Password security assessment method and device based on probability inference model, electronic equipment and storage medium

Abstract

The invention discloses a password security assessment method and device based on a probability inference model, electronic equipment and a storage medium. The method comprises the following steps: acquiring user password information and user personal information; processing the personal information of the user according to a preset PII tag setting rule to obtain a plurality of user PII tags, and identifying and matching the password information of the user based on the plurality of user PII tags to determine the plurality of user PII tags; obtaining a capital and small case combination type of English characters in the password information of the user; matching the plurality of user PII tags and the English character capital and small case combination types with a preset probability tree, and determining respective corresponding feature probabilities; calculating the guess probability of the password information of the user according to the feature probability; calculating guessing times of the user password information according to the guessing probability; and determining the password strength level of the user password information according to the guess times of the user password information. According to the scheme, the password security can be evaluated more accurately.

Description

Technical Field

[0001] The present invention relates to the technical field of password security assessment, and in particular to a password security assessment method, device, electronic device and storage medium based on a probability inference model. Background Art

[0002] Identity verification is a technical means that is most commonly used by ordinary users and has the widest application range, which directly affects the security of different entities such as individuals, enterprises and governments. Passwords are the most common means of identity verification. Although they have many shortcomings in security, they are easy to operate, low cost and easy to update. In the foreseeable future, passwords will still be the main means of verification.

[0003] Current password strength assessment tools assess the security of passwords in a variety of ways, including but not limited to character set length calculation, password entropy calculation, and cracking time estimation. These tools can detect whether the password contains lowercase letters, uppercase letters, numbers, and special characters, thereby calculating the character set length of the password (the number of character types used), and calculate the entropy value of the password based on the character set length and password length. The higher the entropy value, the more difficult it is to crack the password. In addition, some tools have introduced context-free grammars (PCFGs) to simulate the behavior of users constructing passwords, such as the fuzzyPSM algorithm, which evaluates the strength of passwords by simulating the behavior of users constructing passwords in the real world and performs well in evaluating weak passwords.

[0004] Currently, most password strength assessment tools focus on traditional brute force, masked brute force, and dictionary attacks to prevent users from using weak passwords. When assessing password strength, these tools often fail to fully consider users' personal information, which may result in some passwords that are actually weak (especially those containing personal information) being mistakenly assessed as strong passwords. Summary of the invention

[0005] In order to solve the technical problem that existing password strength assessment tools fail to fully consider the impact of user personal information on account security, the embodiments of the present invention provide a password security assessment method, device, electronic device and storage medium based on a probabilistic inference model.

[0006] The technical solution of the embodiment of the present invention is achieved as follows:

[0007] The embodiment of the present invention provides a password security assessment method based on a probability inference model, the method comprising: obtaining user password information and user personal information; processing the user personal information according to a preset PII tag setting rule to obtain multiple user PII tags; identifying and matching the user password information based on the multiple user PII tags to determine the multiple user PII tags matched by the user password information; and obtaining the uppercase and lowercase combination types of English characters in the user password information; matching the multiple user PII tags matched by the user password information and the uppercase and lowercase combination types of English characters in the user password information with a preset probability tree to determine the feature probabilities corresponding to the user PII tags and the uppercase and lowercase combination types of English characters respectively; calculating the guessing probability of the user password information according to the feature probability; and calculating the number of guesses of the user password information according to the guessing probability; and determining the password strength level of the user password information according to the number of guesses of the user password information.

[0008] In one embodiment, the preset PII tag setting rules include: PII tag N1 represents the name, PII tag N2 represents the abbreviation of the name, PII tag N3 represents the surname, PII tag N4 represents the given name, PII tag N5 represents the first letter of the name + the surname, PII tag N6 represents the surname + the first letter of the name, and PII tag N7 represents the surname with the first letter capitalized; PII tag B1 represents the birthday in the format of year-month-day, PII tag B2 represents the birthday in the format of month-day-year, PII tag B3 represents the birthday in the format of day-month-year, PII tag B4 represents the year of birth + month, PII tag B5 represents the year of birth, PII tag B6 represents the year of birth + month, PII tag B7 represents the month of birth + year, PII tag B8 represents the last two digits of the year of birth + the date represented by month and day, and PII tag B9 represents the last two digits of the year of birth + the date represented by month and day. It represents the date expressed as month and day + the last two digits of the year of birth, and PII tag B10 represents the date expressed as day and month + the last two digits of the year of birth; PII tag A1 represents the full name of the user, PII tag A2 represents the first letter segment of the user, and PII tag A3 represents the first numeric segment of the user; PII tag E1 represents the full name of the email prefix, PII tag E2 represents the first letter segment of the email prefix, and PII tag E3 represents the first numeric segment of the email prefix; PII tag T1 represents the entire mobile phone number, PII tag T2 represents the first three digits of the mobile phone number, and PII tag T3 represents the last four digits of the mobile phone number; PII tag I1 represents the last four digits of the ID number, PII tag I2 represents the first three digits of the ID number, and PII tag I3 represents the first six digits of the ID number; PII tag P1 indicates that the password contains some popular passwords.

