Password complexity judgment method
Patent Information
- Application Number
- CN202510363590.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-26
- Publication Date
- 2025-08-01
AI Technical Summary
[0003]本发明主要是解决现有技术所存在的复杂度判定方式简单、对密码强调分析不够深入等的技术问题，提供一种准确度高、多维度的密码复杂度判定方法
[0018] The substantial effects brought by the present invention are: comprehensiveness: comprehensively considering the character types and the conversion complexity between characters, more comprehensively evaluating the security of passwords; flexibility: can adapt to different security requirements by adjusting the assignment of character complexity and conversion complexity; scalability: can add new character types and conversion rules to adapt to future development needs.
Smart Images
Figure CN120408591A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security, and in particular to a method for determining password complexity. Background Art
[0002] In the field of information security, password complexity is an important indicator of password security. Traditional password complexity assessment methods focus on password length and character types, but these methods often ignore the complexity of character transitions. Summary of the Invention
[0003] The present invention mainly solves the technical problems existing in the prior art, such as the simple complexity determination method and the insufficient in-depth analysis of passwords, and provides a highly accurate and multi-dimensional password complexity determination method.
[0004] The present invention aims to solve the above technical problems mainly through the following technical solutions: a password complexity determination method comprising the following steps: S1. Count the number of character types contained in the password string and determine the type complexity D based on the number of character types. S2. Count the transformations between adjacent characters in the password string and calculate the transformation complexity T based on the transformations. S3. Calculate the basic complexity C of the password string; S4. Calculate the length complexity S based on the length of the password string; S5. Calculate the final complexity K according to the following formula: K=(D wd ×T wt ×C wc ×S ws ) 1 / 13 ; Where wd is the weight of type complexity D, wt is the weight of conversion complexity T, wc is the weight of basic complexity C, and ws is the weight of length complexity S; S6. If the final complexity is less than the complexity threshold, a warning or a prompt is issued that the password strength is insufficient; if the final complexity is greater than or equal to the complexity threshold, no prompt is issued or a prompt is issued that the password strength is sufficient.
[0005] The complexity threshold is set according to the specific application scenario and security requirements. For example, it can be set to 3 for low-security scenarios, 5 for medium-security scenarios, and 8 for high-security scenarios.
[0006] Preferably, the step S1 is specifically as follows: The character types include numbers, lowercase letters, uppercase letters, and special characters; the type complexity D is equal to the number of character types included in the password string. For example, if the password is "A123bc", which includes uppercase letters, numbers, and lowercase letters, the complexity is 3.
[0007] Preferably, the step S2 is specifically as follows: If two adjacent characters are of the same character type, the conversion degree is 0; if the previous of two adjacent characters is a number or a lowercase letter or an uppercase letter, and the latter is a special character, the conversion degree is 2; in other cases, the conversion degree is 1; count all the conversion degrees, and then the sum of all the conversion degrees is the conversion complexity T. Taking "A123bc@" as an example, the conversion degrees are 1, 0, 0, 1, 0, 2 respectively, and the conversion complexity is 1 + 0 + 0 + 1 + 0 + 2 = 4.
[0008] Preferably, the step S3 is specifically as follows: The character complexity of numbers, lowercase letters, and uppercase letters is 1, and the character complexity of special characters is 2. Add the character complexities of each character in the password string, which is the basic complexity C. Still taking "A123bc@" as an example, the character complexities of each character are 1, 1, 1, 1, 1, 1, 2 respectively, and the basic complexity is 1 + 1 + 1 + 1 + 1 + 1 + 2 = 8.
[0009] Preferably, in the step S4, the number of characters in the password string is the length complexity S. Taking "A123bc@" as an example, there are 7 characters in total, that is, the length complexity is 7.
[0010] Preferably, by default, the type complexity weight wd is 5, the conversion complexity weight wt is 4, the basic complexity weight wc is 2, and the length complexity weight ws is 2. The exponent 1 / 13 in the final complexity calculation formula, and the denominator 13 comes from 5 + 4 + 2 + 2.
[0011] Preferably, when it is detected that the password string contains regular letters or regular numbers, the basic complexity weight wc is reduced to 1; the regular letters include common words, repeated letters, and consecutive letters; the regular numbers include repeated numbers, consecutive numbers, geometric numbers, arithmetic numbers, and year-month-day numbers.
