Dynamic password strength evaluation method for Internet of Things equipment

Abstract

The invention discloses a dynamic password strength evaluation method for Internet of Things equipment, and relates to the technical field of Internet of Things security, and the method comprises the steps: obtaining a to-be-evaluated target password, carrying out the analysis of the target password, and extracting the basic characteristics of the password; generating initial password strength of the target password based on the password basic characteristics; mapping the initial password strength into attack cost according to context information of equipment corresponding to the target password; obtaining dynamic risk state data in the operation process of the equipment, and dynamically correcting the attack cost to obtain a dynamic password strength evaluation result of the target password; according to the method, probabilistic attack modeling is introduced, and equipment context and dynamic risk correction are combined, so that the problems that existing password strength evaluation is static and is separated from an actual attack environment of the Internet of Things are solved.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and more specifically, to a dynamic password strength assessment method for IoT devices. Background Technology

[0002] With the rapid development of IoT technology, a large number of sensing devices, control terminals, and smart nodes are being widely deployed in application scenarios such as industrial manufacturing, smart cities, smart homes, energy management, and public infrastructure. IoT devices are typically characterized by large numbers, dispersed deployment environments, limited computing and storage resources, and long operating cycles. Their security capabilities directly affect the stable operation and data security of the entire system. In IoT systems, cryptographic mechanisms remain one of the most fundamental and prevalent security measures for device authentication, access control, and communication security. Therefore, a reasonable assessment of the security of the cryptography used by IoT devices is of significant practical importance.

[0003] Furthermore, IoT devices are typically in a continuous operating state, and their security environment is not static. The risk level, attack frequency, abnormal behavior characteristics, and protection strategy configuration of the network in which the device operates may change over time, which also makes the security significance of cryptography different at different stages of operation. With the development of security situation awareness and risk assessment technologies, incorporating the security status of devices during operation into the scope of cryptographic security assessment has gradually become an important research direction in IoT security management.

[0004] For example, the invention patent with publication number CN120046139A discloses a method and apparatus for real-time password strength evaluation. This method trains a multinomial Naive Bayes model using a password dataset, which includes cracked weak password samples and verified strong password samples. In response to a user-input password trigger event, it extracts character-level and semantic features of the user-input password. It generates sub-feature vectors based on the character-level and semantic features respectively, and weights these sub-feature vectors to obtain a feature vector. The trained multinomial Naive Bayes model scores the feature vectors to obtain a password strength score. Finally, it determines the password strength level based on the password strength score. The provided method can evaluate password strength in real time, improving the accuracy of password security assessment.

[0005] For example, the invention patent with publication number CN120934756A discloses a context-based deep email password strength measurement method. This method introduces user context information such as email address, name, and birthday into the basic password measurement model framework, achieves information fusion through a multi-head self-attention mechanism, and combines a character-level long short-term memory network (LSTM) to construct a password sequence probability calculation model. It quantifies the performance differences of different models with and without user context information by establishing an evaluation system with the number of guesses as the core indicator. This method can more realistically reflect the cracking ability of attackers when they have user context information.

[0006] The above-disclosed technical solutions have at least the following technical problems:

[0007] Traditional cryptographic strength assessment methods ignore the semantic priorities and probability distributions employed by attackers during actual attacks, leading to significant deviations between assessment results and the actual guessing order. Furthermore, they often score individual cryptographic keys independently, lacking a mechanism for comparison with a group of cryptographic keys, resulting in clustering or ambiguous ranges in assessment results for keys of different strengths. To address these issues, this invention proposes a solution. Summary of the Invention

[0008] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a dynamic cryptographic strength evaluation method for Internet of Things (IoT) devices. By introducing probabilistic attack modeling and combining device context with dynamic risk correction, the method solves the problem that existing cryptographic strength evaluations are static and detached from the actual attack environment of IoT.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] A dynamic password strength assessment method for IoT devices includes: acquiring a target password to be assessed and analyzing the target password to extract its basic features; generating an initial password strength of the target password based on the basic features; mapping the initial password strength to an attack cost according to the context information of the device corresponding to the target password; acquiring dynamic risk status data during device operation and dynamically correcting the attack cost to obtain the dynamic password strength assessment result of the target password.

[0011] In a preferred technical solution, the step of acquiring the target password to be evaluated and analyzing it to extract its basic features is as follows: The target password undergoes structural semantic parsing to identify different character types and their distribution, and semantic patterns are analyzed; based on the semantic patterns, the basic statistical features of the target password are output; these basic statistical features are input into a statistical probability model to output the probability metric value corresponding to the target password; based on the probability metric value and the priority rules of the semantic patterns in the attack model, the relative guessing order of the target password during the attack attempt process is derived; based on the relative guessing order, the attackable features that are prioritized for guessing during the attack process are extracted to form the probabilistic attack features of the password; the semantic patterns, basic statistical features, and probabilistic attack features are fused according to a preset feature association relationship to generate a set of basic password features for the target password.

[0012] In a preferred technical solution, the step of inputting basic statistical features into a statistical probability model and outputting a probability metric value corresponding to the target cipher is as follows: A cipher feature representation is constructed based on the basic statistical features of the target cipher, and this cipher feature representation is converted into an encodeable structured representation; an encoding scheme for the cipher feature representation is constructed based on the value range and statistical distribution characteristics of each data point in the structured representation; the structured representation is encoded according to the encoding scheme, and the encoding lengths of each part are accumulated to obtain a description length metric value; the description length metric value is used as probability constraint data in the statistical probability model and input into the statistical probability model along with the cipher feature representation; the statistical probability model performs initial probability inference on the target cipher based on the cipher feature representation to obtain an initial probability result of the target cipher in the sense of statistical distribution; the description length metric value is mapped to a probability constraint factor, and the initial probability result is weighted and adjusted according to the probability constraint factor to obtain a corrected probability metric value.

