Password verification methods, devices, storage media and program products
By employing a multi-dimensional quantitative inspection and adaptive learning mechanism based on character space distribution, the problem of insufficient weak password recognition in existing technologies is solved, the security defense capabilities of database systems are improved, and protection requirements of different security levels are adapted to achieve a balance between security and user experience.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CETC JINCANG (BEIJING) TECH CO LTD
- Filing Date
- 2026-01-23
- Publication Date
- 2026-06-02
AI Technical Summary
Existing technologies cannot effectively identify and intercept weak passwords that conform to basic character rules but whose arrangement patterns are predictable. This results in insufficient defense capabilities of database systems against new types of attacks, and verification strategies are difficult to adjust flexibly to adapt to dynamic security requirements.
A multi-dimensional quantitative inspection method based on character space distribution is adopted, including physical keyboard layout and numerical space analysis of encoded character sets. A three-level progressive verification framework is designed, and the defense strategy is dynamically adjusted by calculating the distance between adjacent characters and the overall dispersion analysis, combined with an adaptive learning mechanism.
It enables accurate identification and interception of predictable weak passwords, enhances the security defense strength of the database system at the password entry point, adapts to the protection needs of different security level scenarios, and balances security and user experience.
Smart Images
Figure CN122133126A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of big data, and in particular to a password verification method, device, storage medium, and program product. Background Technology
[0002] In database security systems, password authentication serves as the primary access control barrier, and its strength directly impacts the security of core data assets in critical sectors such as finance and government. Currently, many users, for convenience, still habitually set weak passwords based on personal information or simple patterns. These passwords have low entropy values and are highly predictable, making them extremely vulnerable to brute-force or dictionary attacks, thus becoming a weak point in database security systems.
[0003] In current implementations, traditional database systems typically employ rule-based password complexity verification mechanisms. Specifically, when a user creates a password, the system verifies the password length and whether it contains combinations of basic character types such as uppercase letters, lowercase letters, numbers, and special characters, based on a preset rule set. Furthermore, some systems introduce static weak password blacklists for matching and filtering.
[0004] However, the above implementation method cannot recognize passwords that conform to basic character rules but have predictable arrangement patterns, thus making it difficult to effectively improve the security of the database system. Summary of the Invention
[0005] This application provides a password verification method, device, storage medium, and program product to solve the technical problem of database system security.
[0006] In a first aspect, embodiments of this application provide a password verification method, the method comprising:
[0007] Retrieve the user password to be verified;
[0008] Determine the target complexity level that user passwords must meet;
[0009] Perform the corresponding password security verification based on the target complexity level;
[0010] When the target complexity level is level one, the first verification is performed on the user password; wherein, the first verification is used to check whether the password conforms to the preset character complexity rules;
[0011] If the target complexity level is level two, then the user password is subjected to a first verification and a second verification. The second verification is used to check the spatial distribution relationship between adjacent characters in the password.
[0012] If the target complexity level is level three, then the user password is subjected to the first verification, the second verification, and the third verification. The third verification is used to perform discrete analysis on the password.
[0013] If all user password verifications pass, then the user password can be used.
[0014] In this embodiment, by introducing multi-dimensional quantitative checks based on character space distribution (e.g., keyboard distance and encoded value distance) and combining them with a tiered triggerable verification framework, weak passwords that conform to traditional character rules but have predictable arrangement patterns (e.g., "Qwerty", "123abc") can be systematically identified and blocked. This method overcomes the limitations of existing technologies that rely on static rules and fixed lists, achieving accurate and adaptive protection for business scenarios with different security levels, and improving the security defense strength of critical systems such as databases at the password entry point.
[0015] In one possible implementation, a first verification of the user password is performed, including:
[0016] Count the number of character types contained in user passwords. Character types include at least one of uppercase letters, lowercase letters, numbers, and special characters.
[0017] Determine whether the number of character types meets the first preset condition;
[0018] Determine if the length of the user's password meets the minimum length requirement;
[0019] If the number of character types and the length of the user password both meet the corresponding preset requirements, then the first verification is considered successful.
[0020] In this implementation, by quantifying the basic security rules into specific statistics and judgments on the length, number of uppercase letters, lowercase letters, numbers, number of special characters, and total number of letters, the system achieves automated and precise verification of the password character composition and length. This provides a reliable input that conforms to the preset security benchmark for the entire hierarchical verification system, thereby ensuring the compliance and randomness of the password at the basic level.
[0021] In one possible implementation, a second verification is performed on the user password, including:
[0022] The relationship between adjacent characters in the user password is checked; the check includes distance checks based on the physical keyboard layout and / or distance checks based on the numerical values of the encoded character set.
[0023] Distance checks based on physical keyboard layout include: calculating the distance between adjacent characters in the user password on the keyboard layout, and determining whether the first threshold requirement is met;
[0024] Distance checks based on encoded character set values include: calculating the difference between the encoded values of adjacent characters in the user password and determining whether the second threshold requirement is met;
[0025] If the performed check meets the corresponding threshold requirement, the second check is deemed to have passed.