[0009] In one embodiment, obtaining the type of uppercase and lowercase combination of English characters in the user password information includes: identifying an English sequence in the user password information; representing the uppercase state of each letter in the English sequence with U, and representing the lowercase state of each letter in the English sequence with L, and determining the type of uppercase and lowercase combination of English characters in the English sequence.

[0010] In one embodiment, a method for constructing a preset probability tree includes: obtaining a training data set; processing the training data set according to a preset PII tag setting rule to obtain multiple PII tags corresponding to the training data set, and obtaining multiple English character case combination types of the training data set; counting the frequency of occurrence of each PII tag corresponding to the training data set and the frequency of occurrence of each English character case combination type of the training data set; and calculating the feature probability of each PII tag and the probability of each English character case combination type based on the frequency; using each PII tag and each English character case combination type as a node of the probability tree, and using the feature probability of each PII tag and the probability of each English character case combination type as corresponding node weights to construct a probability tree.

[0011] In one embodiment, calculating the probability of guessing the user password information according to the feature probability includes: calculating the probability of guessing the user password information according to the feature probability using the following calculation formula:

[0012]

[0013] Among them, P(Password) represents the probability of guessing the user's password information, P(Feature i ) represents the feature probability corresponding to the user PII tag or the feature probability corresponding to the English character uppercase and lowercase combination type, and n is the number of user PII tags and English character uppercase and lowercase combination types.

[0014] In one embodiment, calculating the number of guesses of the user password information according to the guessing probability includes: calculating the number of guesses of the user password information according to the guessing probability using the following calculation formula:

[0015] y=9.79376176·e -0.13955719·x -10.96126108

[0016] Wherein, y represents the number of guesses of the user password information, and x represents the probability of guessing the user password information.

[0017] In one embodiment, determining the password strength level of the user password information according to the number of guesses of the user password information includes: obtaining a first judgment threshold and a second judgment threshold; if the number of guesses of the user password information is less than the first judgment threshold, determining that the password strength level of the user password information is a weak password; if the number of guesses of the user password information is greater than or equal to the first judgment threshold and less than the second judgment threshold, determining that the password strength level of the user password information is a medium strength password; if the number of guesses of the user password information is greater than or equal to the second judgment threshold, determining that the password strength level of the user password information is a strong password.

[0018] The embodiment of the present invention also provides a password security assessment device based on a probabilistic inference model, and the password security assessment device based on a probabilistic inference model includes: an acquisition module, used to acquire user password information and user personal information; a processing module, used to process the user personal information according to a preset PII tag setting rule to acquire multiple user PII tags; a first matching module, used to identify and match the user password information based on the multiple user PII tags, determine the multiple user PII tags matched by the user password information; and acquire the English character case combination type in the user password information; a second matching module, used to match the multiple user PII tags matched by the user password information and the English character case combination type in the user password information with a preset probability tree, and determine the feature probabilities corresponding to the user PII tags and the English character case combination type respectively; a calculation module, used to calculate the guessing probability of the user password information according to the feature probability; and calculate the number of guesses of the user password information according to the guessing probability; a determination module, used to determine the password strength level of the user password information according to the number of guesses of the user password information.

[0019] An embodiment of the present invention further provides an electronic device, comprising: a processor and a memory for storing a computer program that can be run on the processor; wherein the processor executes the steps of the above-mentioned method when running the computer program.

[0020] An embodiment of the present invention further provides a storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented.

