JP2010191871A - Similar password check system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a similar password check system capable of restricting a change of a password by determining similarity between a new input password and passwords already input. <P>SOLUTION: In the similar password check system in which a server 2 for receiving password authentication and a password change is connected to a client 1 through a public line network 7 in a freely communicable manner, the server 2 includes: a means for receiving password change information from the client 1; a means for accessing a password history management DB 3 by using the received password change information to calculate the number of times of changing passwords; a means for accessing an HMM information management DB 4, obtaining HMM information and calculating the occurrence probability of a changed password when the calculated number of times of changing passwords is a predetermined number or more; and a means for transmitting that the client 1 does not accept the change of the password when the calculated occurrence probability is equal to or greater than a defined threshold. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a similar password check system for managing a password change history, checking a similarity with a change history for a new password change, and restricting the password change.

In recent years, with the spread of the Internet, an increasing number of systems provide services by performing authentication between a client and a server.
As an authentication method between the client and the server, authentication by a user ID and a password is common. When performing authentication using a password, it is important for each user to change the password regularly because there is a possibility that the password may be eavesdropped by others.
Therefore, a function for requesting a password change from the server side and a function for checking the strength of the input password and restricting the change are required.

  The methods used to check the strength of passwords include checking by the number of characters in the password, such as not allowing changes to 8 characters or less, checking the same password, such as not allowing the same password as the previous time, and Markov chaining. Use it to check the strength of the password from the relationship between the i-th character and the i + 1-th character (whether the i + 1-th character is a number or a character).

  In addition, there exists the following patent document 1 as a well-known technical document relevant to this invention. In Patent Document 1, a password that can set a password expiration date and a renewal time limit for each user based on the frequency of access to the user's system, and can prompt the user to change the password based on this time limit. The update method is described.

Japanese Patent No. 2596361

By the way, the password input by the user is often created using a character string {birthday, part of name (Roman characters), pet name, etc.} meaningful to each user. In addition, in many cases, the same character string is reused only by exchanging the character string for changing the password.
For this reason, although the password itself has been changed, the same character string is used many times, so that the password may be easily guessed.

  In view of the above situation, the present invention manages a password change history of a user, learns a password sequence using the change history for each user, and newly input passwords and passwords input so far It is an object of the present invention to provide a similar password check system capable of determining similarity of passwords and restricting password changes.

In order to solve the above problems, the present invention provides the following configurations.
The invention according to claim 1 is a similar password check system in which a server that accepts password authentication and password change is communicatively connected to a client that receives password authentication via a public network,
The server includes a password history management database that manages a password change history;
An HMM information management database that stores HMM information that is attribute information of the learned hidden Markov model (HMM);
Means for receiving password change information from the client;
Means for accessing the password history management database using the client ID of the received password change information and calculating the number of password changes;
If the calculated number of password changes is less than a predetermined value, adding password change information to the password history management database, and means for transmitting to the client that the password change has been successfully accepted,
Means for accessing the HMM information management database if the calculated number of password changes is equal to or greater than a predetermined value, obtaining HMM information, and calculating the probability of occurrence of the changed password;
Means for transmitting to the client that the password change was not accepted if the calculated occurrence probability is greater than or equal to a defined threshold;
If the calculated occurrence probability is less than the defined threshold, password change information is added to the password management database, and HMM information is relearned from the input password and the password history management database information to manage the HMM information. The present invention provides a similar password check system comprising a means for updating a database and transmitting to the client that a password change has been successfully accepted.

  According to the similar password check system of the present invention, the password change history of the user is managed, the password sequence is learned using the change history for each user, the newly entered password and the password entered so far The password change can be restricted so that the password is not easily guessed.

It is a system configuration figure showing an example of an embodiment of a similar password check system of the present invention. It is a block diagram of the data stored in the password history management database of this invention. It is an image figure of a Hidden Markov Model (HMM) used in the present invention. It is a block diagram of the data stored in the HMM information management database of this invention. It is a flowchart figure which shows the outline | summary of the similar password check process of the server of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings showing examples.
The server and the client are computers, and each of the above means is realized by reading and executing a computer program required by the CPU of the computer, and a flowchart thereof is shown in FIG.

FIG. 1 is a system configuration diagram showing an embodiment of the present invention. The similar password check system according to this embodiment includes a client 1 that receives password authentication and a server 2 that receives password authentication and password change. The client 1 and the server 2 are connected by a public network 7. .
The client 1 includes an input device 6 for inputting a password, a display device 5 for displaying the input result, a password authentication result from the server 2, and a change result.