[0013] In a preferred technical solution, the step of generating the initial cryptographic strength of the target cipher based on fundamental cryptographic features specifically involves the following steps: Based on a preset set of reference cipher samples, the feature representations of the target cipher are correlated with the feature representations of the reference cipher samples to construct a comparison relationship between the target cipher and multiple reference ciphers; based on the comparison relationship and the degree of difference between the target cipher and the corresponding reference cipher in various fundamental cryptographic features, a security advantage judgment result of the target cipher relative to the corresponding reference cipher is generated; different security advantage judgment results are summarized to form a local relative security relationship description of the target cipher in the set of reference cipher samples; based on the local relative security relationship description, feature dimension ranking results of the target cipher are generated from different feature dimensions; cross-analysis is performed on the ranking results under each feature dimension to identify the ranking consistency features of the target cipher across multiple dimensions; based on the ranking consistency features, the ranking results under different feature dimensions are aggregated to generate the relative security ranking position of the target cipher in the set of reference cipher samples; based on the relative security ranking position, the target cipher is mapped to a preset security level range to generate the initial cryptographic strength of the target cipher.

[0014] In a preferred technical solution, the step of cross-analyzing the ranking results under each feature dimension to identify the ranking consistency characteristics of the target password, which exhibit security advantages or disadvantages across multiple dimensions, is as follows: The ranking results of the target password under each feature dimension are aligned; based on the aligned ranking results, the relative position intervals of the target password under each feature dimension are determined; the relative position intervals of the target password under multiple feature dimensions are jointly analyzed to determine whether the relative position intervals exhibit the same or similar distribution trends across multiple dimensions; when the target password is located in a relatively early relative position interval across multiple feature dimensions, the target password is identified as having a security advantage-type ranking consistency characteristic; when the target password is located in a relatively late relative position interval across multiple feature dimensions, the target password is identified as having a security disadvantage-type ranking consistency characteristic; when the difference in the relative position intervals of the target password under different feature dimensions exceeds a preset value, the target password is identified as having a ranking dispersion characteristic.

[0015] In a preferred technical solution, the step of mapping the initial password strength to attack cost based on the context information of the device corresponding to the target password is as follows: Obtain the device context information of the IoT device corresponding to the target password, and perform semantic decomposition on the device context information to extract context elements related to the attack implementation conditions; construct a feasible attack space for the target device based on the context elements; construct an abstract attack space corresponding to the initial password strength of the target password, and determine the basic cracking complexity of the target password in the abstract attack space; map the basic cracking complexity from the abstract attack space to the feasible attack space, and analyze the constraints of the device context on the attack attempt capability boundary; output the resource consumption required for the target password to complete an effective attack within the feasible attack space based on the projection analysis results; and use the resource consumption as the attack cost of the target password in the current device context.

[0016] In a preferred technical solution, the semantic decomposition of the device context information to extract context elements related to the attack implementation conditions is specifically as follows: the acquired device context information is subjected to type identification and classification processing; for different types of device context information, key descriptive items reflecting the attack implementation conditions are extracted; the key descriptive items are subjected to semantic merging processing, and descriptive items with the same or similar attack impact meanings are merged into unified context elements; the merged context elements are represented in a structured form to form a set of context elements directly related to the attack implementation conditions.

[0017] In a preferred technical solution, the construction of the feasible attack space of the target device based on context elements is specifically as follows: an attack attempt data set is obtained, and each extracted context element is mapped to a corresponding data item in the attack attempt data set; according to the constraint relationship corresponding to each context element, the value range of the corresponding attack attempt data is pruned to obtain the effective value range of each attack attempt data under the current device context; the effective value ranges of all attack attempt data are combined to form a multi-dimensional data space; and the multi-dimensional data space is determined as the feasible attack space of the target device.

[0018] In a preferred technical solution, the process of mapping the basic cracking complexity from the abstract attack space to the feasible attack space and analyzing the constraints of the device context on the attack attempt capability boundary is as follows: The basic cracking complexity is represented as a standard attack resource requirement description under the abstract attack space; based on the data consistency relationship between the abstract attack space and the feasible attack space, a data correspondence expression of the attack resource requirement description in the feasible attack space is established; according to the limiting conditions of the device context elements on the range of data values ​​for each attack attempt in the feasible attack space, boundary verification is performed on the data correspondence expression; when all resource configurations in the attack resource requirement description meet the boundary verification conditions, it is determined that the basic cracking complexity is fully realized under the current device context; when some resource configurations in the attack resource requirement description exceed the allowable range of the feasible attack space, the excess portion is identified as the constraint boundary formed by the device context on the attack attempt capability.

[0019] In a preferred technical solution, the step of acquiring dynamic risk status data during device operation, dynamically adjusting attack costs, and obtaining a dynamic password strength assessment result for the target password is as follows: During the operation of the target device, dynamic risk status data of the device's current security posture is collected; the dynamic risk status data is classified and merged to generate a risk status description result representing the device's current risk level; based on the risk status description result, a preset attack cost adjustment rule is matched to determine the attack cost adjustment method corresponding to the current risk status; the attack cost is dynamically adjusted according to the attack cost adjustment method; the dynamically adjusted attack cost is used as an effective attack cost description for the target password in the current operating state; based on the effective attack cost description, the target password is mapped to a preset dynamic password strength range, and the dynamic password strength assessment result for the target password is output.

[0020] The technical effects and advantages of the dynamic password strength evaluation method for IoT devices proposed in this invention are as follows:

[0021] 1. This invention, from the perspective of cryptographic structure semantics and attack probability, performs multi-level feature modeling of target cryptography. Through structural semantic parsing, basic statistical feature extraction, and probabilistic attack feature derivation, it expands the traditional simple statistics of character length and character types into a comprehensive feature set that can reflect the attacker's true guessing strategy. Furthermore, it introduces a statistical probability model and descriptive length constraints to correct the probability metric values, making the obtained cryptographic strength closer to the actual attack distribution pattern, fundamentally improving the authenticity and credibility of the cryptographic strength assessment results.