[0012] Passwords containing regular letters and / or regular numbers, such as "Sunshine2023!" or "P@ssw0rd", can meet basic complexity requirements, such as including uppercase letters, numbers, and special characters, and having sufficient length. Therefore, they may pass traditional static rule checks. However, their structural patterns are obvious and their actual security is relatively low. Attackers can use dictionary attacks or patterns generated by machine learning to crack them, or use brute force to crack similar passwords generated by combining common phrases and years. Therefore, it is necessary to reduce the basic complexity weight in this case to prompt users to set stronger passwords.
[0013] Preferably, when three or more consecutive characters belong to consecutive keyboard characters, the conversion complexity weight wt is reduced to 2.
[0014] Consecutive keyboard characters refer to characters that are positionally consecutive on the qwert keyboard, regardless of case. For example, "1q", "qA", "#e" are consecutive on the keyboard. They are more in line with human input convenience and are easily cracked by dictionary attacks. Therefore, it is necessary to reduce the conversion complexity. If only two characters are consecutive on the keyboard, the reduction of conversion complexity is not triggered. If three or more are consecutive (such as "1qa", "23Ed"), the conversion complexity is reduced.
[0015] Preferably, when a risk environment is detected, the type complexity weight wd is reduced to 3, and the conversion complexity weight wt is reduced to 3.
[0016] A risk environment refers to situations such as the login IP being in a high-risk area, the device fingerprint being abnormal, or a brute force cracking attempt being detected. For a risk environment, the most effective defense measure is to increase the password length. At this time, by reducing the weights of other factors except the length complexity, users can be made to rely more on increasing the password length to improve security. In addition, similar prompts such as "Please increase the password length" can be given actively.
[0017] Preferably, when more than one weight reduction requirement is met, the weight takes the lowest value. For example, when it is a risk environment, there are consecutive characters, and there are regular numbers, the type complexity weight wd is reduced to 3, the basic complexity weight wc is reduced to 1, and the conversion complexity weight wt is reduced to 2.
[0018] The substantial effects brought by the present invention are: comprehensiveness: comprehensively considering the character types and the conversion complexity between characters, more comprehensively evaluating the security of passwords; flexibility: can adapt to different security requirements by adjusting the assignment of character complexity and conversion complexity; scalability: can add new character types and conversion rules to adapt to future development needs. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1It is a flowchart of a password complexity determination method of the present invention. Detailed implementation manners
[0020] The technical solution of the present invention will be further specifically described below through embodiments in conjunction with the accompanying drawings.
[0021] Embodiment: A password complexity determination method, as Figure 1 shown, includes the following steps: S1. Count the number of character types included in the password string, and determine the type complexity D according to the number of character types; S2. Count the transformation situations between adjacent characters in the password string, and calculate the transformation complexity T according to the transformation situations; S3. Calculate the basic complexity C of the password string; S4. Calculate the length complexity S according to the length of the password string; S5. Calculate the final complexity K according to the following formula: K = (D wd × T wt × C wc × S ws ) 1 / 13 ; In the formula, wd is the weight of the type complexity D, wt is the weight of the transformation complexity T, wc is the weight of the basic complexity C, and ws is the weight of the length complexity S; when the final complexity is not an integer, it is truncated to one decimal place, for example, 2.4754... is taken as 2.4; S6. If the final complexity is less than the complexity threshold, give a warning or prompt that the password strength is insufficient; if the final complexity is greater than or equal to the complexity threshold, do not give a prompt or prompt that the password strength is sufficient.
[0022] The complexity threshold is set according to specific application scenarios and security requirements. For example, it can be set to 3 for low - security scenarios, 5 for medium - security scenarios, and 8 for high - security scenarios.
[0023] The specific content of step S1 is as follows: The character types include numbers, lowercase letters, uppercase letters, and special characters; the type complexity D is equal to the number of character types included in the password string. For example, if the password is "A123bc", which includes uppercase letters, numbers, and lowercase letters, the type complexity is 3.
[0024] The specific steps of step S2 are as follows: If two adjacent characters are of the same character type, the conversion degree is 0; if the previous of two adjacent characters is a digit, a lowercase letter, or an uppercase letter, and the latter is a special character, the conversion degree is 2; in other cases, the conversion degree is 1; count all the conversion degrees, and then the sum of all the conversion degrees is the conversion complexity T. Taking "A123bc@" as an example, the conversion degrees are 1, 0, 0, 1, 0, 2 respectively, and the conversion complexity is 1 + 0 + 0 + 1 + 0 + 2 = 4.
