Password security assessment method, device, electronic device and storage medium based on probability inference model

Abstract

The present invention discloses a password security assessment method, device, electronic device, and storage medium based on a probabilistic inference model. The method includes obtaining user password information and user personal information; processing the user personal information according to preset PII tag setting rules to obtain multiple user PII tags; identifying and matching the user password information based on the multiple user PII tags to determine the multiple user PII tags; obtaining the uppercase and lowercase English character combination types in the user password information; matching the multiple user PII tags and the uppercase and lowercase English character combination types with a preset probability tree to determine the corresponding feature probabilities; calculating the probability of guessing the user password information based on the feature probabilities; and calculating the number of guesses for the user password information based on the guess probabilities; and determining the password strength level of the user password information based on the number of guesses for the user password information. The present invention can achieve a more accurate assessment of password security.

Description

Technical Field

[0001] The present invention relates to the technical field of password security assessment, and in particular to a password security assessment method, device, electronic device and storage medium based on a probabilistic inference model. Background Art

[0002] Identity verification, the most widely used and most accessible technology for ordinary users, directly impacts the security of individuals, businesses, and governments. Passwords, the most common authentication method, despite numerous security shortcomings, remain the primary authentication method for the foreseeable future due to their ease of use, low cost, and ease of updating.

[0003] Current password strength assessment tools evaluate password security using various methods, including but not limited to character set length calculation, password entropy calculation, and cracking time estimation. These tools can detect whether a password contains lowercase letters, uppercase letters, numbers, and special characters, thereby calculating the password's character set length (the number of character types used). They also calculate the password's entropy based on the password's character set length and password length. The higher the entropy, the harder the password is to crack. Furthermore, some tools incorporate context-free grammars (PCFGs) to simulate user password construction behavior, such as the fuzzyPSM algorithm. This algorithm evaluates password strength by simulating real-world user password construction behavior and excels in detecting weak passwords.

[0004] Currently, most password strength assessment tools focus on traditional brute force, masked brute force, and dictionary attacks to prevent users from using weak passwords. These tools often fail to fully consider users' personal information when assessing password strength, potentially leading to some passwords that are actually weak (especially those containing personal information) being mistakenly rated as strong. Summary of the Invention

[0005] To address the technical problem that existing password strength assessment tools fail to fully consider the impact of user personal information on account security, embodiments of the present invention provide a password security assessment method, device, electronic device, and storage medium based on a probabilistic inference model.

[0006] The technical solution of the embodiment of the present invention is achieved as follows:

[0007] An embodiment of the present invention provides a password security assessment method based on a probabilistic inference model, the method comprising: obtaining user password information and user personal information; processing the user personal information according to a preset PII tag setting rule to obtain multiple user PII tags; identifying and matching the user password information based on the multiple user PII tags to determine the multiple user PII tags matched by the user password information; and obtaining the case combination type of English characters in the user password information; matching the multiple user PII tags matched by the user password information and the case combination type of English characters in the user password information with a preset probability tree to determine feature probabilities corresponding to the user PII tags and the case combination type of English characters, respectively; calculating a guessing probability of the user password information based on the feature probabilities; and calculating the number of guesses of the user password information based on the guessing probability; and determining a password strength level of the user password information based on the number of guesses of the user password information.

[0008] In one embodiment, the preset PII tag setting rules include: PII tag N1 represents the name, PII tag N2 represents the abbreviation of the name, PII tag N3 represents the surname, PII tag N4 represents the first name, PII tag N5 represents the first letter of the name + the surname, PII tag N6 represents the surname + the first letter of the name, and PII tag N7 represents the surname with the first letter capitalized; PII tag B1 represents the birthday in the format of year, month, and day, PII tag B2 represents the birthday in the format of month, day, and year, PII tag B3 represents the birthday in the format of day, month, and year, PII tag B4 represents the year of birth + month, PII tag B5 represents the year of birth, PII tag B6 represents the year of birth + month, PII tag B7 represents the month of birth + year, PII tag B8 represents the last two digits of the year of birth + the date represented by month and day, and PII tag B9 It represents the date expressed in month and day + the last two digits of the year of birth, and PII tag B10 represents the date expressed in day and month + the last two digits of the year of birth; PII tag A1 represents the full name of the user, PII tag A2 represents the first letter segment of the user name, and PII tag A3 represents the first numeric segment of the user name; PII tag E1 represents the full name of the email prefix, PII tag E2 represents the first letter segment of the email prefix, and PII tag E3 represents the first numeric segment of the email prefix; PII tag T1 represents the entire mobile phone number, PII tag T2 represents the first three digits of the mobile phone number, and PII tag T3 represents the last four digits of the mobile phone number; PII tag I1 represents the last four digits of the ID number, PII tag I2 represents the first three digits of the ID number, and PII tag I3 represents the first six digits of the ID number; PII tag P1 indicates that the password contains some popular passwords.