[0022] 2. This invention constructs a relatively secure ranking mechanism by referencing a set of cryptographic samples. Instead of evaluating the "absolute strength" of a single cryptography in isolation, it compares and analyzes the target cryptography with a large number of reference cryptography based on multiple feature dimensions to form a description of local relative security relationships. Furthermore, it identifies security advantage, security disadvantage, or ranking dispersion characteristics through ranking consistency analysis, thereby effectively avoiding the distortion problem of a single indicator and enabling the initial cryptographic strength to have stronger distinguishability and stability. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating a dynamic password strength evaluation method for Internet of Things (IoT) devices according to the present invention.

[0024] Specific technical solutions

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Example 1, Figure 1 This invention provides a dynamic password strength evaluation method for Internet of Things (IoT) devices, comprising:

[0027] S1, Obtain the target password to be evaluated, analyze the target password, and extract the basic characteristics of the password;

[0028] In this embodiment, the target password to be evaluated is obtained and analyzed to extract its basic features, as follows:

[0029] The target cipher is subjected to structural semantic parsing to identify different character types and their distribution in the cipher and to analyze semantic patterns.

[0030] Based on the semantic pattern, the basic statistical features of the target password are output. The basic statistical features include at least character distribution features, pattern frequency features, and structural complexity features.

[0031] The basic statistical features are input into the statistical probability model, and the probability metric corresponding to the target password is output to characterize the statistical probability of the target password.

[0032] Based on probability metrics and the priority rules of semantic patterns in the attack model, the relative guessing order of the target password during the attack attempt process is derived.

[0033] Based on the relative guessing order, the attackable features that are prioritized for guessing during the attack process of the target cipher are extracted to form the probabilistic attack features of the cipher. The attackable features are used to characterize the attack exposure attributes of the target cipher during the attack attempt process, including: attack attempt coverage features (used to characterize the degree to which the target cipher is covered in the attack attempt space, such as: whether the target cipher falls into the cipher construction path that the attacker prioritizes to enumerate, and whether the target cipher is located in the pre-attack interval in the attack attempt process) and attack path reachability features (used to characterize whether the target cipher is in the path node that can be directly reached in the attack process without additional construction, such as: whether it can be directly generated by common semantic patterns, and whether it can be obtained by simple extension of high-frequency structural patterns).

[0034] Semantic patterns, basic statistical features, and probabilistic attack features are fused according to preset feature associations to generate a set of basic cryptographic features for the target cipher. Specifically, the semantic patterns identified in the target cipher are used as the fusion thread to determine the character distribution features, pattern occurrence frequency features, and structural complexity features that correspond to the semantic patterns in terms of structural construction. The basic statistical features are used as the structural representation of the semantic patterns. On this basis, the probabilistic attack features are associated with the structural representations so that the probabilistic attack features can be used to characterize the actual exposure degree of the corresponding structural representations in the attack path. While keeping the original semantics of various features unchanged, the semantic patterns, their associated basic statistical features, and the corresponding probabilistic attack features are combined to generate a set of basic cryptographic features that can simultaneously reflect the structural construction characteristics, statistical distribution characteristics, and attack exploitability characteristics of the target cipher.

[0035] In this embodiment, the target password is subjected to structural semantic parsing to identify different character types and their distribution, and semantic patterns are analyzed, as follows:

[0036] Each character in the target password is scanned digit by digit, and the characters are labeled according to their category to obtain the character type sequence of the target password. The character categories include numeric characters, alphabetic characters, and special symbol characters, where alphabetic characters are further divided into uppercase letters and lowercase letters.

[0037] Based on the character type sequence, the quantity, proportion, and positional distribution of each type of character in the target password are statistically analyzed to form character distribution features, which are used to characterize the overall structure of the target password.

[0038] Based on character type sequence and character distribution characteristics, the target cipher is divided into substrings to identify consecutive repeating characters, consecutive characters of the same type, and character combinations with a fixed length. The identified construction features are encoded into structural pattern representations to characterize whether there are repeating construction patterns or regular construction patterns in the target cipher.

[0039] The structural pattern representation is matched with a preset semantic pattern rule base, which includes common word patterns, sequential increasing or decreasing patterns, and character substitution patterns. The matching results are used to identify potential semantic patterns in the target password.

[0040] In this embodiment, basic statistical features are input into the statistical probability model, and the probability metric value corresponding to the target password is output, as follows:

[0041] Construct cryptographic feature representations based on the fundamental statistical characteristics of the target cryptography;

[0042] The cryptographic feature representation is converted into an encodeable structured representation, which includes at least character type sequence representation, character distribution representation, and structural pattern representation, so that the target cryptography is transformed from the original character sequence into a representation object composed of multiple structured data.

[0043] For character type sequence representation, a set of character type categories and corresponding legal value ranges are predefined, and based on historical cryptographic sample usage data, the frequency of occurrence of different character types and their arrangements in cryptographic samples is statistically analyzed to obtain the statistical distribution characteristics of character type sequences;

[0044] For character distribution representation, the value range of each character category in the password is determined according to the target password length and the character category set, and the statistical distribution characteristics of the character distribution are obtained based on the statistical results of the occurrence ratio of each character category in historical password samples.

[0045] For structural pattern representation, the range of values ​​for structural pattern parameters is determined according to preset structural pattern rules, and the statistical distribution characteristics of structural patterns are obtained based on the frequency of occurrence of different structural patterns in historical cryptographic samples.

[0046] Based on the value range and statistical distribution characteristics of each data in the structured representation, an encoding scheme for cryptographic feature representation is constructed. The encoding scheme is used to represent the structured representation with the least amount of information, thereby reflecting the compressibility of the cryptographic feature representation.

