WO2019006848A1 - 口令生成方法和装置以及口令校验方法和装置 - Google Patents

口令生成方法和装置以及口令校验方法和装置 Download PDF

Info

Publication number
WO2019006848A1
WO2019006848A1 PCT/CN2017/100683 CN2017100683W WO2019006848A1 WO 2019006848 A1 WO2019006848 A1 WO 2019006848A1 CN 2017100683 W CN2017100683 W CN 2017100683W WO 2019006848 A1 WO2019006848 A1 WO 2019006848A1
Authority
WO
WIPO (PCT)
Prior art keywords
password
base
verification
modifying
module
Prior art date
Application number
PCT/CN2017/100683
Other languages
English (en)
French (fr)
Inventor
威廉 罗斯科安德鲁
陈邦道
Original Assignee
克洛斯比尔有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 克洛斯比尔有限公司 filed Critical 克洛斯比尔有限公司
Publication of WO2019006848A1 publication Critical patent/WO2019006848A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms

Definitions

  • the present invention relates to the field of cryptography, and in particular, to a password generation method and apparatus, and a password verification method and apparatus.
  • Identity authentication is the authentication of a user's identity, which is usually achieved by a password, that is, password authentication.
  • password authentication is the authentication of a user's identity, which is usually achieved by a password, that is, password authentication.
  • each application or account uses its unique password.
  • a password generation method and apparatus capable of accurately identifying a system guessing attack and a password verification method and apparatus are provided.
  • a password generating method comprising determining a password base, the password base being basic information included in a password to be generated; modifying the password base, and modifying the password base Satisfying the disclosed verification criteria, wherein the verification criteria are formulated for screening and verifying the modified password base based on the semantics and/or purpose of the password; and the modified The password base is generated as the password.
  • the purpose used may include information about a username, a system or service to log in, and/or any particular function of the password.
  • the verification criterion may be that the hash value of the combination of the password and the used purpose is within a certain range.
  • the verification criterion may be a hash value of a combination of the password and the used purpose.
  • modifying the password base can include adding words, numbers, symbols, and/or characters at the beginning, end of the password base, or at any of the locations in the password base.
  • modifying the password base can include adjusting the case of the letters contained in the password base.
  • the modifying the password base can include adding words, numbers, symbols, and/or characters at the beginning, end of the password base, or at any of the password bases, and adjusting the The case of the letters contained in the password base.
  • a password generating apparatus including a determining module for determining a password base, the password base being basic information included in a password to be generated, and a modifying module for modifying the Declaring a password base, and causing the modified password base to satisfy the disclosed verification criteria, wherein the verification criteria are formulated for screening and verifying the repair according to the semantics of the password and/or the purpose used a modified password base; and a generating module for generating the modified password base that satisfies the verification criterion as the password.
  • the purpose used may include information about a username, a system or service to log in, and/or any particular function of the password.
  • the verification criterion may be that the hash value of the combination of the password and the used purpose is within a certain range.
  • the verification criterion may be a hash value of a combination of the password and the used purpose.
  • the modification module can be further configured to add words, numbers, symbols, and/or characters at the beginning, end of the password base, or at any of the locations in the password base.
  • the modification module can be further configured to adjust the case of the letters contained in the password base.
  • the modification module can be further configured to add words, numbers, symbols, and/or characters at the beginning, end of the password base, or at any of the locations in the password base, and adjust the The case of the letters contained in the password base.
  • a password verification method comprising: receiving an input password; verifying whether the password satisfies a public verification criterion; and wherein the password satisfies the In the case of a public verification criterion and an error, the password is considered an attack.
  • a password verification apparatus comprising: a receiving module configured to receive an input password; a verification module configured to verify the password Whether the published verification criteria are met; and a decision module configured to treat the password as an attack if the password satisfies the disclosed verification criteria and is an error.
  • a computing device comprising a processor and a memory, wherein the memory stores computer program instructions, the computer program instructions being adapted to be loaded and executed by the processor The password generation method and/or password verification method described above.