[0009] In one embodiment, obtaining the uppercase and lowercase combination type of English characters in the user password information includes: identifying an English sequence in the user password information; representing the uppercase state of each letter in the English sequence with U, and representing the lowercase state of each letter in the English sequence with L, and determining the uppercase and lowercase combination type of English characters in the English sequence.

[0010] In one embodiment, a method for constructing a preset probability tree includes: obtaining a training data set; processing the training data set according to a preset PII tag setting rule to obtain multiple PII tags corresponding to the training data set, and obtaining multiple English character case combination types in the training data set; counting the frequency of occurrence of each PII tag corresponding to the training data set and the frequency of occurrence of each English character case combination type in the training data set; and calculating the feature probability of each PII tag and the probability of each English character case combination type based on the frequencies; using each PII tag and each English character case combination type as a node of the probability tree, and using the feature probability of each PII tag and the probability of each English character case combination type as corresponding node weights to construct the probability tree.

[0011] In one embodiment, calculating the probability of guessing the user password information based on the feature probability includes: calculating the probability of guessing the user password information based on the feature probability using the following calculation formula:

[0012]

[0013] Among them, P(Password) represents the probability of guessing the user's password information, P(Feature i ) represents the feature probability corresponding to the user PII tag or the feature probability corresponding to the English character uppercase and lowercase combination type, and n is the number of user PII tags and English character uppercase and lowercase combination types.

[0014] In one embodiment, calculating the number of guesses of the user password information according to the guessing probability includes: calculating the number of guesses of the user password information according to the guessing probability using the following calculation formula:

[0015] y=9.79376176·e -0.13955719·x -10.96126108

[0016] Wherein, y represents the number of guesses of the user password information, and x represents the probability of guessing the user password information.

[0017] In one embodiment, determining the password strength level of the user password information based on the number of guesses of the user password information includes: obtaining a first judgment threshold and a second judgment threshold; if the number of guesses of the user password information is less than the first judgment threshold, determining that the password strength level of the user password information is a weak password; if the number of guesses of the user password information is greater than or equal to the first judgment threshold and less than the second judgment threshold, determining that the password strength level of the user password information is a medium strength password; if the number of guesses of the user password information is greater than or equal to the second judgment threshold, determining that the password strength level of the user password information is a strong password.

[0018] An embodiment of the present invention further provides a password security assessment device based on a probabilistic inference model. The password security assessment device based on the probabilistic inference model includes: an acquisition module for acquiring user password information and user personal information; a processing module for processing the user personal information according to a preset PII tag setting rule to acquire multiple user PII tags; a first matching module for identifying and matching the user password information based on the multiple user PII tags, determining the multiple user PII tags matched by the user password information, and acquiring the uppercase and lowercase combination types of English characters in the user password information; a second matching module for matching the multiple user PII tags matched by the user password information and the uppercase and lowercase combination types of English characters in the user password information with a preset probability tree to determine feature probabilities corresponding to the user PII tags and the uppercase and lowercase combination types, respectively; a calculation module for calculating a guess probability of the user password information based on the feature probability; and calculating the number of guesses for the user password information based on the guess probability; and a determination module for determining a password strength level of the user password information based on the number of guesses for the user password information.

[0019] An embodiment of the present invention further provides an electronic device, comprising: a processor and a memory for storing a computer program that can be run on the processor; wherein the processor executes the steps of the above-mentioned method when running the computer program.

[0020] An embodiment of the present invention further provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0021] This embodiment has the following beneficial effects:

[0022] 1. This embodiment can accurately identify passwords containing personal information, can comprehensively and accurately identify password strength, and can well help users improve password security.

