A video device weak password management method and device

Abstract

The application discloses a kind of video equipment weak password management method and device, belong to video monitoring network security field.Method includes: detecting and identifying each video equipment;Wherein, each video equipment is from different manufacturers;Using pre-packaged dynamic detection interface, based on the fingerprint of each video equipment Call corresponding authentication process algorithm carries out the authentication of each video equipment, to further weak password detection is carried out to each video equipment;Using pre-packaged password correction interface, based on the address of each video equipment with weak password Call corresponding SDK interface to carry out password correction.The scheme, by encapsulating dynamic detection interface, the process algorithm corresponding to the authentication protocol of different manufacturers is encapsulated, which can improve the universality and detection efficiency of weak password detection;By encapsulating password correction interface, the SDK interface of each manufacturer is encapsulated together to realize the automatic password correction of weak password video equipment, improve universality and network security.

Description

Technical Field

[0001] This invention relates to the field of video surveillance network security technology, and in particular to a method and apparatus for managing weak passwords for video devices. Background Technology

[0002] With the increasing number of manufacturers of video equipment such as cameras, traditional weak password management methods for video devices are becoming increasingly difficult to apply in today's multi-vendor, multi-protocol environment. Different manufacturers have significantly different authentication protocols, and existing password brute-force methods rely on manually written scripts, resulting in poor universality. Furthermore, traditional weak password management methods cannot correct weak passwords.

[0003] Therefore, traditional weak password management methods have poor universality, inefficient detection, and cannot perform password correction to improve network security. Thus, there is an urgent need to provide a new method for managing weak passwords on video devices. Summary of the Invention

[0004] To address the problems of poor universality, inefficient detection, and inability to correct passwords in traditional weak password management methods, this invention provides a method and apparatus for managing weak passwords in video devices.

[0005] On the one hand, a method for managing weak passwords on video devices is provided, the method comprising: The system detects and identifies various video devices, each from a different manufacturer. Using a pre-encapsulated dynamic detection interface, the corresponding authentication process algorithm is invoked based on the fingerprint of each video device to authenticate each video device, so as to further detect weak passwords for each video device; Using a pre-encapsulated password correction interface, the corresponding SDK interface is called to correct the password based on the address of each video device with a weak password.

[0006] On the other hand, a weak password management device for video devices is provided, the device comprising: A multi-protocol detection unit is used to detect and identify various video devices, which are manufactured by different companies. A generalized weak password detection unit is used to use a pre-encapsulated dynamic detection interface to call the corresponding authentication process algorithm based on the fingerprint of each video device to authenticate each video device, so as to further detect weak passwords for each video device. A general password repair unit is used to call the corresponding SDK interface to perform password repair based on the address of each video device with a weak password by utilizing a pre-encapsulated password repair interface.

[0007] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing a computer program, and the processor for executing the computer program stored in the memory to implement the steps of the method described above.

[0008] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the method described above.

[0009] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described above.

[0010] The technical solution provided by this invention can bring at least the following beneficial effects: By encapsulating the dynamic detection interface and the process algorithms corresponding to authentication protocols from different manufacturers, the universality and efficiency of weak password detection can be improved. By encapsulating the password correction interface and the SDK interfaces of various manufacturers together, the automated password correction of video devices with weak passwords can be achieved, thereby improving universality and network security. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a video device weak password management method according to an embodiment of the present invention; Figure 2 This is a structural diagram of a video device weak password management device provided in an embodiment of the present invention; Figure 3 This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0014] The following describes the specific implementation of the above concept.

[0015] Please refer to Figure 1 This invention provides a method for managing weak passwords in video devices, the method comprising: Step 100: Detect and identify each video device; each video device is from a different manufacturer; Step 102: Using a pre-packaged dynamic detection interface, the corresponding authentication process algorithm is invoked based on the fingerprint of each video device to authenticate each video device, so as to further detect weak passwords for each video device. Step 104: Using the pre-encapsulated password correction interface, call the corresponding SDK interface to correct the password based on the address of each video device with a weak password.

[0016] In this embodiment of the invention, by encapsulating the dynamic detection interface, the process algorithms corresponding to the authentication protocols of different manufacturers are encapsulated, which can improve the universality and detection efficiency of weak password detection; by encapsulating the password correction interface, the SDK interfaces of various manufacturers are encapsulated together to realize the automated password correction of video devices with weak passwords, thereby improving universality and network security.