[0026] In this implementation, by quantitatively analyzing the proximity of adjacent characters in the password within the physical keyboard layout and encoded value space, the abstract requirement of "preventing patterned attacks" is transformed into a calculable and comparable distance indicator (such as the difference between the keyboard Manhattan distance and the ASCII code). This scheme enables the system to accurately identify and intercept regular weak passwords such as continuous keyboard sequences like "qwerty" or continuous encoded value sequences like "123abc". Therefore, in addition to traditional character rule verification, a powerful security dimension based on spatial distribution patterns is added, enhancing the system's ability to defend against new attack patterns.
[0027] In one possible implementation, a third verification is performed on the user password, including:
[0028] Based on the user's password, obtain the character distance data sequence to be analyzed;
[0029] Calculate the mean and variance of the character distance data sequence;
[0030] Determine whether the mean is not lower than the first dispersion threshold and whether the variance is not higher than the second dispersion threshold;
[0031] If the result is yes, then the third verification is considered to have passed.
[0032] In this implementation, by introducing the analysis of higher-order statistical features (mean and variance) of character distance sequences, this application can identify and intercept complex weak passwords that, even if they pass the adjacent character distance check, still exhibit specific regularities (such as periodic fluctuations and segmented concentrations) from the overall distribution pattern, thus elevating password security verification from local proximity defense to a higher dimension of global randomness verification.
[0033] In one possible implementation, before determining whether the average is not lower than a first dispersion threshold and whether the variance is not higher than a second dispersion threshold, the method further includes:
[0034] Retrieve the weight configuration corresponding to the current business scenario;
[0035] Based on the weight configuration, determine the first dispersion threshold and the second dispersion threshold.
[0036] In this implementation, by dynamically associating and binding the threshold of dispersion analysis with specific business scenarios, this application achieves refined and scenario-based adaptation of password security policies. This allows the system to automatically switch verification strength in business environments with different security requirements, ensuring the security of core assets while avoiding excessive restrictions on low-risk scenarios, thus achieving a better balance between security and user experience.
[0037] In one possible implementation, the method further includes:
[0038] Analyze historical user password behavior data using clustering analysis or anomaly detection algorithms;
[0039] Based on the analysis results, update at least one of the following:
[0040] The keyboard distance threshold used in the second verification when performing distance checks based on the physical keyboard layout;
[0041] The encoded distance threshold used in the second verification when performing distance checks based on the encoded character set;
[0042] The first or second discrete threshold used in the third verification.
[0043] This implementation upgrades the traditional, knowledge-based static defense system into an intelligent adaptive system capable of continuously learning from real-world data, proactively identifying threats, and dynamically adjusting defense strategies. This effectively solves the problem of outdated defense rules caused by the continuous evolution of weak password patterns, improving the system's security against new and unknown attacks.
[0044] In one possible implementation, the method further includes:
[0045] Adjust the thresholds used in the second and / or third verification processes based on historical user password behavior data and / or attack pattern data identified by the system.
[0046] In this implementation, through such a feedback adjustment mechanism, the verification system of this application realizes dynamic adjustment rules, which can optimize defense parameters in real time and automatically according to changes in user behavior and the evolution of attack patterns, so that the password security policy has continuous environmental adaptability and threat resistance capabilities.
[0047] In a second aspect, this application provides an electronic device, including: a processor and a memory communicatively connected to the processor;
[0048] The memory stores instructions that the computer executes;
[0049] The processor executes computer-executable instructions stored in memory to implement any of the methods of the first aspect.
[0050] Thirdly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method of any one of the first aspects.
[0051] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method of any one of the first aspects. Attached Figure Description
[0052] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0053] Figure 1 A flowchart illustrating a password verification method provided in an embodiment of this application;
[0054] Figure 2 This application provides a schematic representation of the relationship between complexity levels and verification rules in its embodiments.
[0055] Figure 3 A schematic diagram of a keyboard coordinate mapping provided in an embodiment of this application;
[0056] Figure 4 This is a table diagram illustrating an ASCII character distance mapping provided in an embodiment of this application.
[0057] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0058] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0059] It should be noted that the password verification method, device, storage medium and program products provided in this application can be used in the field of big data, or in any field other than big data. This application does not limit the application field of the password verification method, device, storage medium and program products.
[0060] Specific application scenarios for this application include password security management in various information systems with strict requirements for data security and access control.
[0061] Specifically, this solution can be applied to database management systems, enterprise resource planning systems, cloud service platform account systems, and various business application systems that require user authentication. In key stages such as user registration, password modification, or privileged account creation in these systems, system administrators can preset different password security levels for different user groups or data resources based on the sensitivity of the business data, such as Level 1, Level 2, and Level 3.