[0047] According to the encoding scheme, the structured representation is encoded, and the encoding lengths required for the character type sequence, character distribution, and structural pattern are output respectively. The encoding lengths of each part are accumulated to obtain the total encoding length of the target cryptographic feature representation, which is used as a description length metric.

[0048] The length metric is used as the probability constraint data in the statistical probability model, and is input into the statistical probability model along with the cryptographic feature representation.

[0049] The statistical probability model, based on the cryptographic feature representation, performs initial probability inference on the target cryptography to obtain the initial probability result of the target cryptography in the sense of statistical distribution. The initial probability result is used to characterize the probability evaluation value obtained solely based on statistical features.

[0050] The description length metric is mapped to a probability constraint factor, which is used to characterize the influence weight of the redundancy of the target cryptographic structure on the probability evaluation result. The smaller the description length metric, the weaker the suppression effect of the corresponding probability constraint factor on the probability result.

[0051] Based on the probability constraint factor, the initial probability result is weighted and adjusted to obtain the corrected probability result, which serves as the probability metric value corresponding to the target password.

[0052] In this embodiment, based on probability metrics and the priority rules of semantic patterns in the attack model, the relative guessing order of the target password during the attack attempt process is derived, as follows:

[0053] Based on the probability metric output by the statistical probability model, the probability positions of the target password in the candidate password space are sorted to obtain the initial sorting position of the target password under the condition of statistical probability alone.

[0054] Based on the semantic patterns identified in the target cipher, the priority level of the semantic patterns in the preset attack model priority rule set is determined. The priority level is used to characterize the degree to which the attack model prioritizes the semantic patterns when generating or enumerating candidate ciphers.

[0055] The initial sorting position corresponding to the probability metric value is integrated and adjusted with the priority level of the semantic pattern. The semantic pattern with a higher priority level is given an advance weight correction during the sorting process, so that the cipher containing the high priority semantic pattern is advanced in the attack attempt order.

[0056] Based on the fused and adjusted sorting results, the relative position of the target password in the candidate password sequence generated by the attack model is determined, and this relative position is used as the relative guessing order of the target password during the attack attempt process.

[0057] In this embodiment, the attackable features of the target password that are prioritized for guessing during the attack process are extracted according to the relative guessing order, forming the probabilistic attack features of the password, as follows:

[0058] Based on the relative guessing order, the ranking position of the target password in the candidate password sequence generated by the attack model is determined, and the ranking position is used to characterize the order of the target password in the attack attempt process;

[0059] Based on the sorting position, the priority features corresponding to the target password being tried in advance during the attack process are extracted. The priority features include the degree of sorting, the priority attempt interval (used to characterize whether the target password is located in the candidate interval that the attack model prioritizes to generate or try), and the sorting density, which are used to reflect the degree to which the target password is guessed in advance relative to other candidate passwords.

[0060] By combining the distribution of sorting positions in the candidate password sequence, early exposure features of the target password are extracted. These early exposure features are used to characterize whether the target password is in a candidate region preferentially generated by the attack model.

[0061] By combining priority features with early exposure features, a probabilistic attack feature for the target password can be formed.

[0062] S2, based on the fundamental cryptographic features, generates the initial cryptographic strength of the target cryptography;

[0063] In this embodiment, the initial password strength of the target password is generated based on the fundamental cryptographic features, as follows:

[0064] Based on a pre-set set of reference cipher samples, the feature representation of the target cipher is associated with the feature representation of the reference cipher samples to construct a comparison relationship between the target cipher and multiple reference ciphers;

[0065] Based on the comparison relationship and the degree of difference between the target cipher and the corresponding reference cipher in various basic cryptographic features, a security advantage determination result of the target cipher relative to the corresponding reference cipher is generated. The security advantage determination result is used to characterize the relative security of the target cipher under the comparison relationship.

[0066] The results of different security advantage assessments are summarized to form a description of the local relative security relationship of the target cryptography in the reference cryptographic sample set;

[0067] Based on the description of local relative security relationships, the feature dimension ranking results of the target password are generated from different feature dimensions, including structural complexity dimension, semantic predictability dimension, and attack priority related dimension.

[0068] Cross-analysis of the ranking results under each feature dimension is performed to identify the ranking consistency characteristics of the target password, which show security advantages or security disadvantages in multiple dimensions.

[0069] Based on the sorting consistency feature, the sorting results under different feature dimensions are aggregated to generate the relative secure sorting position of the target cipher in the reference cipher sample set.

[0070] Based on the relative security sorting position, the target password is mapped to a preset security level range to generate the initial password strength of the target password. The initial password strength is used to characterize the basic security level of the target password before the introduction of device context information and dynamic risk status.

[0071] In this embodiment, based on the comparison relationship and the degree of difference between the target cipher and the corresponding reference cipher in various basic cryptographic features, a security advantage determination result of the target cipher relative to the corresponding reference cipher is generated, as follows:

[0072] Output the feature difference between each target cipher and the reference cipher on multiple preset cryptographic feature dimensions, wherein the cryptographic feature dimensions include at least structural complexity features, semantic predictability features, and attack-related features;

[0073] Based on the degree of difference corresponding to each feature dimension, the security trend of the target password relative to the reference password under that feature dimension is determined. The security trend is used to indicate whether the target password exhibits a security advantage, a security disadvantage, or equivalent security under that feature dimension.

[0074] By combining and analyzing the security trend results under different feature dimensions, a comprehensive security comparison result is formed between the target cipher and the corresponding reference cipher.

[0075] In this embodiment, cross-analysis is performed on the ranking results under each feature dimension to identify the ranking consistency features of the target password that exhibit security advantages or disadvantages across multiple dimensions, as detailed below:

[0076] The ranking results of the target password under each feature dimension are aligned. The alignment process is used to map the ranking results under different feature dimensions to a unified comparison reference range to ensure the comparability between ranking results of different dimensions.