[0023] 2. This embodiment implements the password strength assessment function in an offline manner, thereby effectively preventing personal information leakage and better defending against targeted password guessing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 Schematic diagram of a password security assessment method based on a probabilistic inference model according to an embodiment of the present invention;

[0025] Figure 2 Schematic diagram of the process framework of the password security assessment method based on the probabilistic inference model according to an embodiment of the present invention;

[0026] Figure 3 This is a schematic diagram of the feature list construction process according to an embodiment of the present invention;

[0027] Figure 4 Schematic diagram of the calculation process of the probability of the password to be tested according to an embodiment of the present invention;

[0028] Figure 5 Schematic diagram of the curve fitting results of password probability and its corresponding number of guesses according to an embodiment of the present invention;

[0029] Figure 6 Schematic diagram of the structure of a password security assessment device based on a probabilistic inference model according to an embodiment of the present invention;

[0030] Figure 7 This is a diagram of the internal structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] Before introducing this embodiment in detail, the following contents are introduced first:

[0032] PCFG (Probabilistic Context-Free Grammar). In computer science and linguistics, PCFG is a mathematical framework used to describe the structure of natural language sentences. It consists of a set of rules (productions), each of which defines how one or more symbols (terminal or non-terminal) are replaced with other symbols. Each rule is assigned a probability value, which represents the likelihood of the rule being selected during the generation process. It consists of five parts: a set of non-terminal symbols, a set of terminals, a start non-terminal symbol, a set of productions, and a probability distribution over the productions.

[0033] Morkov: A statistical model that assumes that a system's future state depends only on its current state, not its past state. In password guessing, a Markov model can be used to predict the probability of the next character in a password based on the state of one or more previous characters. This model can capture the dependencies between characters in a password and generate possible password combinations.

[0034] TarGuess: Targeted password guessing is a password guessing technique that uses password patterns as a guide to generate passwords. For example, if a password policy requires passwords to contain uppercase letters, lowercase letters, numbers, and special characters, the targeted password guessing model will generate passwords that meet these constraints. This approach improves guessing efficiency by only generating passwords that match a specific pattern, rather than randomly generating all possible password combinations.

[0035] The TarGuess-I model is a model for guessing user passwords, proposed by Wang Ding et al. at the 2016 ACM Conference on Computer and Communications Security (ACM CCS). This model uses password information leaked by users on other websites and some personal identity information to guess the user's password on a specific website.

[0036] PII: Personally Identifiable Information (PII) is any data that can be used to identify, distinguish, or trace an individual. This includes direct identifiers such as name, social security number, email address, phone number, and biometric data.

[0037] The present invention will be described in further detail below with reference to the accompanying drawings and embodiments.

[0038] The embodiment of the present invention provides a password security assessment method based on a probabilistic inference model, such as Figure 1 As shown, the method includes:

[0039] Step 101: Obtain user password information and user personal information;

[0040] Step 102: Process the user's personal information according to a preset PII tag setting rule to obtain multiple user PII tags;

[0041] Step 103: Based on the multiple user PII tags, identify and match the user password information to determine the multiple user PII tags that the user password information matches; and obtain the type of uppercase and lowercase English character combinations in the user password information;

[0042] Step 104: Match the multiple user PII tags matched by the user password information and the uppercase and lowercase English character combination types in the user password information with a preset probability tree to determine the feature probabilities corresponding to the user PII tags and the uppercase and lowercase English character combination types, respectively;

[0043] Step 105: Calculate the probability of guessing the user password information based on the feature probability; and calculate the number of guesses of the user password information based on the guess probability;

[0044] Step 106: Determine the password strength level of the user password information based on the number of guesses of the user password information.

[0045] This embodiment proposes a new password security assessment method that can integrate factors such as user personal information, popular passwords, and keyboard pattern passwords. Based on the TarGuess-I model, this method combines popular password dictionaries and keyboard pattern password dictionaries to achieve a more accurate assessment of password security.

[0046] This example proposes an innovative password strength assessment framework that quantitatively analyzes password strength based on user personal information. The core of this example is to build a comprehensive password assessment model by collecting key user personal information, such as name, username, ID number, mobile phone number, and email address.

[0047] This embodiment first uses the longest prefix matching algorithm to extract the longest subsequence that matches the personal information from the password set by the user. This step is intended to identify the personally identifiable information (PII) that may be contained in the password, thereby assessing its potential security risks.

