset acquisition module, a weak password detection module, a weak password dictionary module, a weak password asset analysis module, a simulated account login module, a strong password policy module and a weak password reinforcement module.
[0007] Among them, the asset acquisition module is used to obtain application asset data from the asset management platform and send the application asset data to the weak password detection module;
[0008] The weak password dictionary module is used to obtain weak password rules and send the weak password rules to the weak password detection module and the weak password reinforcement module;
[0009] The weak password detection module performs weak password detection based on application asset data and weak password rules to obtain account weak passwords, and sends the account weak passwords to the weak password asset analysis module;
[0010] The weak password asset analysis module sends the account weak password to the simulated account login module;
[0011] The weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and weak password reinforcement priority according to the account weak password; and send the account weak password, weak password reinforcement type and weak password reinforcement priority to the weak password reinforcement module;
[0012] The strong password policy module is used to obtain strong password rules and send the strong password rules to the weak password reinforcement module;
[0013] The weak password reinforcement module reinforces the weak passwords of accounts according to the weak passwords, weak password reinforcement types, weak password reinforcement priorities, strong password rules and weak password rules to complete the repair of weak passwords of accounts.
[0014] In one possible implementation, the weak password detection module includes a weak password discovery submodule and a policy configuration submodule; accordingly, the weak password detection module performs weak password detection according to application asset data and weak password rules to obtain account weak passwords, including: the policy configuration submodule is used to configure detection parameters of the weak password discovery submodule, and send the detection parameters to the weak password discovery submodule; the weak password discovery submodule performs weak password detection according to the detection parameters, application asset data and weak password rules to obtain account weak passwords.
[0015] In a possible implementation, the weak password detection module also includes a traffic sniffing submodule; the traffic sniffing submodule is used to capture traffic data packets in real time; the traffic sniffing submodule obtains the account weak password from the traffic data packet according to the weak password rules.
[0016] In one possible implementation, the weak password asset analysis module includes a weak password asset association analysis submodule, a weak password asset analysis submodule and a weak password reinforcement priority rating submodule; accordingly, the weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and the weak password reinforcement priority according to the account weak password, including: the weak password asset association analysis submodule obtains the asset data of the account weak password; the weak password asset association analysis submodule sends the asset data to the weak password reinforcement priority rating submodule, the weak password asset analysis submodule and the simulated account login module; the simulated account login module obtains the login account corresponding to the account weak password from the asset data, simulates the login according to the account weak password and the login account, and obtains the login result; the simulated account login module sends the login result to the weak password asset analysis submodule; the weak password asset analysis submodule obtains the weak password reinforcement type according to the login result and the asset data; the weak password reinforcement priority rating submodule obtains the weak password reinforcement priority according to the asset data.
[0017] In one possible implementation, the weak password asset analysis submodule obtains the weak password reinforcement type based on the login result and the asset data, including: the weak password asset analysis submodule obtains the database permission information of the account's weak password from the asset data; if the login result is a successful login, or / and the database permission information is that the account has database permission, then the weak password reinforcement type is determined to be a type that can be directly reinforced; if the login result is a failed login, or the database permission information is that the account does not have database permission, then the weak password reinforcement type is determined to be a type that cannot be directly reinforced.