[0077] Based on the aligned sorting results, the relative position interval of the target cipher under each feature dimension is determined. The relative position interval is used to characterize the security level range of the target cipher relative to the reference cipher sample set under the current dimension.

[0078] Joint analysis is performed on the relative position intervals of the target password under multiple feature dimensions to determine whether the relative position intervals show the same or similar distribution trends in multiple dimensions.

[0079] When the target password is in a relatively high position range across multiple feature dimensions, the identification of the target password has a security advantage type of order consistency feature.

[0080] When the target password is located in the later relative position range under multiple feature dimensions, the identification of the target password has a security disadvantage type of order consistency feature.

[0081] When the relative position range of the target password under different feature dimensions differs beyond a preset value, it is identified that the target password has a sorted and dispersed feature, and the dimensions used to characterize its security performance are inconsistent.

[0082] In this embodiment, based on the sorting consistency feature, the sorting results under different feature dimensions are aggregated to generate the relative secure sorting position of the target cipher in the reference cipher sample set, as follows:

[0083] Based on the sorting consistency features corresponding to the target password, a sorting fusion strategy is determined for the aggregation process. The sorting fusion strategy is used to indicate the comprehensive method of sorting the results of each feature dimension during the aggregation process.

[0084] When the target cipher has a security advantage-type order consistency feature, the leading position intervals corresponding to it in the ordering results of each feature dimension are extracted, and the position intervals are jointly mapped to generate the advantageous fusion position of the target cipher. Specifically, the joint mapping of the position intervals involves: obtaining the leading position intervals corresponding to the target cipher in the ordering results of each feature dimension to form multiple candidate advantageous position intervals; analyzing the interval overlap relationship of the multiple candidate advantageous position intervals to identify the common coverage part of each position interval in the ordering space; when there is a common coverage part, the common coverage part is determined as the advantageous fusion position of the target cipher, which is used to characterize the security advantage intervals simultaneously exhibited by the target cipher under multiple feature dimensions; when there is no common coverage part among the multiple candidate advantageous position intervals, the leading joint position interval is determined according to the relative leading position of each position interval in the ordering space, which is used as the advantageous fusion position of the target cipher.

[0085] When the target cipher has a security disadvantage type of order consistency feature, the corresponding late position interval in the ordering results of each feature dimension is extracted, and the position interval is jointly mapped to generate the disadvantage fusion position of the target cipher. Specifically, the joint mapping of the position interval is as follows: the late position interval of the target cipher in the ordering results of each feature dimension is obtained to form multiple candidate disadvantage position intervals. The interval overlap relationship of the multiple candidate disadvantage position intervals is analyzed to identify the common coverage part of each position interval in the ordering space. When there is a common coverage part, the common coverage part is determined as the disadvantage fusion position of the target cipher, which is used to characterize the security disadvantage interval of the target cipher under multiple feature dimensions. When there is no common coverage part among the multiple candidate disadvantage position intervals, the latest joint position interval is determined according to the relative lateness of each position interval in the ordering space, which is used as the disadvantage fusion position of the target cipher.

[0086] When the target cipher exhibits a dispersed ordering characteristic, the distribution characteristics of its corresponding position intervals in the ordering results of each feature dimension are extracted. Based on these position interval distribution characteristics, the neutral fusion position of the target cipher is determined to characterize its overall security status, which is inconsistent across different security dimensions. Specifically, determining the neutral fusion position of the target cipher based on the position interval distribution characteristics involves: obtaining the position intervals corresponding to the target cipher in the ordering results of each feature dimension, forming multiple position interval sets to characterize the ordering distribution of the target cipher across different security dimensions, performing distribution analysis on the position interval sets, determining the degree of dispersion of each position interval in the ordering space and their overlapping relationships, and determining that the position interval sets do not have continuously covered common intervals and that different position intervals are distributed in different regions of the ordering space. This indicates that the ordering performance of the target cipher across each feature dimension is dispersed. Based on the dispersed distribution characteristics, the relative positional relationships of each position interval in the ordering space are extracted, and the central position interval that comprehensively reflects the overall distribution trend of the position intervals is determined. The central position interval is then identified as the neutral fusion position of the target cipher.

[0087] The advantageous fusion position, the disadvantageous fusion position, and the neutral fusion position are used as the relative security ranking positions of the target cipher in the reference cipher sample set.

[0088] In this embodiment, the target password is mapped to a preset security level range based on its relative security sorting position, and the initial password strength of the target password is generated, as follows:

[0089] A pre-constructed correspondence between security level intervals and sorting position ranges is used to divide the sorting positions in the reference cryptographic sample set into multiple consecutive security level intervals.

[0090] The security level intervals are arranged in order of increasing security strength, and each security level interval corresponds to a range of relative sorting positions in the reference cryptographic sample set.

[0091] Based on the relative security order position of the target password, determine the range of order positions it falls into, and accordingly determine the corresponding security level range.

[0092] The determined security level range is used as the initial cryptographic strength of the target cryptography, which is used to characterize the relative security level of the target cryptography in the reference cryptographic sample set.

[0093] S3: Based on the context information of the device corresponding to the target password, the initial password strength is mapped to the attack cost;

[0094] In this embodiment, the initial password strength is mapped to the attack cost based on the context information of the device corresponding to the target password, as follows:

[0095] Obtain the device context information of the IoT device corresponding to the target password, and perform semantic decomposition on the device context information to extract context elements related to the attack implementation conditions. The context elements are used to characterize the objective constraints of the target device during the attack implementation process.

[0096] Based on contextual elements, a feasible attack space for the target device is constructed, which is used to characterize the range of attack attempts that an attacker can actually carry out under the current device context.