[0048] This embodiment introduces a popular password database and keyboard pattern recognition technology to detect whether there are common patterns or regular sequences based on keyboard layouts in passwords. This step helps identify passwords that are easy to guess or exploit pattern attacks.

[0049] To build the evaluation model, this example uses a dataset collected from the internet as a training set. Through in-depth analysis of the passwords in the training set, we identified and counted the frequency of PII tags and uppercase and lowercase combinations of English characters. Based on these statistics, we calculated the probability of each tag and uppercase combination, and constructed a feature list containing information about the password structure.

[0050] During the password evaluation phase, this embodiment performs a structured analysis of the user-provided password and compares it with the provided personal information to identify the corresponding tag type. By querying the previously constructed feature list, the probability distribution of the password is calculated. Finally, using the least squares method, the number of attempts required to crack the password is further estimated, and this value is used as a quantitative indicator of password strength.

[0051] Compared with the prior art, this embodiment has the following differences:

[0052] 1. Fully consider user personal information to achieve more accurate password strength assessment.

[0053] 2. Implement password strength assessment offline.

[0054] 3. The logic of judging the strength of passwords is different.

[0055] Below, the solution of this embodiment will be described in detail using a specific scenario.

[0056] See also Figure 2 The system architecture diagram of this embodiment is as follows: Figure 2 The tool in this embodiment is mainly divided into three parts: model training, label recognition, and password evaluation. The detailed description of the implementation process of each part is as follows.

[0057] 1. Model Training

[0058] This embodiment adopts a type-based PII field matching method, which expands on the existing probabilistic context-free grammar (PCFG) model and introduces the concepts of PII main tags and sub-tags.

[0059] Specifically, this embodiment expands the L (letter), D (number), and S (special symbol) tags in the PCFG model to accommodate PII identification requirements. Within this framework, the PII primary tag is used to identify the type of PII. For example, label N is used to represent a name, label B is used to represent a birthday, and so on. In addition, to further refine the classification of PII, this embodiment introduces PII subtags, which are distinguished by subscripts to indicate the subclass number of a specific PII type. This embodiment defines a total of seven PII tags:

[0060] (1) N indicates the usage of names, N1 indicates given name (e.g., zhangsan), N2 indicates abbreviated name (e.g., zs), N3 indicates surname (e.g., zhang), N4 indicates given name (e.g., san), N5 indicates the first letter of the name + surname (e.g., szhang), N6 indicates the surname + the first letter of the name (e.g., zhangs), and N7 indicates the surname with the first letter capitalized (e.g., Zhang).

[0061] (2) B indicates the usage of date of birth. B1 indicates birthday in the format of year, month, and day (e.g., 20060607). B2 indicates birthday in the format of month, day, and year (e.g., 06072006). B3 indicates birthday in the format of day, month, and year (e.g., 07062006). B4 indicates year of birth + month (e.g., 200606). B5 indicates year of birth (e.g., 2006). B6 indicates year of birth + month (e.g., 200606). B7 indicates month of birth + year (e.g., 062006). B8 indicates the last two digits of the year of birth + date in month and day (e.g., 820607). B9 indicates date in month and day + the last two digits of the year of birth (e.g., 060782). B10 indicates date in day and month + the last two digits of the year of birth (e.g., 070682).

[0062] (3) A represents the usage of the username information, A1 represents the full name of the username (such as lilychee12), A2 represents the first letter segment of the username (such as lilychee), and A3 represents the first numeric segment of the username (such as 12);

[0063] (4) E represents the usage of email prefix information. Taking loveu1314@163.com as an example, E1 represents the full name of the email prefix (such as loveu1314), E2 represents the first letter segment of the email prefix (such as loveu), and E3 represents the first numeric segment of the email prefix (such as 1314);

[0064] (5) T represents the usage of the mobile phone number, T1 represents the entire mobile phone number, T2 represents the first three digits of the mobile phone number, and T3 represents the last four digits of the mobile phone number;

[0065] (6) I represents the usage of Chinese ID number, I1 represents the last 4 digits of the ID number, I2 represents the first 3 digits of the ID number, and I3 represents the first 6 digits of the ID number.

[0066] (7) P indicates the usage of popular passwords, and P1 indicates that the password contains some popular passwords.

[0067] Our training data comes from five large Chinese websites, as shown in Table 1. These data were leaked by hackers or insiders and are publicly available for download on the Internet.