[0062] For example, in core transaction databases or online payment systems in the financial sector, the highest level (e.g., level three) of password complexity requirements can be enforced for all user accounts. When a user creates or modifies their login password, the system will, according to the password verification method provided in this application, sequentially perform multi-dimensional verifications on the user's input password, including character composition checks, adjacent character spatial relationship checks, and overall discreteness analysis. This ensures that the password can effectively resist guessing attacks based on common keyboard layouts (e.g., continuous or patterned inputs such as "Qwerty" or "1qaz2wsx") and attacks based on character encoding value patterns (e.g., simple sequences such as "123456" or "abcde"), thereby building a high-strength security defense at the entry point.
[0063] Similarly, in e-government systems, high-level verification can be set for back-end management accounts that handle sensitive citizen information; in medical information systems, the password verification method provided in the embodiments of this application can be applied to doctor workstation accounts that access patient privacy data.
[0064] Through this configurable, tiered password strength enforcement mechanism, this application can provide business systems in different security domains with precise password security policy enforcement capabilities that match their risks.
[0065] For the above application scenarios, existing technical solutions typically implement password verification through the following two methods:
[0066] In one possible implementation, password verification can be achieved, for example, based on a static verification method using predefined character rules. This method pre-defines a fixed set of character combination rules in the database or application system, such as requiring the password length to be no less than a certain number of digits (e.g., 8 digits) and to simultaneously contain several categories of uppercase letters, lowercase letters, numbers, and special characters.
[0067] When a user creates a password, the system verifies whether the entered password meets these preset character type and length conditions. If it does, it is deemed compliant. For example, the predefined character rules can be set to a password length of at least 8 characters and to include at least 3 of the following four categories: numbers, lowercase letters, uppercase letters, and special characters. This method aims to increase the theoretical entropy value by forcibly increasing the number of character types in the password, but it can only filter out weak passwords that do not conform to the basic character combination rules.
[0068] In another possible implementation, password verification can be achieved through dynamic detection methods based on weak password dataset matching. This method relies on a pre-collected and maintained dictionary or list of weak passwords, such as those containing frequently used weak passwords like "123456" or "password". During verification, the system matches the user-input password against this weak password dataset; if a match is found, the password is considered weak. To improve detection efficiency and targeting, some optimization schemes incorporate machine learning techniques, analyzing historical data to build a customized weak password dictionary for the target system, or using algorithms like stochastic gradient descent to build a correlation model to reduce the number of matches. For example, a method can generate a customized dictionary by constructing a correlation model of weak passwords between different targets. The core of such methods lies in the identification and interception of known weak passwords.
[0069] However, the solution described above has the following technical problems:
[0070] Existing solutions primarily rely on basic rule validation based on character type and length, or matching against static weak password lists. This validation method cannot effectively identify and block password patterns that conform to basic character rules but exhibit regular and predictable distributions in physical keyboard layout or character encoding values. This results in insufficient defense against new attack methods based on spatial distribution patterns.
[0071] Furthermore, verification methods based on fixed rules or static weak password datasets lack the flexibility to adapt to dynamic security needs. On one hand, they rely on the completeness and timeliness of the dataset, making them unable to identify new weak passwords or targeted attack patterns not included in the dataset. On the other hand, they cannot dynamically adapt verification standards of varying stringency to different security levels across different business scenarios, making it difficult to achieve an effective balance between security and user experience.
[0072] The password verification method provided in this application aims to solve the aforementioned technical problems of the prior art. By constructing a multi-dimensional dynamic verification method based on character space distribution characteristics and capable of hierarchical execution, the method uses the physical keyboard layout and the numerical space of the encoded character set as the benchmark for quantitative analysis, and quantifies the regularity of the arrangement of adjacent characters in the password by calculating the distance between them in the aforementioned space.
[0073] Based on this, this method designs a three-level progressive verification framework: the first level performs basic character composition verification; the second level introduces restrictions on the distance between adjacent characters to defend against patterned attacks based on the continuity of keyboard or encoded values; the third level further performs discrete analysis on the character distance sequence of the entire password, and by calculating its average and variance and other statistical characteristics, it judges whether the overall distribution of the password is random enough to defend against more concealed regular passwords.
[0074] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0075] First, combine Figure 1 and Figure 2 The password verification method provided in the embodiments of this application will be introduced. Figure 1 This is a flowchart illustrating a password verification method provided in an embodiment of this application. Figure 2 This document illustrates a representation of the relationship between complexity levels and verification rules, as provided in embodiments of this application. Figure 1 As shown, the method includes the following steps:
[0076] S101. Obtain the user password to be verified.
[0077] Specifically, when a user enters or submits a password in a system (such as a database management interface or an application registration page), the verification system uses the string contained in that password as the input to be verified. For example, when a user creates a database account, they enter "P@ssw0rd2024" in the password input box, and the system uses that string as the user password to be verified.
[0078] S102. Determine the target complexity level that the user password must meet.