[0025] The specific steps of step S3 are as follows: The character complexity of digits, lowercase letters, and uppercase letters is 1, and the character complexity of special characters is 2. Add up the character complexities of each character in the password string, which is the basic complexity C. Still taking "A123bc@" as an example, the character complexities of each character are 1, 1, 1, 1, 1, 1, 2 respectively, and the basic complexity is 1 + 1 + 1 + 1 + 1 + 1 + 2 = 8.
[0026] In step S4, the number of characters in the password string is the length complexity S. Taking "A123bc@" as an example, there are 7 characters in total, that is, the length complexity is 7.
[0027] By default, the type complexity weight wd is 5, the conversion complexity weight wt is 4, the basic complexity weight wc is 2, and the length complexity weight ws is 2. The exponent 1 / 13 in the final complexity calculation formula, and the denominator 13 comes from 5 + 4 + 2 + 2.
[0028] When it is detected that the password string contains regular letters or regular digits, reduce the basic complexity weight wc to 1; the regular letters include common words, repeated letters, and consecutive letters; the regular digits include repeated digits, consecutive digits, geometric digits, arithmetic digits, and year-month-day digits.
[0029] Passwords containing regular letters and / or regular digits, such as "Sunshine2023!" or "P@ssw0rd", can meet the basic complexity requirements, such as containing uppercase letters, digits, and special characters, and having sufficient length, etc. Therefore, they may pass the traditional static rule check, but their structural patterns are obvious and the actual security is relatively low. Attackers can use dictionary attacks or patterns generated by machine learning to crack them, or use common phrases and year combinations to generate similar passwords for brute-force cracking. Therefore, it is necessary to reduce the basic complexity weight in this case to prompt users to set passwords with higher strength.
[0030] When three or more consecutive characters belong to consecutive keyboard characters, reduce the conversion complexity weight wt to 2.
[0031] Keyboard consecutive characters refer to characters that are positionally consecutive on a QWERTY keyboard, regardless of case. For example, "1q", "qA", "#e" are consecutive on the keyboard. This is more in line with human input convenience but is vulnerable to dictionary attacks and cracking. Therefore, it is necessary to reduce the conversion complexity. If only two characters are keyboard consecutive, the reduction of conversion complexity is not triggered. If three or more characters are keyboard consecutive (e.g., "1qa", "23Ed"), the conversion complexity is reduced.
[0032] When it is detected that the device is in a risk environment, the type complexity weight wd is reduced to 3, and the conversion complexity weight wt is reduced to 3.
[0033] A risk environment refers to situations such as the login IP being in a high-risk area, the device fingerprint being abnormal, or a brute-force cracking attempt being detected. For a risk environment, the most effective defense measure is to increase the password length. At this time, by reducing the weights of other factors except for the length complexity, users can be made to rely more on increasing the password length to improve security. In addition, similar prompts such as "Please increase the password length" can be given actively.
[0034] When more than one weight reduction requirement is met, the lowest weight value is taken. For example, if it is a risk environment, there are consecutive characters, and there are regular numbers, the type complexity weight wd is reduced to 3, the basic complexity weight wc is reduced to 1, and the conversion complexity weight wt is reduced to 2.
[0035] For example, for the password "qwer1234", the type complexity is 2, the conversion complexity is 1, the basic complexity is 8, and the length complexity is 8. If calculated using the original weights of 5, 4, 2, 2 (referring to the weights of type, conversion, basic, and length complexity in sequence, the same below), the final complexity is 2.4. However, because it contains regular numbers and more than three characters are keyboard consecutive characters, the basic complexity is reduced to 1, and the conversion complexity is reduced to 2. The final complexity is 2.1. If it is a risk environment, the type weight needs to be reduced to 3. And the conversion complexity in a risk environment is 3, which is greater than the 2 reduced for three or more consecutive keyboard characters. So the final conversion complexity is 2, that is, the final weights are 5, 2, 1, 2, and the final complexity is 1.8.
[0036] Another example is the password "a1@B56". The type complexity is 4, the conversion complexity is 1 + 2 + 1 + 1 + 0 = 5, the basic complexity is 1 + 1 + 2 + 1 + 1 + 1 = 7, and the length complexity is 6. There is no weight reduction situation, and the weights are 5, 4, 2, 2, and the final complexity is 4.9. If it is a risk environment, the weights are reduced to 3, 3, 2, 2, and the final complexity is 3.5.