[0068] Table 1

[0069] Rank 12306 Dudu Cow grand Tianya Youku 1 123456 123456 123456 123456 123456 2 a123456 111111 111111 111111 a123456 3 123456a 123456789 5201314 12345678 111111 4 woaini1314 5201314 123456789 5201314 12345678 5 5201314 123123 123123 123123 5201314 6 111111 a123456 88888888 1qaz2wsx 123456a 7 qq123456 woaini1314 a123456 7758521 123123 8 1qaz2wsx 1314520 qq123456 1314520 123456789a 9 88888888 123456a woaini1314 666666 woaini1314 10 123qwe qq123456 1qaz2wsx 123321 123qwe ％ 0.0128 0.0328 0.0376 0.0461 0.0375

[0070] This embodiment first parses the passwords in the training set to identify PII tags and uppercase and lowercase combinations of English characters. For example, for English uppercase and lowercase combinations, the model recognizes sequences like "Abc" and labels them as ULL (uppercase-lowercase-lowercase), where the case of each letter is represented by U (uppercase) and L (lowercase), respectively. The TarGuess-I model is then used to calculate the frequency of each tag and uppercase combination in a sufficiently large training set. Based on these frequencies, the model derives the probability of the corresponding tag. This embodiment systematically organizes the PII tag probabilities and English uppercase and lowercase combination probabilities generated by the TarGuess-I model, as shown in Tables 2 and 3. These results are recorded in a probability tree. Each node in the probability tree represents a specific password feature, and the node weight indicates the relative frequency of that feature in the training data.

[0071] Table 2

[0072] PII Tagging Probability <![CDATA[N2B1]]> 0.010002 <![CDATA[N2B8]]> 0.008754 <![CDATA[N2P1]]> 0.008061 <![CDATA[N2U3]]> 0.004711 <![CDATA[N1B5]]> 0.003354 <![CDATA[N1U3]]> 0.003208 <![CDATA[B1N2]]> 0.002693 <![CDATA[N3U3]]> 0.002572 <![CDATA[N1B4]]> 0.002396 <![CDATA[N3B1]]> 0.002255

[0073] Table 3

[0074] Uppercase and lowercase combinations Probability UUUUUUU 0.02234 ULLLLLL 0.01763 UUUULLL 0.00287 UUULLLL 0.00246 ULLULLL 0.00184 LLLLUUU 0.00184 UULLLLL 0.00164 LLLLLUU 0.00164 LLLLLLU 0.00123 UUUUULL 0.00082

[0075] This embodiment then integrates the matched PII tags to form a complete password feature list. This list not only contains the structured information of the password, but also integrates the identification results of personal information, providing a detailed data foundation for subsequent password strength assessment.

[0076] In order to intuitively demonstrate the entire process of feature list construction, this embodiment produces Figure 3 The figure details the steps from password input, feature extraction, PII tag matching, to the final feature list generation.

[0077] 2. User Input

[0078] This section is specifically used to collect users' personal information. Specifically, the system will guide participants to enter their personal information through a user-friendly interface, including but not limited to name, email address, phone number and other account-related details, in order to provide data support for subsequent password strength assessment.

[0079] The tool analyzes the password entered by the user and matches it with the identified personal information tags. Through this matching, the tool can identify the specific information type contained in the password.

[0080] 3. Strength Assessment

[0081] This embodiment uses the probability of an attacker's successful guess as a measure of password strength. The probability tree generated by TarGuess-I is searched for elements that match the list of features in the password to be tested, thereby obtaining the probability of that feature. Since the selection of each feature element during the user-generated password process can be considered independent of each other, this embodiment uses the probability calculation formula of the form 1:

[0082]

[0083] Among them, P(Password) represents the probability of guessing the password to be tested, P(Feature i ) represents the probability of the i-th feature element in the probability tree, and n is the total number of features in the password feature list. This embodiment multiplies the probabilities of the elements in the probability tree that match the password feature list to obtain the probability of the password to be tested. The specific process is as follows: Figure 4 shown.

[0084] In the fields of password science and information security research, password guessing attack models are important tools for measuring password strength. When performing a password guessing attack, attackers rank passwords based on their probability. Passwords with higher probabilities require fewer guessing attempts. This example explores the correlation between the number of attempts and password probability using the TarGuess-I password probability model.