[0021] This embodiment has the following beneficial effects:

[0022] 1. This embodiment can accurately identify passwords containing personal information, can comprehensively and accurately identify password strength, and can well help users improve password security.

[0023] 2. This embodiment implements the password strength assessment function in an offline manner, thereby effectively avoiding personal information leakage and better defending against targeted password guessing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of a password security assessment method based on a probability inference model according to an embodiment of the present invention;

[0025] Figure 2 A schematic diagram of the process framework of a password security assessment method based on a probabilistic inference model according to an embodiment of the present invention;

[0026] Figure 3 A schematic diagram of a feature list construction process according to an embodiment of the present invention;

[0027] Figure 4 Schematic diagram of the calculation process of the probability of a password to be tested according to an embodiment of the present invention;

[0028] Figure 5 A schematic diagram of a curve fitting result of password probability and its corresponding number of guesses according to an embodiment of the present invention;

[0029] Figure 6 It is a schematic diagram of the structure of a password security assessment device based on a probability inference model according to an embodiment of the present invention;

[0030] Figure 7 1 is a diagram showing the internal structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] Before introducing this embodiment in detail, the following contents are introduced first:

[0032] PCFG: Probabilistic context-free grammar, in computer science and linguistics, PCFG is a mathematical framework for describing the structure of natural language sentences. It consists of a set of rules (productions), each of which defines how one or more symbols (terminals or non-terminals) are replaced with other symbols, and a probability value is assigned to each rule, which indicates the possibility of selecting the rule in the generation process. It consists of five parts: non-terminal set, terminal set, start non-terminal, production set, and probability distribution of production.

[0033] Morkov: is a statistical model that assumes that the future state of a system depends only on its current state, and not on its past state. In password guessing, the Markov model can be used to predict the probability of the next character in the password, based on the state of the previous character or characters. This model can capture the dependencies between characters in the password, thereby generating possible password combinations.

[0034] TarGuess: Directed password guessing, which is a password guessing technique that uses password patterns as a guide to generate passwords. For example, if a password policy requires that passwords must contain uppercase letters, lowercase letters, numbers, and special characters, the directed password guessing model will generate passwords that meet these constraints. This method can improve guessing efficiency because it only generates passwords that meet a specific pattern instead of randomly generating all possible password combinations.

[0035] TarGuess-I model: It is a model for guessing passwords of specific users proposed by Wang Ding et al. at the ACM Conference on Computer and Communications Security (ACM CCS) in 2016. This model uses password information leaked by users on other websites and some personal identity information to guess the passwords of users on specific websites.

[0036] PII: Personally Identifiable Information (PII) is any data that can be used to identify, distinguish, or track an individual. This includes direct identifiers such as name, social security number, email address, phone number, and biometric data.

[0037] The present invention will be described in further detail below with reference to the accompanying drawings and embodiments.

[0038] The embodiment of the present invention provides a password security assessment method based on a probability inference model, such as Figure 1 As shown, the method includes:

[0039] Step 101: Obtain user password information and user personal information;

[0040] Step 102: Process the user personal information according to a preset PII tag setting rule to obtain multiple user PII tags;

[0041] Step 103: Based on the multiple user PII tags, identify and match the user password information to determine the multiple user PII tags matched by the user password information; and obtain the type of uppercase and lowercase combination of English characters in the user password information;

[0042] Step 104: Match multiple user PII tags matched by the user password information and the uppercase and lowercase combination types of English characters in the user password information with a preset probability tree to determine feature probabilities corresponding to the user PII tags and the uppercase and lowercase combination types of English characters respectively;

[0043] Step 105: Calculate the probability of guessing the user password information according to the feature probability; and calculate the number of guesses of the user password information according to the guess probability;

[0044] Step 106: Determine the password strength level of the user password information according to the number of guesses of the user password information.

[0045] This embodiment proposes a new password security assessment method, which can integrate factors such as user personal information, popular passwords and keyboard mode passwords, based on the TarGuess-I model, combined with popular password dictionaries and keyboard mode password dictionaries, to achieve a more accurate assessment of password security.

[0046] This embodiment proposes an innovative password strength assessment framework, which performs quantitative analysis of password strength based on user personal information. The core of this embodiment is to build a comprehensive password assessment model by collecting key user personal information, such as name, username, ID number, mobile phone number, and email address.