  • a computer readable storage medium having stored thereon computer program instructions, wherein the computer program instructions, when executed by a processor, implements the Password generation method and/or password verification method.
  • the password generation method and apparatus modifies the password base and causes the modified password base to satisfy the public verification criterion
  • the modified password base that satisfies the verification criterion is then generated as a password.
  • the verification criteria are public, the attacker will make the guessed password satisfy the public verification criterion when performing the system guessing attack, and the password that the wrong user misreads or misplaces for the legitimate user satisfies the
  • the probability of the verification criterion is extremely small, even substantially impossible, so that the password that is erroneous and satisfies the verification criterion is likely to be a system guessing attack by the attacker, and thus utilizes an exemplary embodiment in accordance with the present invention.
  • the password generated by the password generation method and the technical solution of the device can easily identify the system guessing attack.
  • the purpose used may further include information about the user name to be logged in. Information about any specific function of the system or service and/or password, so the passwords between the systems are not compatible, ie the correct password of one system is not able to meet the verification criteria required by the password of another system, thus preventing People enter the correct password for one system into another.
  • the verification criteria are public.
  • FIG. 1 is a flowchart of a password generation method according to an exemplary embodiment of the present invention
  • FIG. 2 is a schematic diagram of a password generating apparatus according to an exemplary embodiment of the present invention.
  • FIG. 3 is a flowchart of a password verification method according to an exemplary embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a password verification apparatus according to an exemplary embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a computing device in accordance with an exemplary embodiment of the present invention.
  • a password generating method according to an exemplary embodiment of the present invention may include:
  • Step S101 determining a password base, where the password base refers to basic information included in the password to be generated;
  • Step S102 Modify the password base and make the modified password base meet the disclosed verification criteria, wherein the verification criterion is determined according to the semantics of the password and/or the purpose used for screening and verifying the modified password.
  • Base
  • Step S103 Generate the modified password base that satisfies the verification criterion as the password.
  • the password generating method first determines a password base, then modifies the password base and causes the modified password base to satisfy the disclosed verification criteria, and then uses the modified password base as Password generation. Since the verification criterion is public, that is, the public can know the verification criterion, the attacker will make the guessed password satisfy the public verification criterion when performing the system guessing attack, because the The password of the verification criterion is definitely not the correct password, and the probability that the password is wrong or misplaced for the legitimate user to satisfy the verification criterion is extremely small, or even basically impossible, so that the error is satisfied and the school is satisfied.
  • the password of the test criterion is likely to be a system guessing attack by the attacker. Therefore, the password generated by the technical solution of the password generating method according to the exemplary embodiment of the present invention can accurately identify the system guessing attack.
  • the password base may be provided or confirmed by the user, and thus, in one embodiment of the invention, step S101 determining that the password base may include receiving a password base from the user. In another embodiment of the present invention, step S101 determines that the password base can include randomly generating a password base. In still another embodiment of the present invention, determining that the password base in step S101 may include forming a password base according to a certain rule, the rule may be, for example, a combination of a 4-bit letter and a 2-digit number, and a password base as a password to be generated. The system name and so on.
  • the rule may be, for example, that the password base is composed of 8-bit characters, wherein at least a 1-bit symbol, a 2-digit number, and the like are present. It is to be understood that the cryptographic group can be formed in any manner known in the art or known in the future, and the invention is not limited in this respect.
  • a password generation method modifies a password base and causes the modified password base to satisfy the disclosed verification criteria.
  • Modifying the password base can include adding words, numbers, symbols, and/or characters at the beginning, end of the password base, or at any location in the password base.
  • modifying the password base may include adjusting the case of the letters included in the password base. Adjusting the case of the letters may include adjusting all letters to uppercase letters and adjusting all letters. Set to lowercase letters, adjust initials to uppercase letters, second and last letters to uppercase letters, and more.
  • modifying the password base may include adding words, numbers, symbols, and/or characters at the beginning, end of the password base, or at any position in the password base, and adjusting The case of the letters contained in the password base.