[0079] The system determines the security strength standard to be followed in this verification based on the preset business security policy. The target complexity level is usually directly related to the security requirements of the business scenario, and the correspondence between each level and the business scenario is as follows:
[0080] Level 1 (Basic Compliance): Applicable to scenarios such as widely used and low-sensitivity business systems, aiming to meet the basic compliance requirements for enabling password complexity in Level 2 (Level 2 of the National Cybersecurity Classified Protection System).
[0081] Level 2 (Enhanced Protection): Suitable for scenarios with high security requirements, such as core business systems and internal critical system accounts.
[0082] Level 3 (High Security Protection): Applicable to scenarios such as privileged accounts (e.g., database administrator accounts) and core systems with the highest security level, requiring the strongest level of password protection.
[0083] In practical applications, the system can query the security management configuration table based on the identifier of the database or application the user wants to access (e.g., the core transaction database) to determine the corresponding complexity level. Alternatively, the system can determine the target complexity level based on the policies associated with the user account's role (e.g., system administrator).
[0084] S103. Perform the corresponding password security verification according to the target complexity level.
[0085] This step is the core logic branch point of the method. Based on the specific level value determined in S102, the system selects and executes a sequence of one or more corresponding verification steps. Specifically, it is divided into three cases: S104 to S106, with each level having progressively stricter requirements. Specific verification rules and constraints can be found in the embodiments provided in this application. Figure 2 The table shows the comparison between complexity levels and verification rules.
[0086] like Figure 2 As shown, the comparison table clarifies the core verification dimensions corresponding to each of the three levels: the first level corresponds to the character composition and length rules; the second level adds restrictions on adjacent character relationships (such as distance) on the basis of the first level; and the third level adds restrictions on overall dispersion analysis on the basis of the first two levels.
[0087] S104. When the target complexity is at level one, perform the first verification on the user password.
[0088] If the target complexity level determined by S102 is Level 1, it indicates that the current business scenario requires basic security protection. In this case, the system only performs the first verification. The first verification is mainly used to check whether the password conforms to the preset character complexity rules, such as checking whether the character type combination of the password meets the minimum requirements and whether the password length meets the standard.
[0089] S105. When the target complexity is at level two, perform a second verification on the user password.
[0090] If the target complexity level is level two, it indicates that the current scenario requires medium security protection. In this case, the system performs a second verification after completing the first verification (corresponding to step S104). The second verification checks the spatial distribution relationship between adjacent characters in the password, such as calculating and determining the distance between adjacent characters on the physical keyboard or determining whether the numerical difference between adjacent characters in the ASCII table meets a security threshold, to prevent continuous keyboard attacks such as "qwerty".
[0091] S106. When the target complexity is level 3, perform third verification on the user password.
[0092] If the target complexity level is level three, it indicates that the current scenario requires the highest level of security protection. In this case, the system needs to perform the first verification (corresponding to the step in S104), the second verification (corresponding to the step in S105), and then perform the third verification.
[0093] The third verification is used to perform dispersion analysis on the character distance data of the entire password. For example, it calculates the average and variance of the distance of all characters in the password and judges whether the character distance distribution of the password is sufficiently uniform and random in order to identify and defend against more complex and regular weak passwords.
[0094] It should be noted that S104, S105, and S106 are three mutually exclusive execution branches. Based on the judgment in S103, the system executes only the verification combination defined by one of the branch paths. For the executed verification combination, the results of all verification steps (i.e., the verifications covered by the branch) must be passing in order to trigger the "allow user password" operation in S107.
[0095] S107. If all user password verifications pass, then the user password is allowed to be used.
[0096] Specifically, the system summarizes and judges the results of all verification steps performed according to the target complexity level. For example, when the target complexity level is level three, the system needs to confirm that the first verification, the second verification, and the third verification have all returned a "pass" result.
[0097] The system only performs the final authorization operation when all required verifications pass successfully, allowing the user's password to be successfully set, stored, and used for subsequent user login authentication. If any verification fails—for example, if the password length is insufficient, the keyboard spacing between adjacent characters is too small, or the dispersion of the character distance sequence does not meet the requirements—the system will refuse the creation of the password and will usually return a prompt message to the user containing the specific reason for the failure, guiding the user to create a password that meets the security requirements.
[0098] The password verification method provided in this embodiment introduces a multi-dimensional quantitative check based on character space distribution (e.g., the distance between keyboard keys and encoded values), and combines it with a tiered triggerable verification framework. This allows for the systematic identification and blocking of weak passwords (e.g., "Qwerty", "123abc") that conform to traditional character rules but have predictable arrangement patterns. This method overcomes the limitations of existing technologies that rely on static rules and fixed lists, achieving precise and adaptive protection for business scenarios with different security levels, and improving the security defense strength of critical systems such as databases at the password entry point.
[0099] Optionally, performing the first verification on the user password can be achieved through the following steps:
[0100] First, count the number of character types contained in the user's password. Character types include uppercase letters, lowercase letters, numbers, and special characters.