[0047] This embodiment first uses the longest prefix matching algorithm to extract the longest subsequence that matches the personal information from the password set by the user. This step is intended to identify the personal identification information (PII) that may be contained in the password, thereby evaluating its potential security risks.

[0048] This embodiment introduces a popular password database and keyboard pattern recognition technology to detect whether there are popular patterns or regular sequences based on keyboard layouts in the password. This step helps to identify passwords that are easy to guess or attack using patterns.

[0049] In order to build the evaluation model, this embodiment uses a data set collected from the Internet as a training set. By conducting an in-depth analysis of the passwords in the training set, the frequency of occurrence of PII tags and the combination patterns of uppercase and lowercase English characters are identified and counted. Based on these statistical data, the probability of each tag and uppercase combination is calculated, and a feature list containing password structure information is constructed accordingly.

[0050] In the password evaluation phase, this embodiment performs a structured analysis on the password provided by the user and compares it with the personal information provided to match the corresponding tag type. By querying the previously constructed feature list, the probability distribution of the password can be calculated. Finally, the least squares method is used to further estimate the number of attempts required to crack the password, and this value is used as a quantitative indicator of the password strength.

[0051] Compared with the prior art, this embodiment has the following differences:

[0052] 1. Fully consider user personal information to achieve more accurate password strength assessment.

[0053] 2. Implement password strength assessment offline.

[0054] 3. The logic of judging the strength of passwords is different.

[0055] The following will describe the solution of this embodiment in detail using a specific scenario.

[0056] See also Figure 2 The system architecture diagram of this embodiment is as follows: Figure 2 The tool of this embodiment is mainly divided into three parts: model training part, label recognition part, and password evaluation part. The specific description of the implementation process of each part is as follows.

[0057] 1. Model Training

[0058] This embodiment adopts a type-based PII field matching method, which is extended on the basis of the existing probabilistic context-free grammar (PCFG) model and introduces the concepts of PII main tags and sub-tags.

[0059] Specifically, this embodiment expands the L (letter), D (number), and S (special symbol) tags in the PCFG model to meet the identification requirements of PII. Under this framework, the PII main tag is used to identify the type of PII. For example, label N is used to represent the name, label B is used to represent the birthday, etc. In addition, in order to further refine the classification of PII, this embodiment introduces PII subtags, which are distinguished by subscripts to represent the subclass number of a specific PII type. This embodiment defines a total of 7 PII tags:

[0060] (1) N indicates the usage of the name, N1 indicates the name (such as zhangsan), N2 indicates the abbreviation of the name (such as zs), N3 indicates the surname (such as zhang), N4 indicates the given name (such as san), N5 indicates the first letter of the name + the surname (such as szhang), N6 indicates the surname + the first letter of the name (such as zhangs), and N7 indicates the surname with the first letter capitalized (such as Zhang);

[0061] (2) B indicates the usage of date of birth. B1 indicates the use of birthday in the format of year, month, and day (e.g., 20060607). B2 indicates the use of birthday in the format of month, day, and year (e.g., 06072006). B3 indicates the use of birthday in the format of day, month, and year (e.g., 07062006). B4 indicates the year of birth + month (e.g., 200606). B5 indicates the year of birth (e.g., 2006). B6 indicates the year of birth + month (e.g., 200606). B7 indicates the month of birth + year (e.g., 062006). B8 indicates the last two digits of the year of birth + date expressed in month and day (e.g., 820607). B9 indicates the date expressed in month and day + the last two digits of the year of birth (e.g., 060782). B10 indicates the date expressed in day and month + the last two digits of the year of birth (e.g., 070682).

[0062] (3) A represents the usage of the user name information, A1 represents the full name of the user (such as lilychee12), A2 represents the first letter segment of the user name (such as lilychee), and A3 represents the first numeric segment of the user name (such as 12);

[0063] (4) E represents the usage of email prefix information. Taking loveu1314@163.com as an example, E1 represents the full name of the email prefix (such as loveu1314), E2 represents the first letter segment of the email prefix (such as loveu), and E3 represents the first number segment of the email prefix (such as 1314);

[0064] (5) T represents the usage of the mobile phone number, T1 represents the entire mobile phone number, T2 represents the first three digits of the mobile phone number, and T3 represents the last four digits of the mobile phone number;

[0065] (6) I represents the usage of Chinese ID number, I1 represents the last 4 digits of the ID number, I2 represents the first 3 digits of the ID number, and I3 represents the first 6 digits of the ID number.