[0018] In a possible implementation, the weak password reinforcement module includes a permission detection submodule, a strong password generation submodule, a permission escalation submodule, and a weak password reinforcement submodule; accordingly, the weak password reinforcement module reinforces the account weak password according to the account weak password, weak password reinforcement type, weak password reinforcement priority, strong password rules, and weak password rules to complete the repair of the account weak password, including: the strong password generation submodule generates a strong password according to the strong password rules and the weak password rules; the permission detection submodule calls the weak password asset analysis submodule to obtain the account weak password The database permission information of the weak password; if the weak password reinforcement type is a type that can be directly reinforced, and the database permission information is with database permission, the weak password reinforcement submodule changes the account's weak password to a strong password in the database to complete the repair of the account's weak password; if the weak password reinforcement type is a type that cannot be directly reinforced, the weak password reinforcement submodule calls the permission escalation submodule, so that the permission escalation submodule modifies the database permission information of the account's weak password to have database permission, and modifies the account's weak password to a strong password in the database to complete the repair of the account's weak password
[0019] In a second aspect, an embodiment of the present application provides a method for managing weak passwords for an account, which is applied to the above-mentioned management system for weak passwords for an account, wherein the system includes an asset acquisition module, a weak password detection module, a weak password dictionary module, a weak password asset analysis module, a simulated account login module, a strong password policy module, and a weak password reinforcement module; the method includes:
[0020] Among them, the asset acquisition module is used to obtain application asset data from the asset management platform and send the application asset data to the weak password detection module;
[0021] The weak password dictionary module is used to obtain weak password rules and send the weak password rules to the weak password detection module and the weak password reinforcement module;
[0022] The weak password detection module performs weak password detection based on application asset data and weak password rules to obtain account weak passwords, and sends the account weak passwords to the weak password asset analysis module;
[0023] The weak password asset analysis module sends the account weak password to the simulated account login module;
[0024] The weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and weak password reinforcement priority according to the account weak password; and send the account weak password, weak password reinforcement type and weak password reinforcement priority to the weak password reinforcement module;
[0025] The strong password policy module is used to obtain strong password rules and send the strong password rules to the weak password reinforcement module;
[0026] The weak password reinforcement module reinforces the weak passwords of accounts according to the weak passwords, weak password reinforcement types, weak password reinforcement priorities, strong password rules and weak password rules to complete the repair of weak passwords of accounts.
[0027] In one possible implementation, the weak password detection module includes a weak password discovery submodule and a policy configuration submodule; accordingly, the weak password detection module performs weak password detection according to application asset data and weak password rules to obtain account weak passwords, including: the policy configuration submodule is used to configure detection parameters of the weak password discovery submodule, and send the detection parameters to the weak password discovery submodule; the weak password discovery submodule performs weak password detection according to the detection parameters, application asset data and weak password rules to obtain account weak passwords.
[0028] In a possible implementation, the weak password detection module also includes a traffic sniffing submodule; the traffic sniffing submodule is used to capture traffic data packets in real time; the traffic sniffing submodule obtains the account weak password from the traffic data packet according to the weak password rules.
[0029] In one possible implementation, the weak password asset analysis module includes a weak password asset association analysis submodule, a weak password asset analysis submodule and a weak password reinforcement priority rating submodule; accordingly, the weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and the weak password reinforcement priority according to the account weak password, including: the weak password asset association analysis submodule obtains the asset data of the account weak password; the weak password asset association analysis submodule sends the asset data to the weak password reinforcement priority rating submodule, the weak password asset analysis submodule and the simulated account login module; the simulated account login module obtains the login account corresponding to the account weak password from the asset data, simulates the login according to the account weak password and the login account, and obtains the login result; the simulated account login module sends the login result to the weak password asset analysis submodule; the weak password asset analysis submodule obtains the weak password reinforcement type according to the login result and the asset data; the weak password reinforcement priority rating submodule obtains the weak password reinforcement priority according to the asset data.
[0030] The management system and method for weak passwords of accounts provided in the embodiments of the present application are as follows: the asset acquisition module acquires application asset data, the weak password dictionary module acquires weak password rules, and the weak password detection module acquires weak passwords of accounts according to application asset data and weak password rules; the strong password policy module acquires strong password rules, and the weak password asset analysis module and the simulated account login module acquire weak password reinforcement types and weak password reinforcement priorities; the weak password reinforcement module reinforces weak passwords of accounts according to weak passwords of accounts, weak password reinforcement types, weak password reinforcement priorities, strong password rules and weak password rules to complete the repair of weak passwords of accounts. There is no need for operation and maintenance personnel to manually repair weak passwords of accounts, and the detection and repair of weak passwords of accounts are automatically completed, which improves the repair efficiency of weak passwords of accounts on the one hand; on the other hand, it avoids the problem that manual repair may bring new weak passwords of accounts, so as to thoroughly repair weak passwords of accounts. In addition, the weak password discovery submodule and the traffic sniffing submodule are used to obtain application asset data from different dimensions, providing data support for the management of account weak passwords. By obtaining the weak password reinforcement priority, the account weak passwords can be reinforced according to the priority. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0032] Figure 1 A schematic diagram of the structure of the management system for weak account passwords provided in the embodiment of the present application Figure 1 ;
[0033] Figure 2 A schematic diagram of the structure of the management system for weak account passwords provided in the embodiment of the present application Figure 2 ;
[0034] Figure 3 A flowchart of a method for managing weak account passwords provided in an embodiment of the present application.