[0017] The following description Figure 1 The execution method of each step is shown.

[0018] For step 100: In some implementations, step 100 may include: A dual-mode active and passive detection mechanism, which involves actively sending packets and obtaining traffic packets from switches, is used to acquire data packets from each video device. Based on a pre-established cross-vendor protocol feature database, protocol feature identification is performed on the data packets of each video device to identify each video device.

[0019] Traditional device discovery methods mainly rely on the ONVIF protocol. However, older devices or some manufacturers may disable related services, resulting in incomplete device discovery.

[0020] In this embodiment, a dual-mode discovery mechanism is formed by combining WS-Discovery broadcasting, DHDiscover unicasting, and UPnP SSDP monitoring, which involves both active packet scanning and passive acquisition of traffic packets from the switch. This significantly improves the device discovery rate. A cross-vendor multi-protocol feature database is also established, including features such as HTTP Header, TLS certificate information, and response time sequences, enabling identification even when standard protocols are not enabled on the device. This embodiment achieves cross-VLAN / NAT device discovery through multi-hop probing and proxy forwarding.

[0021] Regarding step 102: In this embodiment, the PDL protocol description language is used to uniformly abstract authentication process algorithms from different vendors, such as Dahua Cookie verification and Hikvision XML-RPC. The dynamic detection interface automatically matches the corresponding authentication process algorithm to generate a request based on the fingerprint of the video device, without the need to call the SDK or write scripts separately, thus achieving cross-vendor compatibility.

[0022] In some implementations, weak password detection is performed on each video device, including: Weak password brute-force algorithms are used to detect weak passwords on various video devices; Based on the successful matching frequency of each weak password in the weak password dictionary, attempts are made sequentially starting with the high-frequency weak passwords; Real-time acquisition of response content from each video device; If the response is normal, enable high-concurrency fast mode to perform weak password detection on the video device; When the response indicates a locked status, the device will automatically go into sleep mode for a set time before performing weak password detection on the video device. When the response indicates too many requests, switch to single-threaded low-speed detection mode to perform weak password detection on the video device.

[0023] Traditional brute-force methods rely on manually written scripts, which have poor versatility. Some video devices have login failure lockouts, CAPTCHAs, and rate limits, so traditional brute-force methods are prone to triggering defense mechanisms and are inefficient.

[0024] In this embodiment, by dynamically adjusting the brute-force strategy, such as brute-force rate, concurrency, and request mode, based on the response content of real-time feedback, it is possible not only to avoid triggering the manufacturer's protection mechanism, but also to reduce the device load.

[0025] Regarding step 104: In some implementations, step 104 may include: Using a pre-packaged password correction interface, the address of the video device is obtained, and the corresponding manufacturer is determined based on the address of the video device in order to call the SDK interface of the corresponding manufacturer. By utilizing the called SDK interface and adding a secure rollback mechanism, weak passwords for video devices can be corrected. After the correction is completed, the video device is verified to be usable using a triple verification method: Ping, SNMPv3, and application layer authentication. If the device is verified to be usable, the correction is successful. If verification fails, the security rollback mechanism is triggered, and the password reverts to the original weak password.

[0026] Due to licensing restrictions and inconsistent interfaces in vendor SDKs, it is difficult to develop a universal solution. Furthermore, without standardized verification of successful password changes, devices can easily become unreachable.

[0027] In this embodiment, the PDL protocol description language is used to uniformly abstract password modification operations from different manufacturers, encapsulate them into a password correction interface, determine the corresponding manufacturer based on the address of the video device, and call the SDK interface of the corresponding manufacturer to achieve cross-manufacturer universal password correction, get rid of SDK limitations, achieve universal password hardening, and improve device security.

[0028] In addition, by combining multi-channel detection, Ping, SNMPv3, and application layer handshake, we can ensure that the device remains online and controllable after the password is changed.

[0029] In some implementations, the secure rollback mechanism is achieved in the following manner: Before changing the password, save the original password and create a temporary auxiliary account. If the new password verification fails, roll back to the original weak password.

[0030] In this embodiment, during the password modification process, the system generates a temporary auxiliary account and a two-factor authentication channel. If the modification fails, it can be rolled back to the original weak password to avoid device disconnection.