[0066] (7) P indicates the usage of popular passwords, and P1 indicates that the password contains some popular passwords.

[0067] Our training data comes from five large Chinese websites, as shown in Table 1. These data are leaked by hackers or insiders and are publicly available for download on the Internet.

[0068] Table 1

[0069] Rank 12306 Dudu Cow grand The End of the World YouTube 1 123456 123456 123456 123456 123456 2 a123456 111111 111111 111111 a123456 3 123456a 123456789 5201314 12345678 111111 4 woaini1314 5201314 123456789 5201314 12345678 5 5201314 123123 123123 123123 5201314 6 111111 a123456 88888888 1qaz2wsx 123456a 7 qq123456 woaini1314 a123456 7758521 123123 8 1qaz2wsx 1314520 qq123456 1314520 123456789a 9 88888888 123456a woaini1314 666666 woaini1314 10 123qwe qq123456 1qaz2wsx 123321 123qwe ％ 0.0128 0.0328 0.0376 0.0461 0.0375

[0070] This embodiment first parses the passwords in the training set to identify the PII tags and uppercase and lowercase combinations of English characters. For example, for English uppercase and lowercase combinations, the model will recognize a sequence such as "Abc" and mark it as ULL (uppercase-lowercase-lowercase), where the uppercase and lowercase states of each letter are represented by U (uppercase) and L (lowercase), respectively. The TarGuess-I model is then used to calculate the frequency of each tag and uppercase combination in a sufficiently large training set. Based on these frequencies, the model will derive the probability of the corresponding tag. This embodiment systematically organizes the PII tag probabilities and English uppercase and lowercase combination probabilities generated by the TarGuess-I model, as shown in Tables 2 and 3, and records these results in a probability tree, where each node in the probability tree represents a specific password feature, and the weight of the node represents the relative frequency of the feature in the training data.

[0071] Table 2

[0072] PII Tags Probability <![CDATA[N2B1]]> 0.010002 <![CDATA[N2B8]]> 0.008754 <![CDATA[N2P1]]> 0.008061 <![CDATA[N2U3]]> 0.004711 <![CDATA[N1B5]]> 0.003354 <![CDATA[N1U3]]> 0.003208 <![CDATA[B1N2]]> 0.002693 <![CDATA[N3U3]]> 0.002572 <![CDATA[N1B4]]> 0.002396 <![CDATA[N3B1]]> 0.002255

[0073] Table 3

[0074] Uppercase and lowercase combinations Probability UUUUUUU 0.02234 ULLLLLL 0.01763 UUUULLL 0.00287 UUULLLL 0.00246 ULLULLL 0.00184 LLLLUUU 0.00184 UULLLLL 0.00164 LLLLLUU 0.00164 LLLLLLU 0.00123 UUUUULL 0.00082

[0075] Subsequently, this embodiment integrates the matched PII tags to form a complete password feature list. This list not only contains the structured information of the password, but also integrates the identification results of the personal information, providing a detailed data basis for the subsequent password strength assessment.

[0076] In order to intuitively demonstrate the entire process of feature list construction, this embodiment produces Figure 3 The figure details the steps from password input, feature extraction, PII tag matching, to the final feature list generation.

[0077] 2. User Input

[0078] This section is specifically used to collect users' personal information. Specifically, the system will guide participants to enter their personal information, including but not limited to name, email address, phone number and other account-related details through a user-friendly interface, in order to provide data support for subsequent password strength assessment.

[0079] The tool background will analyze the password entered by the user and match it with the identified personal information tags. Through this matching, the tool can identify the specific type of information contained in the password.

[0080] 3. Strength Assessment

[0081] This embodiment uses the probability of an attacker's successful guess as a measure of the strength of a password. In the probability tree generated by TarGuess-I, an element matching the list of password features to be tested is searched to obtain the probability of the feature. Since the selection of each feature element can be considered independent of each other during the process of user-generated passwords, this embodiment uses a probability calculation formula such as Formula 1:

[0082]

[0083] Among them, P(Password) represents the probability of guessing the password to be tested, P(Feature i ) represents the probability of the i-th feature element in the probability tree, and n is the total number of features in the password feature list. This embodiment multiplies the probabilities of the elements in the probability tree that match the password feature list to obtain the probability of the password to be tested. The specific process is as follows: Figure 4 shown.