[0097] Based on the initial password strength of the target password, an abstract attack space corresponding to the initial password strength is constructed, and the basic cracking complexity of the target password in the abstract attack space is determined. The basic cracking complexity is used to characterize the inherent resistance level of the password itself under the condition of not considering device limitations.

[0098] The basic cracking complexity is mapped from the abstract attack space to the feasible attack space, and the constraints of the device context on the attack attempt capability boundary are analyzed. The attack attempt capability boundary is used to characterize the expandable range of attack attempts under the current device conditions.

[0099] Based on the projection analysis results, the resource consumption status of the target cipher to complete an effective attack within the feasible attack space is output. The resource consumption includes time resource consumption, computational resource consumption, and interaction opportunity consumption.

[0100] Resource consumption is used as the attack cost of the target password in the current device context, which is used to characterize the actual cost that an attacker needs to pay to crack the target password under real-world conditions.

[0101] In this embodiment, semantic decomposition is performed on the device context information to extract contextual elements related to the attack implementation conditions, as follows:

[0102] The acquired device context information is processed by type identification and classification, and the device context information is divided into device capability information, communication environment information, interaction restriction information and operating status information, so as to eliminate the mixed influence of context information from different sources at the semantic level.

[0103] For different types of device context information, key descriptive items reflecting the conditions for attack implementation are extracted. Among them, device capability information is used to characterize the device's available capabilities in computing and storage, communication environment information is used to characterize the device's characteristics in network connectivity and reachability, interaction restriction information is used to characterize the constraints on the frequency and method of interaction of attack attempts, and operating status information is used to characterize the device's operating stability and its impact on the persistence of the attack.

[0104] Semantic merging is performed on key descriptive items to merge descriptive items with the same or similar attack impact meanings into unified contextual elements, in order to avoid attack condition evaluation bias caused by inconsistent granularity of contextual information. Specifically, multiple attack impact dimensions are predefined for the attack implementation process. These dimensions include at least attack attempt frequency constraint dimension, concurrent attack capability constraint dimension, single attack computation consumption dimension, and attack persistence constraint dimension. Each descriptive item is mapped to its corresponding attack impact dimension. This mapping characterizes the main direction of influence of the descriptive item on the attack implementation process. When multiple descriptive items are mapped to the same attack impact dimension and their effects manifest as similar constraint effects during the attack implementation process, the descriptive items are determined to have the same attack impact meaning. When multiple descriptive items are mapped to different but related attack impact dimensions and have a synergistic or cumulative effect on attack resource consumption during the attack implementation process, the descriptive items are determined to have similar attack impact meanings.

[0105] The merged context elements are represented in a structured form, forming a set of context elements directly related to the attack execution conditions.

[0106] In this embodiment, a feasible attack space for the target device is constructed based on contextual elements, as follows:

[0107] Acquire an attack attempt data set, which includes the number of attack attempts allowed per unit time, the upper limit of computing resources available for a single attack, the upper limit of the number of parallel attack attempts, and the duration of continuous attacks;

[0108] Each extracted context element is mapped to a corresponding data item in the attack attempt data set. The mapping is used to characterize the restrictive relationship between the context element and the range of values ​​in the attack attempt data.

[0109] Based on the constraints corresponding to each context element, the value range of the corresponding attack attempt data is pruned to obtain the effective value range of each attack attempt data under the current device context.

[0110] The valid value ranges of all attack attempt data are combined to form a multidimensional data space, which is used to characterize the set of attack attempt configurations that the attacker can actually carry out in the current device context.

[0111] The multidimensional data space is defined as the feasible attack space of the target device, which describes the realistic feasible range of attack behavior under the current device operation and protection conditions.

[0112] In this embodiment, based on the initial password strength of the target password, an abstract attack space corresponding to the initial password strength is constructed, and the basic cracking complexity of the target password in the abstract attack space is determined, as follows:

[0113] Based on the initial password strength of the target password, the range of values ​​for each attack attempt data under theoretical conditions is determined. The range of values ​​is used to characterize the upper limit of the attack capabilities that an attacker can employ when not limited by device conditions.

[0114] By combining the theoretically acceptable ranges of data from each attack attempt, an abstract attack space corresponding to the initial password strength of the target password is constructed.

[0115] Based on the data configuration relationship between basic cryptographic features and the abstract attack space, the minimum combination of attack resources required to achieve cryptographic cracking within the abstract attack space is determined.

[0116] The minimum attack resource consumption combination is determined as the basic cracking complexity of the target cipher in the abstract attack space. The basic cracking complexity is used to characterize the theoretical cost required to crack the target cipher under ideal attack conditions.

[0117] In this embodiment, the basic cracking complexity is mapped from the abstract attack space to the feasible attack space, and the constraints of the device context on the attack attempt capability boundary are analyzed, as follows:

[0118] The basic cracking complexity is represented as a standard attack resource requirement description under the abstract attack space. The attack resource requirement description is used to characterize the resource configuration requirements required to complete the password cracking under ideal attack conditions.

[0119] Based on the data consistency relationship between the abstract attack space and the feasible attack space, a data correspondence expression of the attack resource requirement description in the feasible attack space is established. The data correspondence expression is used to maintain the consistency of the attack requirement semantics in different spaces. Specifically, the attack resource requirement description of the target password in the abstract attack space is decomposed according to the preset attack data semantic system and mapped one by one to the same attack data item in the feasible attack space. Thus, while keeping the attack resource requirement semantics unchanged, the attack resource requirement is transformed from the data expression under theoretical attack conditions to the data correspondence expression under the constraints of device context.

[0120] Based on the device context elements, the data value range of each attack attempt in the feasible attack space is limited, and the corresponding data expression is boundary-checked to determine whether the resource configurations in the attack resource requirement description fall within the allowable range of the feasible attack space.