[0085] Given the limited amount of collected data, in order to more accurately derive the mathematical relationship between the number of password guesses and the password probability, this embodiment employs the following steps for analysis:

[0086] This embodiment first performs a logarithmic transformation on the collected password probabilities and their corresponding guess counts to reduce data dispersion. A nonlinear least squares method is then used to curve fit the processed data to determine the optimal fit function between the guess count and password probability.

[0087] Finally, we get the fitting function of the form 2, and the fitting function graph is as follows: Figure 5 , where p is the password probability and n is the number of guesses.

[0088] y=9.79376176·e -0.13955719·x -10.96126108 Formula (2)

[0089] The covariance matrix of the fitting function is shown in Equation 3:

[0090]

[0091] Specifically, this embodiment defines three password strength levels: weak, medium, and strong. Table 4 shows that the key difference between online and offline password guessing attacks is the maximum number of guesses an attacker can make. In online attacks, the system the attacker attempts to attack typically has security mechanisms in place, such as suspicious login detection and lockout policies. Therefore, online attackers are typically limited to a limited number of guesses (for example, the NIST-recommended limit of 100 failed logins within 30 days). In offline attacks, attackers are often unconstrained by security mechanisms and can make as many guesses as possible. The only limitations are the attacker's time and computing power. This means that the results of offline guesses can potentially consist of trillions of guesses. This embodiment takes both types of guessing attacks into account when designing the judgment criteria. If a password is successfully cracked within 10⁴ attempts, it is vulnerable to online password guessing attacks and is classified as weak. If a password remains uncracked after 10⁻¹⁴ attempts, it is less vulnerable to offline password guessing attacks and is defined as strong. Passwords with a guess count between these two levels are defined as medium. The probability value P1 corresponding to 104 guesses is taken as the right critical value. If the probability of the password to be tested is greater than P1, it is judged as a weak password. The left critical value P2 corresponding to 1014 guesses is obtained by fitting the function. If the probability of the password to be tested is less than P2, it is judged as a strong password. If the probability of the password to be tested is between the two, it is judged as a medium-strength password.

[0092] Table 4

[0093]

[0094] This example conducts a quantitative analysis of password strength based on user personal information. By collecting key user personal information such as name, username, ID number, mobile phone number, and email address, a comprehensive password evaluation model is constructed.

[0095] This embodiment has the following beneficial effects:

[0096] 1. This embodiment, based on comprehensive consideration of the characteristics of multiple existing password evaluation models, can accurately identify passwords containing personal information and comprehensively and accurately identify password strength, which can greatly help users improve password security.

[0097] 2. This embodiment implements the password strength assessment function in an offline manner, thereby effectively preventing personal information leakage and better defending against targeted password guessing attacks.

[0098] The protection points of this embodiment are:

[0099] 1. This embodiment proposes a password strength assessment method based on user personal information. The method processes collected personal information locally on the user's device; uses the processed personal information to assess the strength of the password set by the user; and provides feedback on the password strength to the user based on the assessment results.

[0100] 2. All functions are implemented offline. Deploying models and algorithms on users' personal devices to perform offline password strength assessment can effectively prevent privacy leaks and data security issues.

[0101] In order to implement the method of the embodiment of the present invention, the embodiment of the present invention also provides a password security assessment device based on a probability inference model, such as Figure 6 As shown, the password security assessment device 600 based on the probability inference model includes: an acquisition module 601, a processing module 602, a first matching module 603, a second matching module 604, a calculation module 605 and a determination module 606; wherein,

[0102] Acquisition module 601, used to obtain user password information and user personal information;

[0103] Processing module 602, configured to process the user's personal information according to a preset PII tag setting rule to obtain multiple user PII tags;

[0104] A first matching module 603 is configured to identify and match the user password information based on the multiple user PII tags, determine the multiple user PII tags that the user password information matches, and obtain the type of uppercase and lowercase English character combinations in the user password information;

[0105] A second matching module 604 is configured to match the multiple user PII tags matched by the user password information and the uppercase and lowercase English character combinations in the user password information with a preset probability tree to determine feature probabilities corresponding to the user PII tags and the uppercase and lowercase English character combinations, respectively;

[0106] A calculation module 605 is configured to calculate a probability of guessing the user password information based on the feature probability; and calculate a number of guesses of the user password information based on the guess probability;

[0107] The determination module 606 is configured to determine the password strength level of the user password information according to the number of guesses of the user password information.