[0084] In the research field of password science and information security, the password guessing attack model is an important tool for measuring the strength of passwords. When an attacker performs a password guessing attack, he or she sorts the passwords according to their probability. Passwords with higher probabilities require fewer guessing attempts. This embodiment explores the correlation between the number of attempts and the password probability under the TarGuess-I password probability model.

[0085] In view of the limited amount of collected data, in order to more accurately obtain the mathematical relationship between the number of password guesses and the password probability, this embodiment adopts the following steps for analysis:

[0086] This embodiment first performs logarithmic transformation on the collected password probabilities and their corresponding guessing times to reduce the dispersion of the data, and then uses nonlinear least squares method to perform curve fitting on the processed data to determine the best fitting function between the guessing times and the password probability.

[0087] Finally, we get the fitting function of the form 2, and the fitting function graph is as follows: Figure 5 , where p is the password probability and n is the number of guesses.

[0088] y=9.79376176·e -0.13955719·x -10.96126108 Formula (2)

[0089] The covariance matrix of the fitting function is shown in Equation 3:

[0090]

[0091] Specifically, this embodiment defines three password strength levels: weak passwords, medium-strength passwords, and strong passwords. Table 4 shows that the most critical difference between online password guessing and offline password guessing attacks is the maximum number of guesses that the attacker can make. In online attacks, the system that the attacker attempts to attack is usually running security mechanisms such as suspicious login detection and lockout strategies. Therefore, online attackers can usually only make limited guesses (for example, 100 failed logins within 30 days recommended by NIST). In offline attacks, attackers are often not restricted by security mechanisms and can make as many guesses as possible. The only restrictions are the attacker's time and computer computing power, which means that the results of offline guesses may consist of trillions of guesses. This embodiment fully considers these two guessing attack methods when designing the judgment criteria of Zhaoheng. If a password is successfully cracked within 104, it means that it is vulnerable to online password guessing attacks and is classified as a weak password. If a password still cannot be cracked after 1014 attempts, it means that it is difficult to be attacked by offline password guessing and is defined as a strong password. The number of guesses is between the two, which is defined as a medium-strength password. The probability value P1 corresponding to guessing 104 times is the right critical value. If the probability of the password to be detected is greater than P1, it is judged as a weak password. The left critical value P2 of the probability value P2 corresponding to guessing 1014 times is obtained by fitting the function. If the probability of the password to be detected is less than P2, it is judged as a strong password. If the probability of the password to be detected is between the two, it is judged as a medium-strength password.

[0092] Table 4

[0093]

[0094] This embodiment performs a quantitative analysis of password strength based on user personal information, by collecting key user personal information, such as name, username, ID number, mobile phone number, and email address, to build a comprehensive password evaluation model.

[0095] This embodiment has the following beneficial effects:

[0096] 1. Based on comprehensive consideration of the characteristics of multiple existing password evaluation models, this embodiment can accurately identify passwords containing personal information, comprehensively and accurately identify password strength, and can well help users improve password security.

[0097] 2. This embodiment implements the password strength assessment function in an offline manner, thereby effectively avoiding personal information leakage and better defending against targeted password guessing attacks.

[0098] The protection points of this embodiment are:

[0099] 1. This embodiment proposes a password strength assessment method based on user personal information, which processes the collected personal information locally on the user device; uses the processed personal information to assess the strength of the password set by the user; and provides the user with feedback on the password strength based on the assessment result.

[0100] 2. All functions are implemented offline. Deploying models and algorithms on users’ personal devices to implement offline password strength assessment can effectively avoid privacy leaks and data security issues.