[0035] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION
[0036] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0037] With the penetration of various information systems in various fields, account passwords are the first line of defense for various information systems. If the security level of account passwords is set too low, they are easily detected by attackers or cracked by cracking tools, which in turn poses a threat to the security of various information systems. Therefore, the management of weak account passwords is crucial. At present, the existing technology uses password scanning tools to scan weak account passwords to form a list of weak account passwords, and the operation and maintenance personnel manually repair the weak account passwords according to the list of weak account passwords. However, manually repairing weak account passwords by operation and maintenance personnel is time-consuming and labor-intensive, which reduces the efficiency of repairing weak account passwords; on the other hand, manual repair may bring new weak account passwords, resulting in incomplete repair of weak account passwords.
[0038] In order to solve the above technical problems, the embodiments of the present invention propose the following technical ideas: Considering that manual repair of weak passwords by operation and maintenance personnel will reduce the repair efficiency of weak passwords and cause incomplete repair of weak passwords. The inventors have thought of automating the management of weak passwords, including the detection and repair of weak passwords. The management system of weak passwords includes an asset acquisition module, a weak password detection module, a weak password dictionary module, a weak password asset analysis module, a simulated account login module, a strong password policy module and a weak password reinforcement module. The asset acquisition module obtains application asset data, the weak password dictionary module obtains weak password rules, and the weak password detection module obtains account weak passwords based on application asset data and weak password rules; the strong password policy module obtains strong password rules, and the weak password asset analysis module and simulated account login module obtain weak password reinforcement types and weak password reinforcement priorities; the weak password reinforcement module reinforces account weak passwords based on account weak passwords, weak password reinforcement types, weak password reinforcement priorities, strong password rules, and weak password rules to complete the repair of account weak passwords. There is no need for operation and maintenance personnel to manually repair account weak passwords, and the detection and repair of account weak passwords are automatically completed. On the one hand, the efficiency of account weak password repair is improved; on the other hand, the problem of new account weak passwords that may be caused by manual repair is avoided, so that the account weak passwords can be thoroughly repaired.
[0039] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.
[0040] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.
[0041] refer to Figure 1 and Figure 2 , Figure 1 A schematic diagram of the structure of the management system for weak account passwords provided in the embodiment of the present application Figure 1 ; Figure 2 A schematic diagram of the structure of the management system for weak account passwords provided in the embodiment of the present application Figure 2 .like Figure 1 As shown, the system provided by the embodiment of the present application includes: an asset acquisition module 101, a weak password detection module 102, a weak password dictionary module 103, a weak password asset analysis module 104, a simulated account login module 105, a strong password policy module 106 and a weak password reinforcement module 107.
[0042] Among them, the asset acquisition module 101 is used to obtain application asset data from the asset management platform and send the application asset data to the weak password detection module 102.
[0043] Optionally, the asset acquisition module 101 may also acquire application asset data from the application asset management platform.
[0044] Optionally, the asset acquisition module 101 includes an asset detection submodule 1011 , an asset management platform 1012 and an application asset management platform 1013 .
[0045] Specifically, the asset detection submodule 101 scans various application asset data, such as asset IP and other related information, including whether it is connected to the Internet and the asset importance level, etc., by accessing the asset management platform 1012 and the application asset management platform 1013.
[0046] The weak password dictionary module 103 is used to obtain weak password rules and send the weak password rules to the weak password detection module 102 and the weak password reinforcement module 107 .