[0121] When all resource configurations in the attack resource requirement description meet the boundary verification conditions, it is determined that the basic cracking complexity can be fully realized in the current device context;

[0122] When some resource configurations in the attack resource requirement description exceed the allowable range of the feasible attack space, the excess portion is identified as the constraint boundary formed by the device context on the attack attempt capability.

[0123] S4: Obtain dynamic risk status data during device operation, dynamically adjust attack costs, and obtain dynamic password strength assessment results for the target password.

[0124] In this embodiment, dynamic risk status data during device operation is acquired, and the attack cost is dynamically adjusted to obtain the dynamic password strength assessment result of the target password, as detailed below:

[0125] During the operation of the target device, dynamic risk status data of the device's current security status is collected. The dynamic risk status data includes authentication failure behavior characteristics, abnormal access event characteristics, operating environment change status, and device exposure status change information, which are used to characterize the risk status of the device at different operating stages.

[0126] Dynamic risk status data is classified and merged to generate a risk status description result representing the current risk level of the equipment. The risk status description result is used to depict the phased changes in safety risks during equipment operation. Specifically, the collected dynamic risk status data is initially grouped according to the risk source type, and it is determined whether each type of risk source data is in an abnormal trigger state within the current time window within a preset time range. Subsequently, the judgment results of various types of risk data are uniformly merged, and the current operating state of the equipment is divided according to the combination of the triggered risk judgment results, thereby generating a risk status description result that characterizes the current overall safety situation of the equipment.

[0127] Based on the risk status description results, a preset attack cost correction rule is matched to determine the attack cost correction method corresponding to the current risk status. The attack cost correction rule is used to describe the changing trend of attack implementation difficulty under different risk statuses. Specifically, a correspondence table between risk status and attack cost change method is pre-established for different risk statuses. When the current risk status description result of the device is generated, the risk status description result is used as an index to search in the correspondence table to obtain the attack cost correction method that matches the risk status.

[0128] Based on the attack cost correction method, the attack cost is dynamically adjusted so that the attack cost changes accordingly with the changes in the risk status during equipment operation;

[0129] The dynamically adjusted attack cost is used as a description of the effective attack cost of the target cipher in its current operating state.

[0130] Based on the description of effective attack cost, the target password is mapped to a preset dynamic password strength range, and the dynamic password strength evaluation result of the target password is output. The dynamic password strength evaluation result is used to reflect the actual security level change of the target password throughout the entire operation cycle of the device.

[0131] In this embodiment, the attack cost is dynamically adjusted according to the attack cost correction method, as follows:

[0132] Based on the feasible attack space, the range of attack attempt data values ​​allowed under the current device context is obtained, and the initial reachable state set of the attack cost components in the feasible attack space is determined accordingly. The initial reachable state set is used to characterize the attack resource configuration state that the attacker can theoretically and actually achieve under the current device conditions.

[0133] The attack cost correction method is analyzed as a state evolution rule for the components of attack cost;

[0134] During equipment operation, changes in dynamic risk status data are used as the basis for determining changes in attack conditions, indicating whether the equipment operating environment on which the initial reachable state set depends has changed.

[0135] When it is determined that the device operating environment has changed, the attack resource configuration states in the initial reachable state set are re-screened based on the restrictive effect of dynamic risk status on the attack implementation conditions. Attack resource configurations that no longer meet the current risk status constraints are removed, resulting in an updated reachable state set.

[0136] Based on the updated set of reachable states, the attack cost boundary that an attacker needs to satisfy to complete an effective attack under the current device operating state is redefined, thereby realizing the nonlinear adjustment of attack cost as the device's dynamic risk state changes.

[0137] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0138] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0139] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0140] The above description is merely a specific technical solution of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0141] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A dynamic cryptographic strength evaluation method for Internet of Things (IoT) devices, characterized in that, include: Obtain the target password to be evaluated, analyze the target password, and extract the basic characteristics of the password; Based on fundamental cryptographic features, generate the initial cryptographic strength of the target cryptography; Based on the context information of the device corresponding to the target password, the initial password strength is mapped to the attack cost; By acquiring dynamic risk status data during device operation, dynamically adjusting the attack cost, and obtaining the dynamic password strength assessment result of the target password.

2. The dynamic password strength evaluation method for IoT devices according to claim 1, characterized in that, The process of obtaining the target password to be evaluated and analyzing it to extract its basic features is as follows: The target cipher is subjected to structural semantic parsing to identify different character types and their distribution in the cipher and to analyze semantic patterns. Based on the semantic pattern, output the basic statistical features of the target cipher; Input the basic statistical features into the statistical probability model, and output the probability metric value corresponding to the target password; Based on probability metrics and the priority rules of semantic patterns in the attack model, the relative guessing order of the target password during the attack attempt process is derived. Based on the relative guessing order, the attackable features that are prioritized for guessing during the attack process of the target password are extracted to form the probabilistic attack features of the password. Semantic patterns, basic statistical features, and probabilistic attack features are fused according to preset feature associations to generate a set of basic cryptographic features for the target cryptography.

3. The dynamic password strength evaluation method for IoT devices according to claim 2, characterized in that, The process of inputting basic statistical features into a statistical probability model and outputting a probability metric value corresponding to the target password is as follows: Based on the fundamental statistical characteristics of the target cipher, construct a cryptographic feature representation and convert the cryptographic feature representation into an encodeable structured representation. Based on the value range and statistical distribution characteristics of each data in the structured representation, an encoding scheme for cryptographic feature representation is constructed. According to the encoding scheme, the structured representation is encoded, and the encoding lengths of each part are accumulated to obtain the description length metric. The length metric is used as the probability constraint data in the statistical probability model, and is input into the statistical probability model along with the cryptographic feature representation. The statistical probability model, based on the cryptographic feature representation, performs initial probability inference on the target cryptography and obtains the initial probability result of the target cryptography in the sense of statistical distribution. The description length metric is mapped to a probability constraint factor, and the initial probability result is weighted and adjusted according to the probability constraint factor to obtain the corrected probability metric.