[0101] Next, it is determined whether the number of character types meets the first preset condition, and whether the length of the user password meets the minimum length requirement.
[0102] In one possible implementation, the first preset condition and the minimum length requirement can be set as follows:
[0103] The minimum length requirement for the password is 8 characters.
[0104] The password must meet the following character type requirements: it must contain at least 1 uppercase letter, 1 lowercase letter, 2 numbers, and 2 special characters, and the total number of letters (uppercase and lowercase combined) must be no less than 3.
[0105] Finally, if the user password meets both the length requirement and the character type quantity requirement mentioned above, the first verification is considered successful.
[0106] By quantifying basic security rules into specific statistics and judgments on length, number of uppercase letters, lowercase letters, numbers, number of special characters, and total number of letters, the system achieves automated and precise verification of password character composition and length. This provides a reliable input that conforms to preset security benchmarks for the entire hierarchical verification system, thereby ensuring the compliance and randomness of passwords at the basic level.
[0107] Optionally, a second verification is performed on the user password, including checking the relationship between adjacent characters in the password. This check may include distance checks based on the physical keyboard layout and / or distance checks based on the numerical values of the encoded character set. This will be discussed in conjunction with... Figure 3 and Figure 4 The implementation process of the second verification will be introduced. Figure 3 This is a table diagram illustrating a keyboard coordinate mapping provided in an embodiment of this application. Figure 4This is a table diagram illustrating an ASCII character distance mapping provided in an embodiment of this application.
[0108] First, we introduce distance checking based on the physical keyboard layout. This check aims to determine whether adjacent characters in a password are too close together on the physical keyboard. As a specific implementation method, it can be combined with... Figure 3 The keyboard coordinate mapping and distance calculation rules shown are used for execution. The specific steps are as follows:
[0109] Coordinate mapping: First, assign a predefined two-dimensional coordinate (x, y) to each character on the keyboard. For example... Figure 3 As shown, in a specific keyboard layout model, the top-left character 'q' can be mapped to coordinates (1, -1), the 'w' to its right to it to (2, -1), the 'a' below it to (1, -2), and so on, to create a coordinate mapping table for all available characters.
[0110] Distance Calculation: For each pair of adjacent characters in the password, the coordinates (x_i, y_i) and (x_{i+1}, y_{i+1}) are obtained by querying the coordinate mapping table based on the character, and then the corresponding Manhattan distance is calculated. For example, the Manhattan distance d_key is calculated as: d_key = |x_i - x_{i+1| + |y_i - y_{i+1}|. For example, the Manhattan distance between adjacent characters "q" and "w" is |1 - 2| + |-1 - (-1)| = 1.
[0111] Threshold Check: After calculating the keyboard distances of all adjacent character pairs in the password, determine whether these distances meet a first threshold requirement. In a specific configuration, this first threshold requirement can be set to: the keyboard distance of all adjacent character pairs is not less than 2. If this is met, the check passes.
[0112] Secondly, we will introduce the distance check based on the numerical values of the encoded character set. This check aims to determine whether the numerical values of adjacent characters in a password are too close (e.g., ASCII or Unicode). As a specific implementation method, it can be combined with... Figure 4 The ASCII value mapping and distance calculation rules shown are used for execution. The specific steps are as follows:
[0113] Numerical mapping: First, a numerical value is preset for each character in a standard encoded character set (such as ASCII). For example... Figure 4 As shown, in a specific embodiment, the ASCII value corresponding to the character 'q' is 113, the character 'w' is 119, the character '1' is 49, the character '#' is 35, and so on, establishing a mapping relationship between characters and numerical values.
[0114] Distance Calculation: For each pair of adjacent characters in the password, obtain their respective ASCII values (x_i and x_{i+1}) based on the mapping relationship described above, and then calculate the ASCII distance between the pair of adjacent characters. The formula for calculating the ASCII distance d_ascii can be expressed as: d_ascii = |x_i - x_{i+1}|. For example, the ASCII distance between the adjacent characters "q" and "w" is |113 - 119| = 6.
[0115] Threshold Check: After calculating the ASCII distances of all adjacent character pairs in the password, determine whether these distances meet the second threshold requirement. In a specific configuration, this second threshold requirement can be set to: the ASCII distance of all adjacent character pairs is not less than 2. If this is met, the check passes.
[0116] Finally, if all the performed checks (keyboard distance check and / or encoding distance check) meet their corresponding threshold requirements, the second check is deemed to have passed.
[0117] By quantitatively analyzing the proximity of adjacent characters in a password within the physical keyboard layout and encoded value space, the abstract requirement of "preventing patterned attacks" is transformed into a calculable and comparable distance metric (such as the difference between the keyboard Manhattan distance and the ASCII code). This scheme enables the system to accurately identify and intercept regular weak passwords such as continuous keyboard sequences like "qwerty" or continuous encoded value sequences like "123abc". Therefore, in addition to traditional character rule verification, a powerful security dimension based on spatial distribution patterns is added, enhancing the system's ability to defend against new attack patterns.