[0037] For another example, for the password "8ik,9AS.", the type complexity is 4, the conversion complexity is 1 + 0 + 2 + 1 + 1 + 0 + 2 = 7, the basic complexity is 1 + 1 + 1 + 2 + 1 + 1 + 1 + 2 = 10, the length complexity is 8, "8ik," are consecutive keyboard characters, and the weights are reduced to 5, 2, 2, 2. The final complexity is 4.9; in a risk environment, the weights are reduced to 3, 3, 2, 2, and the final complexity is 4.5. In a risk environment, the final complexity is 3.6.
[0038] For another example, for the password "A!w2P#r4U%y6", the type complexity is 4, the conversion complexity is 2 + 1 + 1 + 1 + 2 + 1 + 1 + 1 + 2 + 1 + 1 = 14, the basic complexity is 1 + 2 + 1 + 1 + 1 + 2 + 1 + 1 + 1 + 2 + 1 + 1 = 15, the length complexity is 12, there is no weight reduction, and the final complexity is 8.5; in a risk environment, the final complexity is 5.6.
[0039] The specific embodiments described herein are merely illustrative of the spirit of the present invention. Those skilled in the art to which the present invention pertains can make various modifications or supplements to the described specific embodiments or use similar methods for substitution, but will not deviate from the spirit of the present invention or exceed the scope defined by the appended claims.
[0040] Although terms such as character type, conversion complexity, and weight are used more frequently herein, the possibility of using other terms is not excluded. These terms are used only to more conveniently describe and explain the essence of the present invention; interpreting them as any additional limitation is contrary to the spirit of the present invention.
Claims
1. A method for determining password complexity, characterized in that, It includes the following steps: S1. Count the number of character types included in the password string, and determine the type complexity D according to the number of character types; S2. Count the transformation situations between adjacent characters in the password string, and calculate the transformation complexity T according to the transformation situations; S3. Calculate the basic complexity C of the password string; S4. Calculate the length complexity S according to the length of the password string; S5. Calculate the final complexity K according to the following formula: K = (D wd × T wt × C wc × S ws ) 1 / 13 ; In the formula, wd is the weight of the type complexity D, wt is the weight of the transformation complexity T, wc is the weight of the basic complexity C, and ws is the weight of the length complexity S; S6. If the final complexity is less than the complexity threshold, give a warning or prompt that the password strength is insufficient; If the final complexity is greater than or equal to the complexity threshold, do not give a prompt or prompt that the password strength is sufficient.
2. The method for determining password complexity according to claim 1, wherein The specific content of step S1 is as follows: The character types include numbers, lowercase letters, uppercase letters, and special characters; the type complexity D is equal to the number of character types included in the password string.
3. The method for determining password complexity according to claim 1, wherein The specific content of step S2 is as follows: If two adjacent characters are of the same character type, the transformation degree is 0; if the previous of two adjacent characters is a number or a lowercase letter or an uppercase letter, and the latter is a special character, the transformation degree is 2; in other cases, the transformation degree is 1; count all the transformation degrees, and then the value obtained by adding all the transformation degrees is the transformation complexity T.
4. A password complexity determination method according to claim 1, wherein The specific content of step S3 is as follows: The character complexity of numbers, lowercase letters, and uppercase letters is 1, and the character complexity of special characters is 2. Add the character complexities of each character in the password string, which is the basic complexity C.
5. A method for determining password complexity according to claim 1, characterized in that, In step S4, the number of characters in the password string is the length complexity S.
6. A password complexity determination method according to any one of claims 1, characterized in that, By default, the type complexity weight wd is 5, the transformation complexity weight wt is 4, the basic complexity weight wc is 2, and the length complexity weight ws is 2.
7. A method for determining password complexity according to claim 6, characterized in that, When it is detected that the password string contains regular letters or regular numbers, reduce the basic complexity weight wc to 1; the regular letters include common words, repeated letters, and consecutive letters; the regular numbers include repeated numbers, consecutive numbers, geometric numbers, arithmetic numbers, and date numbers (year-month-day numbers).
8. A method for determining password complexity according to claim 6, characterized in that, When three or more consecutive characters belong to consecutive keyboard characters, reduce the transformation complexity weight wt to 2.
9. A method for determining password complexity according to claim 6, characterized in that, When it is detected that it is in a risk environment, reduce the type complexity weight wd to 3 and reduce the transformation complexity wt to 3.
10. A password complexity determination method according to claim 7 or 8 or 9, characterized in that, When more than one weight reduction requirement is met, the weight takes the lowest value.