4. The dynamic password strength evaluation method for IoT devices according to claim 1, characterized in that, The initial password strength for generating the target password based on fundamental cryptographic features is as follows: Based on a pre-set set of reference cipher samples, the feature representation of the target cipher is associated with the feature representation of the reference cipher samples to construct a comparison relationship between the target cipher and multiple reference ciphers; Based on the comparison relationship and the degree of difference between the target cipher and the corresponding reference cipher in various basic cryptographic features, a security advantage judgment result of the target cipher relative to the corresponding reference cipher is generated. The results of different security advantage assessments are summarized to form a description of the local relative security relationship of the target cryptography in the reference cryptographic sample set; Based on the description of local relative security relationships, the feature dimension ranking results of the target cryptography are generated from different feature dimensions respectively; Cross-analysis of the ranking results under each feature dimension is performed to identify the ranking consistency characteristics of the target password under multiple dimensions. Based on the sorting consistency feature, the sorting results under different feature dimensions are aggregated to generate the relative secure sorting position of the target password in the reference password sample set. Based on the relative security sorting position, the target password is mapped to a preset security level range to generate the initial password strength of the target password.

5. The dynamic password strength evaluation method for IoT devices according to claim 4, characterized in that, The cross-analysis of the ranking results under each feature dimension identifies the ranking consistency characteristics of the target password, which exhibit security advantages or disadvantages across multiple dimensions, as detailed below: Align the sorting results of the target password under each feature dimension; Based on the aligned sorting results, the relative position range of the target password under each feature dimension is determined; Joint analysis is performed on the relative position intervals of the target password under multiple feature dimensions to determine whether the relative position intervals show the same or similar distribution trends in multiple dimensions. When the target password is in a relatively high position range across multiple feature dimensions, the identification of the target password has a security advantage type of order consistency feature. When the target password is located in the later relative position range under multiple feature dimensions, the identification of the target password has a security disadvantage type of order consistency feature. When the relative position range of the target password under different feature dimensions differs by more than a preset value, the target password is identified as having a sorted and dispersed characteristic.

6. The dynamic password strength evaluation method for IoT devices according to claim 1, characterized in that, The initial password strength is mapped to attack cost based on the context information of the device corresponding to the target password, as follows: Obtain the device context information of the IoT device corresponding to the target password, and perform semantic decomposition on the device context information to extract context elements related to the attack implementation conditions; Based on contextual elements, construct the feasible attack space of the target device; Based on the initial password strength of the target password, construct an abstract attack space corresponding to the initial password strength, and determine the basic cracking complexity of the target password in the abstract attack space; The basic cracking complexity is mapped from the abstract attack space to the feasible attack space, and the constraints of the device context on the boundary of attack attempt capability are analyzed. Based on the projection analysis results, output the resource consumption required for the target password to complete an effective attack within the feasible attack space; Resource consumption is used as the attack cost of the target password in the current device context.

7. The dynamic password strength evaluation method for IoT devices according to claim 6, characterized in that, The semantic decomposition of the device context information to extract contextual elements related to the attack execution conditions is as follows: Perform type identification and classification processing on the acquired device context information; Extract key descriptive items that reflect the conditions under which an attack was carried out from the context information of different types of devices; Semantic merging is performed on key descriptive items to combine descriptive items with the same or similar attack impact meanings into unified contextual elements; The merged context elements are represented in a structured form, forming a set of context elements directly related to the attack execution conditions.

8. The method for dynamic password strength evaluation for IoT devices according to claim 7, characterized in that, The construction of the feasible attack space for the target device based on contextual elements is as follows: Obtain the attack attempt data set and map each extracted context element to the corresponding data item in the attack attempt data set; Based on the constraints corresponding to each context element, the value range of the corresponding attack attempt data is pruned to obtain the effective value range of each attack attempt data under the current device context. The valid value ranges of all attack attempt data are combined to form a multidimensional data space. The multidimensional data space is identified as the feasible attack space for the target device.

9. The dynamic password strength evaluation method for IoT devices according to claim 8, characterized in that, The process of mapping the basic cracking complexity from the abstract attack space to the feasible attack space and analyzing the constraints of the device context on the attack attempt capability boundary is as follows: The basic cracking complexity is represented as a description of the standard attack resource requirements under the abstract attack space; Based on the data consistency relationship between the abstract attack space and the feasible attack space, a data correspondence expression of the attack resource requirement description in the feasible attack space is established. Based on the device context elements, the data value range of each attack attempt in the feasible attack space is limited, and boundary checks are performed on the corresponding data representation. When all resource configurations in the attack resource requirement description meet the boundary verification conditions, it is determined that the basic cracking complexity has been fully implemented in the current device context. When some resource configurations in the attack resource requirement description exceed the allowable range of the feasible attack space, the excess portion is identified as the constraint boundary formed by the device context on the attack attempt capability.

10. The method for dynamic password strength evaluation for Internet of Things (IoT) devices according to claim 1, characterized in that, The process of acquiring dynamic risk status data during device operation, dynamically adjusting attack costs, and obtaining a dynamic password strength assessment result for the target password is as follows: During the operation of the target equipment, dynamic risk status data of the equipment's current safety situation are collected; The dynamic risk status data is classified and merged to generate a risk status description that represents the current risk level of the equipment. Based on the risk status description results, match the preset attack cost correction rules to determine the attack cost correction method corresponding to the current risk status; The attack cost is dynamically adjusted based on the attack cost correction method. The dynamically adjusted attack cost is used as a description of the effective attack cost of the target cipher in its current operating state. Based on the description of effective attack cost, the target password is mapped to a preset dynamic password strength range, and the dynamic password strength evaluation result of the target password is output.

Images