[0047] Optionally, the weak password rules include common weak passwords and custom weak passwords.
[0048] The weak password detection module 102 performs weak password detection based on the application asset data and weak password rules to obtain the account weak password, and sends the account weak password to the weak password asset analysis module 104 .
[0049] The weak password detection module 102 includes a weak password discovery submodule 1021 and a policy configuration submodule 1022 .
[0050] Specifically, the policy configuration submodule 1022 is used to configure the detection parameters of the weak password discovery submodule 1021 and send the detection parameters to the weak password discovery submodule 1021; the weak password discovery submodule 1021 performs weak password detection according to the detection parameters, application asset data and weak password rules to obtain the account weak password.
[0051] Among them, the application asset data includes asset objects.
[0052] Optionally, the detection parameters include detection scanning frequency, detection scanning time, and detection asset object, etc.
[0053] In this embodiment, the weak password discovery submodule 1021 detects and analyzes assets with weak account passwords based on application asset data and weak password rules, and provides information such as asset name, IP, account number and weak password.
[0054] Optionally, the weak password detection module 102 also includes a traffic sniffing submodule 1023 .
[0055] Specifically, the traffic sniffing submodule 1023 is used to capture traffic data packets in real time; the traffic sniffing submodule 1023 obtains the account weak password from the traffic data packet according to the weak password rule.
[0056] The weak password asset analysis module 104 sends the account weak password to the simulated account login module 105 .
[0057] The weak password asset analysis module 104 and the simulated account login module 105 obtain the weak password reinforcement type and the weak password reinforcement priority according to the account weak password; and send the account weak password, the weak password reinforcement type and the weak password reinforcement priority to the weak password reinforcement module 107.
[0058] Among them, the weak password asset analysis module 104 includes a weak password asset association analysis submodule 1041 , a weak password asset analysis submodule 1042 and a weak password reinforcement priority rating submodule 1043 .
[0059] Specifically, the weak password-asset association analysis submodule 1041 obtains asset data of the account's weak password.
[0060] In this embodiment, the weak password asset association analysis submodule 1041 performs association analysis on the account information with weak passwords and the asset information, and outputs the asset data of the account with weak passwords, such as the system name, IP, account, weak password, discovery time, the organization to which the system belongs, and the person in charge of the system.
[0061] The weak password asset association analysis submodule 1041 sends the asset data to the weak password reinforcement priority rating submodule 1043 , the weak password asset analysis submodule 1042 and the simulated account login module 105 .
[0062] The simulated account login module 105 obtains the login account corresponding to the account weak password from the asset data, simulates the login according to the account weak password and the login account, and obtains the login result.
[0063] In this embodiment, the login results include the following:
[0064] a. If the account login action can be simulated based on the login account and the account weak password, then the login is successful;
[0065] b. If the account login action cannot be simulated based on the login account and the weak account password, it means the login has failed;
[0066] c. If the login account or account password is weak, such as empty account, empty account password, any account and any account password, it means it is an abnormal login account.
[0067] The simulated account login module 105 sends the login result to the weak password asset analysis submodule 1042;
[0068] The weak password asset analysis submodule 1042 obtains the weak password reinforcement type based on the login result and asset data.
[0069] Specifically, the weak password asset analysis submodule 1042 obtains the database permission information of the account's weak password from the asset data; if the login result is a successful login, or / and the database permission information shows that the user has database permission, then the weak password reinforcement type is determined to be a type that can be directly reinforced; if the login result is a failed login, or the database permission information shows that the user does not have database permission, then the weak password reinforcement type is determined to be a type that cannot be directly reinforced.
[0070] Optionally, if the login result is an abnormal login account, the weak password reinforcement type is an abnormal reinforcement type.
[0071] The weak password reinforcement priority rating submodule 1043 obtains the weak password reinforcement priority according to the asset data.
[0072] Specifically, the weak password reinforcement priority rating submodule 1043 performs a priority assessment on assets with weak account passwords based on factors such as the current asset importance, Internet exposure level, and asset security level, and obtains a weak password reinforcement priority.