The server 2 includes a password history management database (DB) 3 that manages password change history and a hidden Markov model (HMM) information that is attribute information of the learned hidden Markov model (HMM). (HMM) An information management database (DB) 4 is provided.
Further, the server 2 updates the password history management database 3 and the HMM information management database 4, and HMM learning for learning the symbol output probability, state transition probability, etc. of the HMM from the information of the password history management database 3. 9 includes an HMM check unit 10 that checks similarity of password change information input from the client 1 using information in the HMM information management database 4, and a result transmission unit 11 that transmits a check result to the client 1. .

  As shown in FIG. 2, the password history information for each client stored in the password history management database 3 is composed of area data of client ID 21, change date 22, and change password 23, and is registered for each client and change date. The Here, for example, when the client newly changes the password, as shown in FIG. 2, “USER01” as the client ID 21, “2008/11/11” as the change date 22, and “aaabbbcccddd” as the change password 23. be registered.

FIG. 3 is a diagram illustrating an image of a hidden Markov model (HMM). A hidden Markov model (HMM) can be represented by a state 31, an initial state probability 32 of each state, a state transition probability 33 from state to state, and a symbol output probability 34 in the current state.
As shown in FIG. 4, hidden Markov model (HMM) information for each client stored in the HMM information management database 4 is held in the client ID 41, the number of states 42, the initial state probability 43 of each state, and each state. Each area data includes a symbol output probability 44 of a symbol and a state transition probability 45 from state to state, and is registered for each client.

The operation of the similar password check system configured as described above will be described below.
FIG. 5 is a flowchart showing an outline of the similar password check process of the server 2.
The client 1 inputs a password to be changed by the input device 6. The input password is transmitted to the server 2 via the public line network 7. The server 2 receives the password change information from the client 1 (step 501).

The server 2 accesses the password history management database 3 using the client ID of the received password change information and calculates the number of password changes (number of records) (step 502). If the calculated number of password changes is less than a certain value, password change information is added to the password history management database 3 (step 503), and the fact that the password change has been successfully accepted is transmitted to the client 1 (step 503). 504).
If the calculated number of password changes is equal to or greater than a certain value, the HMM information management database 4 is accessed, the HMM information is acquired, and the occurrence probability of the changed password is calculated (step 505).

In order to perform HMM learning, a certain number of password changes are required. Therefore, it is necessary to accept a password change as usual until a certain number of changes are made. The number of changes can be arbitrarily determined by the system, but is assumed to be 10 here.
In order to calculate the occurrence probability of the changed password, an optimum state transition sequence is determined using the Viterbi algorithm, and the product of the symbol output probabilities on the state transition sequence is set as the occurrence probability.

Next, when the calculated occurrence probability is equal to or higher than the threshold defined by the system (step 506), it is determined that the similarity with the password input so far is high, and the client 1 has not accepted the password change. Is transmitted (step 507). If the calculated occurrence probability is less than the threshold defined by the system (step 506), it is determined that the similarity with the password input so far is low, and the password change request is accepted, and the password management database 3 receives the password. Change information is added (step 508).
The threshold value to be determined is calculated as threshold = P × number of series (number of password characters), where P is a reference probability of one symbol (character).

Next, the hidden Markov model (HMM) is relearned from the input password and the information of the password history management database 3 (step 509). Learning uses the Baum-Welch algorithm.
The re-learned information is updated in the HMM information management database 4 (step 510) and used when the password is changed next time.
After all the above processes are completed, the client 1 is transmitted that the password change has been normally accepted (step 511), and the process is completed.

1 Client 2 Server 3 Password History Management Database 4 Markov Model (HMM) Information Management Database 7 Public Line Network 21, 41 Client ID
23 Change password

Claims (1)

A server that accepts password authentication and password change is a similar password check system in which a client receiving password authentication is communicatively connected via a public network,
The server includes a password history management database that manages a password change history;
An HMM information management database that stores HMM information that is attribute information of the learned hidden Markov model (HMM);
Means for receiving password change information from the client;
Means for accessing the password history management database using the client ID of the received password change information and calculating the number of password changes;
If the calculated number of password changes is less than a predetermined value, adding password change information to the password history management database, and means for transmitting to the client that the password change has been successfully accepted,
Means for accessing the HMM information management database if the calculated number of password changes is equal to or greater than a predetermined value, obtaining HMM information, and calculating the probability of occurrence of the changed password;
Means for transmitting to the client that the password change was not accepted if the calculated occurrence probability is greater than or equal to a defined threshold;
If the calculated occurrence probability is less than the defined threshold, password change information is added to the password management database, and HMM information is relearned from the input password and the password history management database information to manage the HMM information. A similar password check system comprising: means for updating a database and transmitting to the client that a password change has been successfully accepted.

Images