[0031] To verify the effectiveness of this solution, it has been applied to a municipal-level surveillance network governance project: Through a multimodal discovery mechanism, 1200 devices deployed across regions were identified, among which 38 Uniview cameras were successfully identified via TLS certificate fingerprinting because they did not use the standard protocol. Adaptive brute-force control automatically switches to low-frequency mode when detecting Dahua devices to avoid triggering locking mechanisms, improving detection efficiency by 45%. The password correction strategy batch modifies weak passwords, and through multi-channel availability verification, the success rate of password repair reaches 99.5%.

[0032] Please refer to Figure 2 This invention provides a video device weak password management device for implementing the steps of any method embodiment in the specification. The device includes: The multi-protocol detection unit 201 is used to detect and identify various video devices, which are manufactured by different companies. The generalized weak password detection unit 202 is used to use a pre-encapsulated dynamic detection interface to call the corresponding authentication process algorithm based on the fingerprint of each video device to authenticate each video device, so as to further detect weak passwords for each video device. The general password repair unit 203 is used to call the corresponding SDK interface to perform password repair based on the address of each video device with a weak password by utilizing a pre-encapsulated password repair interface.

[0033] It should be noted that the video device weak password management device provided in the above embodiments is only an example of the division of the above functional units. In actual applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. In addition, the above device embodiments and method embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0034] Embodiments of this application also provide a computer device, please refer to... Figure 3 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, at least one program, code set or instruction set being loaded and executed by the processor to implement the video device weak password management method provided in the above method embodiments.

[0035] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the video device weak password management method provided in the above-described method embodiments.

[0036] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform any of the video device weak password management methods described in the above embodiments.

[0037] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.

[0038] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of the embodiments of this application.

Claims

1. A method for managing weak passwords on video devices, characterized in that, include: The system detects and identifies various video devices, each from a different manufacturer. Using a pre-encapsulated dynamic detection interface, the corresponding authentication process algorithm is invoked based on the fingerprint of each video device to authenticate each video device, so as to further detect weak passwords for each video device; Using a pre-encapsulated password correction interface, the corresponding SDK interface is called to correct the password based on the address of each video device with a weak password; the pre-encapsulated dynamic detection interface and / or the pre-encapsulated password correction interface are written using the PDL protocol description language; Weak password detection is performed on each of the aforementioned video devices, including: Weak password brute-force algorithm is used to detect weak passwords in each of the video devices. Based on the successful matching frequency of each weak password in the weak password dictionary, attempts are made sequentially starting with the high-frequency weak passwords; Real-time acquisition of the response content from each of the aforementioned video devices; If the response is normal, enable high-concurrency fast mode to perform weak password detection on the video device; When the response indicates a lock, the device will automatically go into sleep mode for a set time before performing weak password detection on the video device. When the response content indicates too many requests, switch to single-threaded low-speed detection mode to perform weak password detection on the video device. The step of using a pre-encapsulated password correction interface to call the corresponding SDK interface for password correction based on the address of each video device with a weak password includes: Using a pre-encapsulated password correction interface, the address of the video device is obtained, and the corresponding manufacturer is determined based on the address of the video device, so as to call the SDK interface of the corresponding manufacturer; By utilizing the invoked SDK interface and adding a secure rollback mechanism, the weak password of the video device is corrected. After the correction is completed, the video device is verified to be usable using a triple verification method: Ping, SNMPv3, and application layer authentication. If the device is verified to be usable, the correction is successful. If verification fails, the security rollback mechanism is triggered, and the password reverts to the original weak password.

2. The method as described in claim 1, characterized in that, The detection and identification of each video device includes: A dual-mode active and passive detection mechanism, which involves actively sending packets and obtaining traffic packets from switches, is used to acquire data packets from each video device. Based on a pre-established cross-vendor protocol feature database, protocol feature identification is performed on the data packets of each video device to identify each video device.

3. The method as described in claim 1, characterized in that, The secure rollback mechanism is implemented in the following manner: Before changing the password, save the original password and create a temporary auxiliary account. If the new password verification fails, roll back to the original weak password.

4. A video device weak password management device, used to implement the steps of any one of claims 1-3, characterized in that, include: A multi-protocol detection unit is used to detect and identify various video devices, which are manufactured by different companies. A generalized weak password detection unit is used to use a pre-encapsulated dynamic detection interface to call the corresponding authentication process algorithm based on the fingerprint of each video device to authenticate each video device, so as to further detect weak passwords for each video device. A general password repair unit is used to call the corresponding SDK interface to perform password repair based on the address of each video device with a weak password by utilizing a pre-encapsulated password repair interface.

5. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-3.

7. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-3.

Images