[0073] The strong password policy module 106 is used to obtain strong password rules and send the strong password rules to the weak password reinforcement module 107 .
[0074] Optionally, strong password rules include the following rules:
[0075] a. The characters include uppercase and lowercase letters, numbers, and special symbols;
[0076] b. The length is not less than 8 characters;
[0077] c. The characters cannot be simple words or numbers, such as Pass@word, aaabbb, qwerty, zyxwvuts, and 123321;
[0078] d. The characters do not contain common characters, such as 1234, password, PASSWORD, admin, ADMIN, user, and USER;
[0079] e. Avoid using the following phrases or simple combinations of characters: user name, pinyin of name, English name, ID number, phone number, birthday, computer name, terminology, company name, place name, hardware name, software name, keyboard order and alphabetical order, etc., which are easy to be guessed by others, as well as any of the above in reverse order, any of the above followed by a number, any of the above mixed with uppercase and lowercase, and passwords already used in other systems.
[0080] The weak password reinforcement module 107 reinforces the weak password of the account according to the weak password of the account, the weak password reinforcement type, the weak password reinforcement priority, the strong password rule and the weak password rule to complete the repair of the weak password of the account.
[0081] Among them, the weak password reinforcement module 107 includes a permission detection submodule 1071, a strong password generation submodule 1072, a permission escalation submodule 1073, and a weak password reinforcement submodule 1074.
[0082] Specifically, the strong password generation submodule 1072 generates a strong password according to the strong password rule and the weak password rule;
[0083] The permission detection submodule 1071 calls the weak password asset analysis submodule to obtain the database permission information of the account's weak password.
[0084] The database permission information includes whether the user has the database permission or not.
[0085] If the weak password reinforcement type is a directly remediable type, and the database permission information indicates that the user has database permission, the weak password reinforcement submodule 1074 modifies the account's weak password into a strong password in the database to complete the repair of the account's weak password.
[0086] Optionally, an SQL statement may be used and the strong password generation submodule 1072 may be called to generate a strong password, and the weak password of the account may be directly repaired into a strong password in the database.
[0087] If the weak password reinforcement type is a type that cannot be directly reinforced, the weak password reinforcement submodule 1074 calls the authority escalation submodule 1073, so that the authority escalation submodule 1073 modifies the database permission information of the account's weak password to have database permissions, and modifies the account's weak password to a strong password in the database to complete the repair of the account's weak password.
[0088] Optionally, if the weak password reinforcement type is an abnormal reinforcement type, the abnormal account weak password is set as a pending item and the processing is completed under the intervention of operation and maintenance personnel.
[0089] In summary, the asset acquisition module obtains application asset data, the weak password dictionary module obtains weak password rules, and the weak password detection module obtains account weak passwords based on application asset data and weak password rules; the strong password policy module obtains strong password rules, and the weak password asset analysis module and the simulated account login module obtain weak password reinforcement types and weak password reinforcement priorities; the weak password reinforcement module reinforces account weak passwords based on account weak passwords, weak password reinforcement types, weak password reinforcement priorities, strong password rules, and weak password rules to complete the repair of account weak passwords. There is no need for operation and maintenance personnel to manually repair account weak passwords, and the detection and repair of account weak passwords are automatically completed. On the one hand, the efficiency of account weak password repair is improved; on the other hand, the problem of new account weak passwords that may be caused by manual repair is avoided, so that the account weak passwords can be thoroughly repaired. In addition, the weak password discovery submodule and the traffic sniffing submodule are used to obtain application asset data from different dimensions, providing data support for the management of account weak passwords. By obtaining the weak password reinforcement priority, the account weak passwords can be reinforced according to the priority.
[0090] Figure 3 The following is a flow chart of a method for managing weak account passwords provided in an embodiment of the present application. Figure 3 As shown, the method includes:
[0091] S301: The asset acquisition module is used to obtain application asset data from the asset management platform and send the application asset data to the weak password detection module.