[0108] In actual application, the acquisition module 601 , the processing module 602 , the first matching module 603 , the second matching module 604 , the calculation module 605 and the determination module 606 may be implemented by a processor in the password security assessment device 600 based on a probability inference model.

[0109] It should be noted that the above embodiments provide apparatuses that are implemented using the division of the above program modules as an example. In actual applications, the above processing can be distributed to different program modules as needed, that is, the internal structure of the terminal can be divided into different program modules to complete all or part of the above-described processing. In addition, the apparatuses provided in the above embodiments and the above-described method embodiments are based on the same concept. The specific implementation process is detailed in the method embodiments and will not be repeated here.

[0110] To implement the method of an embodiment of the present invention, an embodiment of the present invention further provides a computer program product. The computer program product includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the above method.

[0111] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present invention, the embodiment of the present invention further provides an electronic device (computer device). Specifically, in one embodiment, the computer device can be a terminal, and its internal structure diagram can be as follows: Figure 7 As shown. The computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05 and a memory (not shown in the figure) connected via a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A06. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor A01, the method of any one of the above embodiments is implemented. The display screen A04 of the computer device can be a liquid crystal display or an electronic ink display screen, and the input device A05 of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0112] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0113] The device provided by an embodiment of the present invention includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the method of any one of the above embodiments is implemented.

[0114] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0115] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0118] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0119] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0120] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0121] It is understood that the memory of the embodiments of the present invention can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM); magnetic surface memory can be magnetic disk memory or tape memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memories.

[0122] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0123] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A password security assessment method based on a probabilistic inference model, characterized in that: The method comprises: Obtain user password information and personal information; Processing the user's personal information according to preset PII tag setting rules to obtain multiple user PII tags; Based on the multiple user PII tags, the user password information is identified and matched to determine the multiple user PII tags that the user password information matches; and the type of uppercase and lowercase combination of English characters in the user password information is obtained; Matching the multiple user PII tags matched by the user password information and the uppercase and lowercase English character combination types in the user password information with a preset probability tree to determine the feature probabilities corresponding to the user PII tags and the uppercase and lowercase English character combination types, respectively; Calculating the probability of guessing the user password information based on the feature probability; and calculating the number of guesses of the user password information based on the guess probability; determining a password strength level of the user password information based on the number of guesses of the user password information; Among them, the preset probability tree construction methods include: Get the training dataset; Processing the training dataset according to a preset PII tag setting rule to obtain multiple PII tags corresponding to the training dataset and multiple uppercase and lowercase English character combination types in the training dataset; Counting the frequency of occurrence of the PII tag corresponding to each training data set and the frequency of occurrence of the uppercase and lowercase English character combination type in each training data set; and calculating the feature probability of each PII tag and the probability of each uppercase and lowercase English character combination type based on the frequencies; Construct a probability tree by using each PII tag and each English character case combination type as a node, and using the feature probability of each PII tag and the probability of each English character case combination type as the corresponding node weights; Calculating the probability of guessing the user password information based on the feature probability includes: According to the feature probability, the guessing probability of the user password information is calculated using the following calculation formula: in, Indicates the probability of guessing the user's password information, Indicates the feature probability corresponding to the user's PII tag or the feature probability corresponding to the combination of uppercase and lowercase English characters. The number of user PII tags and uppercase and lowercase English character combinations; Calculating the number of guesses of the user password information according to the guess probability includes: The number of guesses of the user password information is calculated according to the guess probability using the following formula: in, Indicates the number of guesses for the user's password information. Indicates the probability of guessing the user's password information.