  • the verification criteria are based on the semantics of the password and/or the purpose of the use, wherein the semantics of the password refer to the meaning of the password.
  • the password is "mypassword” and its semantics is "my password.”
  • the purpose used includes information about the username, the system or service to be logged in, and/or any particular function of the modified password base, so that it is easy to know the system to which the password is applied, thereby preventing people from having the correct password for a system. Enter another system.
  • the password is for a PAKE (Password Authenticated Key Exchange) protocol implementation (SPEKE (Simple Password Encrypted Key Exchange), the SPEKE It is used to connect A to B, so the purpose of the password can be expressed as SPEKE.AB, SPEKE.AtoB, SPEKE-AB, SPEKE-AtoB, SPEKE.AB, SPEKE.A/B and so on.
  • PAKE Password Authenticated Key Exchange
  • SPEKE Simple Password Encrypted Key Exchange
  • the password is for a given PAKE protocol implementation (SPAKE (Simple Password Authenticated Key Exchange), which is used to connect A to B, thus
  • SPAKE Simple Password Authenticated Key Exchange
  • the purpose of the password can be expressed as SPAKE.AB, SPAKE.AtoB, SPAKE-AB, SPAKE-AtoB, SPAKE.AB, SPAKE.A/B, and the like.
  • the password is for a given PAKE protocol implementation Gennaro-Lindell PAKE (GLPAKE), which is used for A is connected to B, and thus the purpose of the password can be expressed as GLPAKE.A.B, GLPAKE.AtoB, GLPAKE-A-B, GLPAKE-AtoB, GLPAKE.A-B, GLPAKE.A/B and the like.
  • GLPAKE Gennaro-Lindell PAKE
  • GLPAKE Gennaro-Lindell PAKE
  • the verification criterion is that the hash value of the combination of the password and the purpose used is within a certain range, such as within the range [A, B].
  • the certain range may be determined according to the actual application, for example, less than 10 -3 of the set of all hash values, assuming that N represents the number of all hash values, then (BA) / N ⁇ 10 -3 .
  • the verification criterion is that the hash value of the combination of the password and the purpose used is a fixed value, such as zero.
  • the verification criterion is that the hash value of the combination of the password base and the used purpose does not exceed the fixed value k, that is, the value range is [0, k].
  • the verification criteria may be embodied in any manner known in the art or known in the future, and the invention is not limited in this respect.
  • the entropy of the password generated according to the technical solution of the disclosure should be greater than the entropy of the general password. Since a part of the entropy of the generated password is used to satisfy the verification criterion, the entropy of the password generated according to the technical solution of the disclosure is necessarily larger than the entropy of the general password.
  • the specific value of entropy should be determined according to the actual application needs. In one embodiment of the invention, modifying the password base is to add three uppercase or lowercase English letters after the password base, whereby the incremental change is approximately 1200, and the increased entropy value is approximately log 2 1200 ⁇ 10.
  • the password base is at least 12 characters, and modifying the password base is to modify any 6 characters in the password base, whereby the added change is about 100000, and the added entropy is roughly log 2 100000 ⁇ 17.
  • Other embodiments are also conceivable by those skilled in the art in light of the teachings of the present disclosure. The invention is not limited in this respect.
  • a password is generated for a given PAKE protocol implementation SPEKE for connecting Alice to Bob.
  • a password base is determined, which consists of 8 letters, symbols and numbers, for example the determined password base is my#$pd12.
  • modify the password base is modified according to the rule of adding a 4-bit random letter at the end of the password base.
  • the password base my#$pd12 can be modified to my#$pd12ABCD, my#$pd12abcd, my. #$pd12ABde and so on.
  • the purpose used is determined to be SPEKE.Alice.Bob, and the published verification criteria are the hash values of the script combined with the modified password base and the purpose used. Less than 2 n-10 , where n is the number of bits of the script hash value, and Script can be a string of modified password bases and the purpose of the purpose.