[0092] S302: The weak password dictionary module is used to obtain weak password rules and send the weak password rules to the weak password detection module and the weak password reinforcement module.
[0093] S303: The weak password detection module performs weak password detection according to the application asset data and weak password rules to obtain the account weak password, and sends the account weak password to the weak password asset analysis module.
[0094] Among them, the weak password detection module includes a weak password discovery submodule and a policy configuration submodule.
[0095] Specifically, the policy configuration submodule is used to configure the detection parameters of the weak password discovery submodule and send the detection parameters to the weak password discovery submodule; the weak password discovery submodule performs weak password detection according to the detection parameters, application asset data and weak password rules to obtain the account weak password.
[0096] Optionally, the weak password detection module also includes a traffic sniffing submodule.
[0097] In this embodiment, the traffic sniffing submodule is used to capture traffic data packets in real time; the traffic sniffing submodule obtains the account weak password from the traffic data packet according to the weak password rule.
[0098] S304: The weak password asset analysis module sends the account weak password to the simulated account login module;
[0099] S305: The weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and the weak password reinforcement priority according to the account weak password; and send the account weak password, the weak password reinforcement type and the weak password reinforcement priority to the weak password reinforcement module.
[0100] Among them, the weak password asset analysis module includes a weak password asset association analysis sub-module, a weak password asset analysis sub-module and a weak password reinforcement priority rating sub-module.
[0101] Specifically, step S305 includes S3051 to S3056:
[0102] S3051 Weak password asset association analysis submodule obtains asset data of account weak passwords;
[0103] S3052: The weak password asset association analysis submodule sends the asset data to the weak password reinforcement priority rating submodule, the weak password asset analysis submodule and the simulated account login module;
[0104] S3053: The simulated account login module obtains the login account corresponding to the account weak password from the asset data, simulates the login according to the account weak password and the login account, and obtains the login result;
[0105] S3054: The simulated account login module sends the login result to the weak password asset analysis submodule;
[0106] S3055: The weak password asset analysis submodule obtains the weak password reinforcement type based on the login results and asset data.
[0107] Specifically, the weak password asset analysis submodule obtains the database permission information of the account's weak password from the asset data; if the login result is a successful login, or / and the database permission information shows that the user has database permission, then the weak password reinforcement type is determined to be a type that can be directly reinforced; if the login result is a failed login, or the database permission information shows that the user does not have database permission, then the weak password reinforcement type is determined to be a type that cannot be directly reinforced.
[0108] S3056: The weak password reinforcement priority rating submodule obtains the weak password reinforcement priority based on the asset data.
[0109] S306: The strong password policy module is used to obtain strong password rules and send the strong password rules to the weak password reinforcement module;
[0110] S307: The weak password reinforcement module reinforces the account weak password according to the account weak password, weak password reinforcement type, weak password reinforcement priority, strong password rule and weak password rule to complete the repair of the account weak password.
[0111] Among them, the weak password reinforcement module includes a permission detection sub-module, a strong password generation sub-module, a permission escalation sub-module, and a weak password reinforcement sub-module.
[0112] Specifically, step S307 includes S3071 to S3074:
[0113] S3071: The strong password generation submodule generates a strong password according to the strong password rules and the weak password rules.
[0114] S3072: The permission detection submodule calls the weak password asset analysis submodule to obtain the database permission information of the account's weak password.
[0115] S3073: If the weak password reinforcement type is a directly reinforced type, and the database permission information is that the user has database permission, the weak password reinforcement submodule modifies the account's weak password into a strong password in the database to complete the repair of the account's weak password.
[0116] S3074: If the weak password reinforcement type is a type that cannot be directly reinforced, the weak password reinforcement sub-module calls the permission escalation sub-module, so that the permission escalation sub-module modifies the database permission information of the account weak password to have database permissions, and modifies the account weak password to a strong password in the database to complete the repair of the account weak password.