[0118] Optionally, a third verification is performed on the user password. This aims to assess the overall dispersion of the password character distance sequence to determine if its distribution is sufficiently random to defend against more complex patterned attacks. This can be achieved through the following steps:
[0119] First, obtain the character distance data sequence to be analyzed. The purpose of this step is to prepare the basic data for the dispersion analysis. The character distance data sequence refers to a set of quantized values, calculated by the second check, that characterize the relationship between all adjacent characters in the password.
[0120] Specifically, if the second verification performs a distance check based on the physical keyboard layout, then the data sequence is the keyboard Manhattan distance sequence of each pair of adjacent characters in the password, denoted as Dkey=[dkey1,dkey2,...,dkey(n−1)], where n is the password length.
[0121] If the second check performs a distance check based on the numerical value of the encoded character set, then the data sequence is the ASCII distance (absolute difference) sequence of each pair of adjacent characters in the password, denoted as Dascii=[dascii1,dascii2,...,dascii(n−1)].
[0122] If the second check performs both of the above checks simultaneously, the two data sequences can be subjected to subsequent dispersion analysis, or merged into a single composite sequence according to preset rules.
[0123] Secondly, calculate the mean and variance of the character distance data sequence. After obtaining the distance data sequence, its statistical characteristics need to be calculated to quantify the dispersion.
[0124] Average Calculation: Calculate the arithmetic mean of all distance values in the sequence to measure the overall level of character distance. The specific calculation formula is as follows:
[0125]
[0126] in, This represents the average value. This represents the i-th distance value in the sequence, where n-1 is the sequence length (i.e., the number of adjacent character pairs).
[0127] Variance calculation: The variance of the sequence is calculated to measure the degree of dispersion (fluctuation) of each distance value relative to the mean. The specific calculation formula is as follows:
[0128]
[0129] in, Represents variance. This is the average value obtained from the above calculations.
[0130] Finally, determine whether the statistical characteristics of dispersion meet the threshold requirements. Compare the calculated mean and variance with the preset safety threshold.
[0131] Average value determination: Determine the calculated average value. Whether it is not lower than the first dispersion threshold. This threshold sets the minimum requirement for the distance of the password characters from the overall "span". The larger the value, the more "spread" the password characters are distributed in space or numerically.
[0132] Variance judgment: Determine the calculated variance Whether it is not higher than the second dispersion threshold. This threshold sets the maximum limit on the fluctuation range of password character distance. The smaller the value, the closer each distance value is to the average value, and the more "uniform" the distribution, avoiding an unbalanced pattern where some characters are extremely close and some characters are extremely far apart.
[0133] In a specific configuration example, the above thresholds can be set as follows: the first dispersion threshold (lower limit of the mean) is 5, and the second dispersion threshold (upper limit of the variance) is 0.4. This configuration requires that the character distance sequence of the password has both sufficient overall span (mean ≥ 5) and good uniformity (variance ≤ 0.4).
[0134] If the results of the above judgments are all yes (i.e., the mean satisfies the lower limit and the variance satisfies the upper limit), then the third verification is deemed to have passed. Otherwise, it is deemed to have failed.
[0135] By introducing the analysis of higher-order statistical features (mean and variance) of character distance sequences, this application can identify and intercept complex weak passwords that, even if they pass the adjacent character distance check, still exhibit specific regularities (such as periodic fluctuations and segmented concentrations) from the overall distribution pattern, thus elevating password security verification from local proximity defense to a higher dimension of global randomness verification.
[0136] Optionally, before determining whether the average value is not lower than a first dispersion threshold and whether the variance is not higher than a second dispersion threshold, embodiments of this application further include a dynamic threshold determination step, so that the rigor of the dispersion analysis can adapt to different business security requirements. This step can be implemented in the following ways:
[0137] Step 1: Obtain the weight configuration corresponding to the current business scenario:
[0138] The system retrieves pre-configured weight parameters for the business scenario associated with the current verification operation. Business scenario information may include, for example, the target database identifier accessed by the user, the user's role, or security policy tags set by the administrator. The system then queries a pre-defined mapping table between business scenarios and weight configurations to obtain the weight configuration data matching the current scenario.
[0139] Step 2: Determine the first and second dispersion thresholds based on the weight configuration.
[0140] The system parses the weight configuration data and determines the specific threshold values that will be used for this dispersion analysis.
[0141] In one possible implementation, the weight configuration can directly include the values of the first and second dispersion thresholds. For example, the weight data configured for the "core transaction database" scenario might be {"first dispersion threshold": 5, "second dispersion threshold": 0.4}; while the data configured for the "internal office system" might be {"first dispersion threshold": 3, "second dispersion threshold": 0.6}. The system directly reads and uses these values as the basis for judgment.
[0142] After completing the above threshold determination steps, the system will use the determined first and second dispersion thresholds to execute the subsequent mean and variance judgment logic.