[0101] In order to implement the method of the embodiment of the present invention, the embodiment of the present invention also provides a password security assessment device based on a probability inference model, such as Figure 6 As shown, the password security assessment device 600 based on the probability inference model includes: an acquisition module 601, a processing module 602, a first matching module 603, a second matching module 604, a calculation module 605 and a determination module 606; wherein,

[0102] The acquisition module 601 is used to acquire user password information and user personal information;

[0103] Processing module 602, used to process the user personal information according to a preset PII tag setting rule to obtain multiple user PII tags;

[0104] The first matching module 603 is used to identify and match the user password information based on the multiple user PII tags, determine the multiple user PII tags matched by the user password information; and obtain the type of uppercase and lowercase combination of English characters in the user password information;

[0105] The second matching module 604 is used to match the multiple user PII tags matched by the user password information and the uppercase and lowercase combination types of English characters in the user password information with a preset probability tree to determine the feature probabilities corresponding to the user PII tags and the uppercase and lowercase combination types of English characters respectively;

[0106] A calculation module 605 is used to calculate the probability of guessing the user password information according to the feature probability; and calculate the number of guesses of the user password information according to the guessing probability;

[0107] The determination module 606 is used to determine the password strength level of the user password information according to the number of guesses of the user password information.

[0108] In actual application, the acquisition module 601, the processing module 602, the first matching module 603, the second matching module 604, the calculation module 605 and the determination module 606 can be implemented by a processor in the password security assessment device 600 based on the probability inference model.

[0109] It should be noted that: when the above-mentioned device provided in the above-mentioned embodiment is executed, only the division of the above-mentioned program modules is used as an example. In actual application, the above-mentioned processing can be assigned to different program modules as needed, that is, the internal structure of the terminal is divided into different program modules to complete all or part of the above-mentioned processing. In addition, the above-mentioned device provided in the above-mentioned embodiment belongs to the same concept as the above-mentioned method embodiment. The specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0110] In order to implement the method of the embodiment of the present invention, the embodiment of the present invention also provides a computer program product, which includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of the above method.

[0111] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present invention, the embodiment of the present invention also provides an electronic device (computer device). Specifically, in one embodiment, the computer device can be a terminal, and its internal structure diagram can be as follows: Figure 7 As shown. The computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05 and a memory (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A06. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor A01, the method of any one of the above embodiments is implemented. The display screen A04 of the computer device can be a liquid crystal display or an electronic ink display, and the input device A05 of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0112] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0113] The device provided by the embodiment of the present invention includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the method of any one of the above embodiments is implemented.

[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0115] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0118] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0119] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0120] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0121] It can be understood that the memory of the embodiment of the present invention can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memories.

[0122] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0123] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A password security assessment method based on a probabilistic inference model, characterized in that: The method comprises: Obtain user password information and user personal information; Processing the user's personal information according to a preset PII tag setting rule to obtain multiple user PII tags; Based on the multiple user PII tags, identify and match the user password information to determine the multiple user PII tags matched by the user password information; and obtain the type of uppercase and lowercase combination of English characters in the user password information; Matching the multiple user PII tags matched by the user password information and the uppercase and lowercase combination types of English characters in the user password information with a preset probability tree to determine the feature probabilities corresponding to the user PII tags and the uppercase and lowercase combination types of English characters respectively; Calculating the probability of guessing the user password information according to the feature probability; and calculating the number of guesses of the user password information according to the guessing probability; A password strength level of the user password information is determined according to the number of guesses of the user password information.

2. The password security assessment method based on the probability inference model according to claim 1 is characterized in that: The preset PII tag setting rules include: PII tag N1 represents the name, PII tag N2 represents the abbreviation of the name, PII tag N3 represents the surname, PII tag N4 represents the first name, PII tag N5 represents the first letter of the name + the surname, PII tag N6 represents the surname + the first letter of the name, and PII tag N7 represents the surname with the first letter capitalized; PII tag B1 indicates birthday in the format of year-month-day, PII tag B2 indicates birthday in the format of month-day-year, PII tag B3 indicates birthday in the format of day-month-year, PII tag B4 indicates year of birth + month, PII tag B5 indicates year of birth, PII tag B6 indicates year of birth + month, PII tag B7 indicates month of birth + year, PII tag B8 indicates the last two digits of the year of birth + date in month and day, PII tag B9 indicates date in month and day + last two digits of the year of birth, PII tag B10 indicates date in day and month + last two digits of the year of birth; PII tag A1 represents the full name of the user, PII tag A2 represents the first alphabetic segment of the user name, and PII tag A3 represents the first numeric segment of the user name; PII tag E1 represents the full name of the mailbox prefix, PII tag E2 represents the first letter segment of the mailbox prefix, and PII tag E3 represents the first number segment of the mailbox prefix; PII tag T1 represents the entire mobile phone number, PII tag T2 represents the first three digits of the mobile phone number, and PII tag T3 represents the last four digits of the mobile phone number; PII tag I1 represents the last 4 digits of the ID number, PII tag I2 represents the first 3 digits of the ID number, and PII tag I3 represents the first 6 digits of the ID number; The PII tag P1 indicates that the password contains some popular passwords.