  • the specific implementation is as follows:
  • a password generating apparatus may include a determining module 201 for determining a password base, the password base referring to basic information included in a password to be generated, and a modifying module 202 for modifying the password base. And modifying the modified password base to meet the disclosed verification criteria, wherein the verification criteria are formulated for screening and verifying the modified password base based on the semantics and/or purpose of the password; and generating module 203 for The modified password base that satisfies the verification criterion is generated as the password.
  • the password generating apparatus first determines the password base by the determining module 201, and then the modifying module 202 modifies the password base and causes the modified password base to satisfy the disclosed verification criteria, which in turn is generated by the generating module 203.
  • the modified password base is generated as a password. Since the verification criterion is public, that is, the public can know the verification criterion, the attacker will make the guessed password satisfy the public verification criterion when performing the system guessing attack, because the The password of the verification criterion is definitely not the correct password, and the probability that the password is wrong or misplaced for the legitimate user to satisfy the verification criterion is extremely small, or even basically impossible, so that the error is satisfied and the school is satisfied.
  • the password of the test criterion is likely to be a system guessing attack by the attacker. Therefore, the password generated by the technical solution of the password generating apparatus according to the exemplary embodiment of the present invention can accurately identify the system guessing attack.
  • the password base can be provided or confirmed by the user, and thus, in one embodiment of the invention, the determination module 201 can be configured to receive a password base from the user. In another embodiment of the invention, the determination module 201 can be configured to randomly generate a password base. In still another embodiment of the present invention, the determining module 201 may be configured to form a password base according to a certain rule, the rule may be, for example, a combination of a 4-bit letter and a 2-digit number, and a password base to be generated. The name of the system to which the password is directed, and so on.
  • the rule may be, for example, that the password base is composed of 8-bit characters, wherein at least a 1-bit symbol, a 2-digit number, and the like are present. It is to be understood that the cryptographic group can be formed in any manner known in the art or known in the future, and the invention is not limited in this respect.
  • the modification module 202 can be configured to add words, numbers, symbols, and/or characters at the beginning, end of the password base, or at any of the locations in the password base.
  • the modification module 202 can be configured to adjust the case of the letters contained in the password base. Adjusting the case of the letters can include adjusting all letters to uppercase letters, and all The letters are adjusted to lowercase letters, the first letter is adjusted to uppercase letters, the second letter and last letter are adjusted to uppercase letters, and so on. It should be understood that the specific manner of adjusting the capitalization of the letters is readily apparent to those skilled in the art, and the invention is not limited in this respect.
  • the modification module can be configured for use in Words, numbers, symbols, and/or characters are added at the beginning, end, or anywhere in the password base, and the case of the letters contained in the password base is adjusted.
  • the verification criteria are based on the semantics of the password and/or the purpose of the use, wherein the semantics of the password refer to the meaning of the password.
  • the password is "mybirthday” and the semantics is "my birthday.”
  • the semantics of the password is "Alice will communicate with Bob via system A”
  • the verification criterion may be hash ("Alice will communicate with Bob via system A", password), where password represents a password.
  • the purpose used includes information about the username, the system or service to be logged in, and/or any particular function of the modified password base, so that it is easy to know the system to which the password is applied, thereby preventing people from having the correct password for a system. Enter another system.
  • the password is for a PAKE (Password Authenticated Key Exchange) protocol implementation (SPEKE (Simple Password Encrypted Key Exchange)), and the SPEKE is used to connect A to B, thus the purpose of the password can be expressed as SPEKE.AB, SPEKE.AtoB, SPEKE-AB, SPEKE-AtoB, SPEKE.AB, SPEKE.A/B and the like.
  • PAKE Password Authenticated Key Exchange
  • SPEKE Simple Password Encrypted Key Exchange
  • the password is for a given PAKE protocol implementation SPAKE (Simple Password Authenticated Key Exchange), the SPAKE is used to connect A to B, and thus the purpose of the password can be expressed as SPAKE.AB, SPAKE.AtoB, SPAKE-AB, SPAKE-AtoB, SPAKE.AB, SPAKE.A/B and so on.