[0143] By dynamically associating and binding the threshold of dispersion analysis with specific business scenarios, this application achieves refined and scenario-based adaptation of password security policies. This enables the system to automatically switch verification strength in business environments with different security requirements, ensuring the security of core assets while avoiding excessive restrictions on low-risk scenarios, thus achieving a better balance between security and user experience.
[0144] Optionally, the password verification method provided in this application embodiment further includes a self-learning update step, which aims to dynamically discover new weak password patterns and automatically optimize the defense parameters of the verification system by analyzing historical user behavior data, thereby enabling the system to have continuously evolving security defense capabilities. This step can be executed periodically or under triggering conditions in the following ways:
[0145] Analyze historical user password behavior data using clustering analysis or anomaly detection algorithms:
[0146] The system collects and organizes historical user password behavior data over a period of time. This data may include: successfully created passwords, passwords rejected by the system and the reasons for the failure, records of user password changes, etc.
[0147] Data preprocessing: The collected password data is standardized, for example, by converting it into a uniform character distance feature sequence (keyboard distance sequence and / or ASCII distance sequence) to form a feature dataset that can be analyzed by machine learning algorithms.
[0148] Pattern discovery: Unsupervised learning algorithms were applied to analyze the above feature dataset.
[0149] Clustering analysis: For example, the DBSCAN (density-based spatial clustering with noise) algorithm can be used to identify user password patterns clustered in the feature space. If the algorithm finds a large number of passwords exhibiting highly similar linear decreasing patterns such as "ZXCVBNM" in keyboard distance features, or continuously decreasing patterns such as "987654321" in ASCII distance features, these clusters are identified as potential new weak password patterns not covered by existing rules.
[0150] Anomaly detection: Alternatively, anomaly detection algorithms can be applied to identify "outliers" that differ significantly from the distribution of password characteristics in the vast majority of passwords. These outliers may represent specific weak passwords that individual users have tried to use in a highly regular manner.
[0151] Based on the analysis results, update the verification threshold:
[0152] Based on the patterns discovered in the above steps, the system automatically adjusts the corresponding verification thresholds to strengthen defenses against these new patterns.
[0153] Update keyboard distance threshold: If cluster analysis identifies a new type of weak password pattern based on consecutive keystrokes (e.g., detecting frequent occurrences of the "ZXCVBNM" pattern), the system can determine that the existing keyboard distance threshold (e.g., "not less than 2") is insufficient to effectively block such patterns. In response, the system can automatically increase this threshold (e.g., from 2 to 3), requiring adjacent characters in the password to be spaced further apart on the keyboard, thereby covering such newly discovered attack vectors.
[0154] Update the encoding distance threshold: Similarly, if a weak password pattern based on regular changes in ASCII values (such as a continuously decreasing sequence) is found, the system can automatically increase the encoding distance threshold (such as from 2 to 4), requiring that the ASCII code values of adjacent characters must have a greater difference.
[0155] Update the dispersion threshold: If the analysis finds that a large number of passwords accepted by the system meet the distance requirements locally (adjacent characters), but the dispersion characteristics (mean or variance) of their overall distance sequence exhibit a new and predictable clustering (e.g., the mean always hovers at a low level), the system can automatically adjust the first dispersion threshold (increase the lower limit of the mean) or the second dispersion threshold (decrease the upper limit of the variance) to strengthen the requirement for the randomness of the overall distribution.
[0156] It should be noted that the above update operations can be performed individually or in combination. The system can determine which threshold(s) to update based on the confidence level of the analysis results and the severity of the impact.
[0157] By upgrading the traditional, knowledge-based static defense system into an intelligent adaptive system capable of continuously learning from real-world data, proactively identifying threats, and dynamically adjusting defense strategies, this effectively solves the problem of outdated defense rules caused by the continuous evolution of weak password patterns, thus improving the system's security when facing new and unknown attacks.
[0158] Optionally, the password verification method provided in this application embodiment further includes a feedback adjustment step as a synergy and optimization of the aforementioned self-learning update step. This step, based on a more explicit and targeted feedback data source, finely calibrates the defense threshold of the verification system to quickly respond to known security threats or optimization strategies. This step can be implemented in the following ways:
[0159] Adjusting thresholds based on historical user password behavior data:
[0160] This adjustment focuses on learning from the system's own operational history to optimize the balance between user experience and security; its core is a dynamic adjustment rule mechanism.
[0161] Data source: Analyze recent historical data on user-generated passwords, especially the high-frequency patterns observed.
[0162] Analysis logic and adjustment actions: The system dynamically optimizes the distance threshold by analyzing user behavior patterns.
[0163] When the system detects that a user frequently generates consecutive keyboard characters (e.g., a large number of patterns such as "QWERTY" or "ASDFGHJKL" appear in historical data), it indicates that the existing keyboard distance threshold may be insufficient to prevent such habitual weak passwords. In response, the system will automatically lower or raise the allowed threshold for Manhattan distance. For example, the requirement that the distance between adjacent characters must be ≥2 will be automatically adjusted to ≥3 to force the user to break this habit of continuous keystrokes.