[0117] In summary, the asset acquisition module obtains application asset data, the weak password dictionary module obtains weak password rules, and the weak password detection module obtains account weak passwords based on application asset data and weak password rules; the strong password policy module obtains strong password rules, and the weak password asset analysis module and the simulated account login module obtain weak password reinforcement types and weak password reinforcement priorities; the weak password reinforcement module reinforces account weak passwords based on account weak passwords, weak password reinforcement types, weak password reinforcement priorities, strong password rules, and weak password rules to complete the repair of account weak passwords. There is no need for operation and maintenance personnel to manually repair account weak passwords, and the detection and repair of account weak passwords are automatically completed. On the one hand, the efficiency of account weak password repair is improved; on the other hand, the problem of new account weak passwords that may be caused by manual repair is avoided, so that the account weak passwords can be thoroughly repaired. In addition, the weak password discovery submodule and the traffic sniffing submodule are used to obtain application asset data from different dimensions, providing data support for the management of account weak passwords. By obtaining the weak password reinforcement priority, the account weak passwords can be reinforced according to the priority.
[0118] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0119] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.
[0120] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.
Claims
1. A management system for weak account passwords, characterized in that: include: Asset acquisition module, weak password detection module, weak password dictionary module, weak password asset analysis module, simulated account login module, strong password strategy module and weak password reinforcement module; The asset acquisition module is used to obtain application asset data from the asset management platform and send the application asset data to the weak password detection module; The weak password dictionary module is used to obtain weak password rules and send the weak password rules to the weak password detection module and the weak password reinforcement module; The weak password detection module performs weak password detection according to the application asset data and the weak password rule to obtain the account weak password, and sends the account weak password to the weak password asset analysis module; The weak password asset analysis module sends the account weak password to the simulated account login module; The weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and the weak password reinforcement priority according to the account weak password; and send the account weak password, the weak password reinforcement type and the weak password reinforcement priority to the weak password reinforcement module; The strong password policy module is used to obtain strong password rules and send the strong password rules to the weak password reinforcement module; The weak password reinforcement module reinforces the account weak password according to the account weak password, the weak password reinforcement type, the weak password reinforcement priority, the strong password rule and the weak password rule to complete the repair of the account weak password.
2. The system according to claim 1, characterized in that The weak password detection module includes a weak password discovery submodule and a policy configuration submodule; Accordingly, the weak password detection module performs weak password detection according to the application asset data and the weak password rule to obtain the weak password of the account, including: The policy configuration submodule is used to configure the detection parameters of the weak password discovery submodule, and send the detection parameters to the weak password discovery submodule; The weak password discovery submodule performs weak password detection according to the detection parameters, the application asset data and the weak password rules to obtain the weak password of the account.
3. The system according to claim 2, characterized in that The weak password detection module also includes a traffic sniffing submodule; The traffic sniffing submodule is used to capture traffic data packets in real time; The traffic sniffing submodule obtains the account weak password from the traffic data packet according to the weak password rule.
4. The system according to claim 1, characterized in that The weak password asset analysis module includes a weak password asset association analysis submodule, a weak password asset analysis submodule and a weak password reinforcement priority rating submodule; Accordingly, the weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and weak password reinforcement priority according to the account weak password, including: The weak password asset association analysis submodule obtains asset data of the weak password of the account; The weak password asset association analysis submodule sends the asset data to the weak password reinforcement priority rating submodule, the weak password asset analysis submodule and the simulated account login module; The simulated account login module obtains the login account corresponding to the account weak password from the asset data, simulates the login according to the account weak password and the login account, and obtains the login result; The simulated account login module sends the login result to the weak password asset analysis submodule; The weak password asset analysis submodule obtains the weak password reinforcement type according to the login result and the asset data; The weak password reinforcement priority rating submodule obtains the weak password reinforcement priority according to the asset data.
5. The system according to claim 4, characterized in that The weak password asset analysis submodule obtains the weak password reinforcement type according to the login result and the asset data, including: The weak password asset analysis submodule obtains database permission information of the weak password of the account from the asset data; If the login result is successful login, and / or the database permission information is that the user has the database permission, the weak password reinforcement type is determined to be a type that can be directly reinforced; If the login result is a login failure, or the database permission information indicates that the user does not have the database permission, the weak password reinforcement type is determined to be a type that cannot be directly reinforced.