  • SPAKE Simple Password Authenticated Key Exchange
  • the password is for a given PAKE protocol implementation Gennaro-Lindell PAKE (GLPAKE), which is used to connect A to B, so the purpose of the password can be expressed as GLPAKE .AB, GLPAKE.AtoB, GLPAKE-AB, GLPAKE-AtoB, GLPAKE.AB, GLPAKE.A/B and so on.
  • GLPAKE Gennaro-Lindell PAKE
  • the objects used may be embodied in any manner known in the art or in the future, and the invention is not limited in this respect.
  • the verification criterion is that the hash value of the combination of the password and the purpose used is within a certain range, such as within the range [A, B].
  • the certain range may be determined according to the actual application, for example, less than 10 -3 of the set of all hash values, assuming that N represents the number of all hash values, then (BA) / N ⁇ 10 -3 .
  • the verification criterion is that the hash value of the combination of the password and the purpose used is a fixed value, such as zero.
  • the verification criterion is that the hash value of the combination of the password base and the used purpose does not exceed the fixed value k, that is, the value range is [0, k].
  • the verification criteria may be embodied in any manner known in the art or known in the future, and the invention is not limited in this respect.
  • a password verification method is disclosed. As shown in FIG. 3, there is shown a password verification method in accordance with an exemplary embodiment of the present invention.
  • a password verification method according to an exemplary embodiment of the present invention may include:
  • Step S301 receiving an input password
  • Step S302 verify whether the password satisfies the public verification criterion
  • Step S303 In the case that the password satisfies the disclosed verification criterion and is an error, the password is regarded as an attack.
  • the input password is first received, and then it is verified whether the password satisfies the public verification criterion. If the password satisfies the public verification criterion and the password itself is wrong, that is, the password is not the password of the system. , the password is considered an attack. In other words, only the password that satisfies the verification criterion is regarded as an attack, and the password that enters the wrong password in the case of the user's mistake, forgetting the password, etc., is regarded as an attack, so that the attack can be accurately identified.
  • a password verification device is also disclosed.
  • a password verification apparatus in accordance with an exemplary embodiment of the present invention.
  • a password verification apparatus may include: a receiving module 401 configured to receive an input password; and a verification module 402 configured to verify whether the password is The published verification criteria are met; and a decision module 403 is configured to treat the password as an attack if the password satisfies the disclosed verification criteria and is an error.
  • the receiving module 401 of the password verification device can receive the input password, and the verification module 402 verifies the input password, that is, whether the password satisfies the public verification criterion, if the password satisfies the public verification criterion and the password itself is If it is wrong, the judgment module 403 regards the password as an attack.
  • the computing device 500 includes a processor 501 and a memory 502, wherein the memory 502 stores computer program instructions 5020, the computer program instructions The 5020 is adapted to be loaded by the processor 501 and to perform the password generation method described above and/or the password verification method described above. As shown in FIG. 5, the computing device 500 includes a processor 501 and a memory 502, wherein the memory 502 stores computer program instructions 5020, the computer program instructions The 5020 is adapted to be loaded by the processor 501 and to perform the password generation method described above and/or the password verification method described above. As shown in FIG.
  • the password generating method may include: step S101: determining a password base, the password base refers to basic information included in the password to be generated; and step S102: modifying the password base and modifying the password
  • the password base satisfies the disclosed verification criteria, wherein the verification criteria are formulated for screening and verifying the modified password base based on the semantics of the password and/or the purpose used; and step S103: the verification criteria will be met
  • the modified password base is generated as the password. Since the technical solution of the password generation method has been described in detail above, it will not be described again. In addition, the password verification method has been described in detail above, and details are not described herein again.
  • the processor executes the password generation method and/or password verification method as described above. Since the technical solutions of the password generation method and the password verification method have been described in detail above, they will not be described again.
  • a computer readable storage medium is a tangible component of a digital processing device.
  • the computer readable storage medium is optionally removable from the digital processing device.