[0164] Conversely, if the system finds that the passwords generated by the vast majority of users can easily meet the current distance threshold and there are no obvious signs of attack, the threshold may be relaxed appropriately to improve availability.
[0165] Thresholds are adjusted based on attack pattern data identified by the system:
[0166] This adjustment focuses on directly responding to external security threats to enhance the system's defenses against known attacks.
[0167] Data source: Integrates explicit attack pattern data from intrusion detection system logs.
[0168] Analysis logic and adjustment actions: The system proactively strengthens the defense in relevant dimensions based on the identified attack characteristics.
[0169] If the system detects or becomes aware of a new attack pattern based on increasing ASCII values (e.g., sequences like "123456789" or "abcdefgh"), it will automatically lower or raise the ASCII distance threshold. For example, it might raise the requirement from ≥2 to ≥10 for the ASCII difference between adjacent characters, thus effectively blocking attacks that utilize a fixed, small-span increasing pattern.
[0170] The two data sources mentioned above can be used independently or in combination. The system makes a comprehensive decision on the final threshold adjustment based on the management strategy.
[0171] Through this feedback adjustment mechanism, the verification system of this application realizes dynamic adjustment rules, which can optimize defense parameters in real time and automatically according to changes in user behavior and the evolution of attack patterns, so that the password security policy has continuous environmental adaptability and threat resistance capabilities.
[0172] The electronic device provided in this application embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.
[0173] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the methods in any of the above method embodiments.
[0174] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the methods in any of the above method embodiments.
[0175] All or part of the steps in the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.
[0176] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0177] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0178] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0179] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.
[0180] In this application, the term "comprising" and its variations can refer to non-limiting inclusion; the term "or" and its variations can refer to "and / or". The terms "first", "second", etc., in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.
[0181] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.
[0182] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.
[0183] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.
[0184] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.
[0185] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.
[0186] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A password verification method, characterized in that, The method includes: Retrieve the user password to be verified; Determine the target complexity level that the user password must meet; Perform the corresponding password security verification based on the target complexity level; When the target complexity level is the first level, a first verification is performed on the user password; wherein, the first verification is used to check whether the password conforms to a preset character complexity rule; If the target complexity level is the second level, then the first verification and the second verification are performed on the user password. The second verification is used to check the spatial distribution relationship between adjacent characters in the password. If the target complexity level is the third level, then the first verification, the second verification, and the third verification are performed on the user password, and the third verification is used to perform discreteness analysis on the password; If all verifications of the user password pass, then the user password is allowed to be used.
2. The method according to claim 1, characterized in that, The first verification of the user password includes: The number of character types contained in the user password is counted, and the character types include at least one of uppercase letters, lowercase letters, numbers, and special characters; Determine whether the number of character types meets the first preset condition; Determine whether the length of the user password meets the minimum length requirement; If the number of character types and the length of the user password both meet the corresponding preset requirements, then the first verification is deemed to have passed.
3. The method according to any one of claims 1 or 2, characterized in that, The second verification of the user password includes: The relationship between adjacent characters in the user password is checked; wherein the check includes a distance check based on the physical keyboard layout and / or a distance check based on the numerical value of the encoded character set; The distance check based on the physical keyboard layout includes: calculating the distance between adjacent characters in the user password on the keyboard layout, and determining whether the first threshold requirement is met; The distance check based on the encoded character set value includes: calculating the difference in the encoded values of adjacent characters in the user password, and determining whether the second threshold requirement is met; If the performed check meets the corresponding threshold requirement, the second check is deemed to have passed.
4. The method according to claim 3, characterized in that, The third verification of the user password includes: Based on the user password, obtain the character distance data sequence to be analyzed; Calculate the mean and variance of the character distance data sequence; Determine whether the average value is not lower than a first dispersion threshold and whether the variance is not higher than a second dispersion threshold; If the result is yes, then the third verification is considered to have passed.
5. The method according to claim 4, characterized in that, Before determining whether the average value is not lower than the first dispersion threshold and whether the variance is not higher than the second dispersion threshold, the method further includes: Retrieve the weight configuration corresponding to the current business scenario; Based on the weight configuration, the first dispersion threshold and the second dispersion threshold are determined.
6. The method according to claim 5, characterized in that, The method further includes: Analyze historical user password behavior data using clustering analysis or anomaly detection algorithms; Based on the analysis results, update at least one of the following: The keyboard distance threshold used in the second verification when performing distance checks based on the physical keyboard layout; The encoded distance threshold used in the second verification when performing distance checks based on the encoded character set; The first or second discrete threshold used in the third verification.
7. The method according to claim 6, characterized in that, The method further includes: Based on the historical user password behavior data and / or the attack pattern data identified by the system, adjust the threshold used in the second verification and / or the third verification.
8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.
10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 7.