6. The system according to claim 5, characterized in that The weak password reinforcement module includes a permission detection submodule, a strong password generation submodule, a permission escalation submodule, and a weak password reinforcement submodule; Accordingly, the weak password reinforcement module reinforces the weak password of the account according to the weak password of the account, the weak password reinforcement type, the weak password reinforcement priority, the strong password rule and the weak password rule to complete the repair of the weak password of the account, including: The strong password generation submodule generates a strong password according to the strong password rule and the weak password rule; The permission detection submodule calls the weak password asset analysis submodule to obtain database permission information of the weak password of the account; If the weak password reinforcement type is the directly remediable type, and the database permission information is that the user has database permission, the weak password reinforcement submodule modifies the weak password of the account to the strong password in the database to complete the repair of the weak password of the account; If the weak password reinforcement type is the type that cannot be directly reinforced, the weak password reinforcement sub-module calls the permission escalation sub-module, so that the permission escalation sub-module modifies the database permission information of the account weak password to have database permission, and modifies the account weak password to the strong password in the database to complete the repair of the account weak password.
7. A method for managing weak account passwords, characterized in that: The method is applied to the management system of weak passwords of accounts as described in claims 1-6, wherein the system comprises an asset acquisition module, a weak password detection module, a weak password dictionary module, a weak password asset analysis module, a simulated account login module, a strong password strategy module and a weak password reinforcement module; include: The asset acquisition module is used to obtain application asset data from the asset management platform and send the application asset data to the weak password detection module; The weak password dictionary module is used to obtain weak password rules and send the weak password rules to the weak password detection module and the weak password reinforcement module; The weak password detection module performs weak password detection according to the application asset data and the weak password rule to obtain the account weak password, and sends the account weak password to the weak password asset analysis module; The weak password asset analysis module sends the account weak password to the simulated account login module; The weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and the weak password reinforcement priority according to the account weak password; and send the account weak password, the weak password reinforcement type and the weak password reinforcement priority to the weak password reinforcement module; The strong password policy module is used to obtain strong password rules and send the strong password rules to the weak password reinforcement module; The weak password reinforcement module reinforces the account weak password according to the account weak password, the weak password reinforcement type, the weak password reinforcement priority, the strong password rule and the weak password rule to complete the repair of the account weak password.
8. The method according to claim 7, characterized in that The weak password detection module includes a weak password discovery submodule and a policy configuration submodule; Accordingly, the weak password detection module performs weak password detection according to the application asset data and the weak password rule to obtain the weak password of the account, including: The policy configuration submodule is used to configure the detection parameters of the weak password discovery submodule, and send the detection parameters to the weak password discovery submodule; The weak password discovery submodule performs weak password detection according to the detection parameters, the application asset data and the weak password rules to obtain the weak password of the account.
9. The method according to claim 8, characterized in that The weak password detection module also includes a traffic sniffing submodule; The traffic sniffing submodule is used to capture traffic data packets in real time; The traffic sniffing submodule obtains the account weak password from the traffic data packet according to the weak password rule.
10. The method according to claim 7, characterized in that The weak password asset analysis module includes a weak password asset association analysis submodule, a weak password asset analysis submodule and a weak password reinforcement priority rating submodule; Accordingly, the weak password asset analysis module and the simulated account login module obtain the weak password reinforcement type and weak password reinforcement priority according to the account weak password, including: The weak password asset association analysis submodule obtains asset data of the weak password of the account; The weak password asset association analysis submodule sends the asset data to the weak password reinforcement priority rating submodule, the weak password asset analysis submodule and the simulated account login module; The simulated account login module obtains the login account corresponding to the account weak password from the asset data, simulates the login according to the account weak password and the login account, and obtains the login result; The simulated account login module sends the login result to the weak password asset analysis submodule; The weak password asset analysis submodule obtains the weak password reinforcement type according to the login result and the asset data; The weak password reinforcement priority rating submodule obtains the weak password reinforcement priority according to the asset data.