3. The password security assessment method based on the probability inference model according to claim 1 is characterized in that: Obtain the type of uppercase and lowercase combinations of English characters in the user password information, including: Recognize the English sequence in the user password information; The uppercase state of each letter in the English sequence is represented by U, and the lowercase state of each letter in the English sequence is represented by L, so as to determine the uppercase and lowercase combination type of English characters in the English sequence.

4. The password security assessment method based on the probabilistic inference model according to claim 1 is characterized in that: The default probability tree construction methods include: Get the training dataset; Processing the training data set according to a preset PII tag setting rule to obtain a plurality of PII tags corresponding to the training data set, and obtaining a plurality of English character uppercase and lowercase combination types of the training data set; Counting the frequency of occurrence of the PII tag corresponding to each of the training data sets and the frequency of occurrence of the uppercase and lowercase English character combination types in each of the training data sets; and calculating the feature probability of each PII tag and the probability of each uppercase and lowercase English character combination type based on the frequencies; Each PII tag and each English character case combination type are used as nodes of the probability tree, and the feature probability of each PII tag and the probability of each English character case combination type are used as corresponding node weights to construct a probability tree.

5. The password security assessment method based on the probabilistic inference model according to claim 1 is characterized in that: Calculating the probability of guessing the user password information according to the feature probability includes: According to the feature probability, the guessing probability of the user password information is calculated using the following calculation formula: Among them, P(Password) represents the probability of guessing the user's password information, P(Feature i ) represents the feature probability corresponding to the user PII tag or the feature probability corresponding to the English character uppercase and lowercase combination type, and n is the number of user PII tags and English character uppercase and lowercase combination types.

6. The password security assessment method based on the probability inference model according to claim 1 is characterized in that: Calculating the number of guesses of the user password information according to the guessing probability includes: The number of guesses of the user password information is calculated according to the guessing probability using the following calculation formula: y=9.79376176·e -0.13955719·x -10.96126108 Wherein, y represents the number of guesses of the user password information, and x represents the probability of guessing the user password information.

7. The password security assessment method based on the probability inference model according to claim 1 is characterized in that: Determining the password strength level of the user password information according to the number of guesses of the user password information includes: Obtaining a first judgment threshold and a second judgment threshold; If the number of guesses of the user password information is less than a first judgment threshold, the password strength level of the user password information is determined to be a weak password; If the number of guesses of the user password information is greater than or equal to the first judgment threshold and less than the second judgment threshold, the password strength level of the user password information is determined to be a medium strength password; If the number of guesses of the user password information is greater than or equal to the second judgment threshold, the password strength level of the user password information is determined to be a strong password.

8. A password security assessment device based on a probability inference model, characterized in that: The password security assessment device based on the probability inference model comprises: An acquisition module is used to obtain user password information and user personal information; A processing module, used to process the user personal information according to a preset PII tag setting rule to obtain multiple user PII tags; A first matching module is used to identify and match the user password information based on the multiple user PII tags, determine the multiple user PII tags matched by the user password information; and obtain the type of uppercase and lowercase combination of English characters in the user password information; A second matching module is used to match multiple user PII tags matched by the user password information and the uppercase and lowercase combination types of English characters in the user password information with a preset probability tree to determine the feature probabilities corresponding to the user PII tags and the uppercase and lowercase combination types of English characters respectively; A calculation module, used to calculate the probability of guessing the user password information according to the feature probability; and calculate the number of guesses of the user password information according to the guessing probability; The determination module is used to determine the password strength level of the user password information according to the number of guesses of the user password information.

9. An electronic device, characterized in that: include: A processor and a memory for storing a computer program capable of running on the processor; wherein, When the processor is used to run the computer program, the steps of the method according to any one of claims 1 to 7 are performed.

10. A storage medium storing a computer program, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images