2. The password security assessment method based on the probabilistic inference model according to claim 1 is characterized in that: The preset PII tag setting rules include: PII tag N1 represents the name, PII tag N2 represents the abbreviation of the name, PII tag N3 represents the surname, PII tag N4 represents the first name, PII tag N5 represents the first letter of the name + the surname, PII tag N6 represents the surname + the first letter of the name, and PII tag N7 represents the surname with the first letter capitalized; PII tag B1 indicates birthday in the format of year, month, and day; PII tag B2 indicates birthday in the format of month, day, and year; PII tag B3 indicates birthday in the format of day, month, and year; PII tag B4 indicates year of birth + month of birth; PII tag B5 indicates year of birth; PII tag B6 indicates year of birth + month of birth; PII tag B7 indicates month of birth + year of birth; PII tag B8 indicates the last two digits of the year of birth + date in month and day; PII tag B9 indicates date in month and day + the last two digits of the year of birth; PII tag B10 indicates date in day and month + the last two digits of the year of birth; PII tag A1 represents the full name of the user, PII tag A2 represents the first alphabetical segment of the user, and PII tag A3 represents the first numeric segment of the user; PII tag E1 represents the full name of the mailbox prefix, PII tag E2 represents the first alphabetical segment of the mailbox prefix, and PII tag E3 represents the first numeric segment of the mailbox prefix; PII tag T1 represents the entire mobile phone number, PII tag T2 represents the first three digits of the mobile phone number, and PII tag T3 represents the last four digits of the mobile phone number; PII tag I1 represents the last four digits of the ID number, PII tag I2 represents the first three digits of the ID number, and PII tag I3 represents the first six digits of the ID number; The PII tag P1 indicates that the password contains some popular passwords.

3. The password security assessment method based on the probabilistic inference model according to claim 1 is characterized in that: Obtain the uppercase and lowercase combination types of English characters in the user password information, including: Recognizing English sequences in the user password information; The uppercase state of each letter in the English sequence is represented by U, and the lowercase state of each letter in the English sequence is represented by L, to determine the uppercase and lowercase combination type of English characters in the English sequence.

4. The password security assessment method based on the probabilistic inference model according to claim 1, characterized in that: Determining a password strength level of the user password information based on the number of guesses of the user password information includes: Obtaining a first judgment threshold and a second judgment threshold; If the number of guesses of the user password information is less than a first judgment threshold, the password strength level of the user password information is determined to be a weak password; If the number of guesses of the user password information is greater than or equal to the first judgment threshold and less than the second judgment threshold, the password strength level of the user password information is determined to be a medium strength password; If the number of guesses of the user password information is greater than or equal to a second judgment threshold, the password strength level of the user password information is determined to be a strong password.

5. A password security assessment device based on a probabilistic inference model, characterized in that: The password security assessment device based on the probability inference model includes: The acquisition module is used to obtain user password information and user personal information; A processing module, configured to process the user's personal information according to a preset PII tag setting rule to obtain multiple user PII tags; a first matching module configured to identify and match the user password information based on the multiple user PII tags, determine the multiple user PII tags that the user password information matches, and obtain the type of uppercase and lowercase English character combinations in the user password information; a second matching module configured to match the plurality of user PII tags matched by the user password information and the uppercase and lowercase English character combinations in the user password information with a preset probability tree to determine feature probabilities corresponding to the user PII tags and the uppercase and lowercase English character combinations, respectively; a calculation module, configured to calculate a probability of guessing the user password information based on the feature probability; and calculate a number of guesses of the user password information based on the guessing probability; a determination module, configured to determine a password strength level of the user password information based on the number of guesses of the user password information; Among them, the preset probability tree construction methods include: Get the training dataset; Processing the training dataset according to a preset PII tag setting rule to obtain multiple PII tags corresponding to the training dataset and multiple uppercase and lowercase English character combination types in the training dataset; Counting the frequency of occurrence of the PII tag corresponding to each training data set and the frequency of occurrence of the uppercase and lowercase English character combination type in each training data set; and calculating the feature probability of each PII tag and the probability of each uppercase and lowercase English character combination type based on the frequencies; Construct a probability tree by using each PII tag and each English character case combination type as a node, and using the feature probability of each PII tag and the probability of each English character case combination type as the corresponding node weights; Calculating the probability of guessing the user password information based on the feature probability includes: According to the feature probability, the guessing probability of the user password information is calculated using the following calculation formula: in, Indicates the probability of guessing the user's password information, Indicates the feature probability corresponding to the user's PII tag or the feature probability corresponding to the combination of uppercase and lowercase English characters. The number of user PII tags and uppercase and lowercase English character combinations; Calculating the number of guesses of the user password information according to the guess probability includes: The number of guesses of the user password information is calculated according to the guess probability using the following formula: in, Indicates the number of guesses for the user's password information. Indicates the probability of guessing the user's password information.

6. An electronic device, characterized in that: include: A processor and a memory for storing a computer program capable of running on the processor; wherein, When the processor is used to run the computer program, the processor performs the steps of the method according to any one of claims 1 to 4.

7. A storage medium storing a computer program, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images