  • the computer readable storage medium may include a USB flash drive, a removable hard disk, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • flash memory programmable memory (PROM), erasable programmable memory (EPROM), solid state memory, disk, optical disk, cloud computing system or service.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

一种口令生成方法和装置以及口令校验方法和装置。该口令生成方法包括确定口令基（S101），所述口令基是指要生成的口令所包含的基本信息；修改所述口令基，并使经修改的口令基满足公开的校验准则（S102），其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修改的口令基；以及将满足所述校验准则的所述经修改的口令基作为所述口令生成（S103）。依据所述口令生成方法和装置的技术方案所生成的口令能够容易识别出系统猜测攻击。

Description

口令生成方法和装置以及口令校验方法和装置
相关申请的交叉引用
本公开内容要求于2017年07月07日提交的发明名称为“口令生成方法和装置以及口令校验方法和装置”并且申请号为201710553163.6的中国专利申请的优先权，其全部内容通过引用结合于此。
技术领域
本发明涉及密码学技术领域，尤其涉及一种口令生成方法和装置以及口令校验方法和装置。
背景技术
随着计算机技术、网络技术的飞速发展，信息安全问题越来越引起了人们的广泛关注。如何确保安全通信是当今密码学技术领域的主要关注点。为了在两个节点之间实现安全通信，通常需要进行身份认证和密钥交换。身份认证就是对用户身份的认证，其通常通过口令来实现，也即进行口令认证。另外，在登录网站、电子邮箱以及各种网上应用等时常常需要输入口令。然而，人们有时会不可避免地记错、混淆或者敲错口令。由于当前应用众多，登录应用所用的口令也就很多。为了便于记忆和管理，有些人会将同一个口令应用于多个应用或账号，即，这多个应用或账号共用同一个口令，这样往往会削弱用户自己的安全性，而且也会削弱用户所使用的系统的安全性。因此，优选还是每个应用或账号使用其唯一口令。
然而，在每个应用或账号具有其唯一口令时，会造成口令众多，人们记错、混淆或敲错口令的概率也就会增大。这样就很难区分出哪次输错的口令是用户人为错误，哪次输错的口令是系统猜测攻击。因而需要一种能够精准识别出系统猜测攻击的口令生成方法和装置。
发明内容
鉴于上述技术问题，提供了一种能够精准识别出系统猜测攻击的口令生成方法和装置以及口令校验方法和装置。
依据本发明的一个方面，提供了一种口令生成方法，其包括确定口令基，所述口令基是指要生成的口令所包含的基本信息；修改所述口令基，并使经修改的口令基满足公开的校验准则，其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修改的口令基；以及将满足所述校验准则的所述经修改的口令基作为所述口令生成。
在一些实施方式中，所述所用目的可以包含关于用户名、要登录的系统或服务和/或所述口令的任何特定功能的信息。
在一些实施方式中，所述校验准则可以是所述口令与所述所用目的的组合的哈希值在一定范围内。
在一些实施方式中，所述校验准则可以是所述口令与所述所用目的的组合的哈希值为固定值。
在一些实施方式中，所述修改口令基可以包括在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符。
在一些实施方式中，所述修改口令基可以包括调整所述口令基中所包含的字母的大小写。
在一些实施方式中，所述修改口令基可以包括在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符，并且调整所述口令基中所包含的字母的大小写。
依据本发明的另一方面，提供了一种口令生成装置，其包括确定模块，用于确定口令基，所述口令基是指要生成的口令所包含的基本信息；修改模块，用于修改所述口令基，并使经修改的口令基满足公开的校验准则，其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修 改的口令基；以及生成模块，用于将满足所述校验准则的所述经修改的口令基作为所述口令生成。
在一些实施方式中，所述所用目的可以包含关于用户名、要登录的系统或服务和/或所述口令的任何特定功能的信息。
在一些实施方式中，所述校验准则可以是所述口令与所述所用目的的组合的哈希值在一定范围内。
在一些实施方式中，所述校验准则可以是所述口令与所述所用目的的组合的哈希值为固定值。
在一些实施方式中，所述修改模块可以进一步用于在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符。
在一些实施方式中，所述修改模块可以进一步用于调整所述口令基中所包含的字母的大小写。
在一些实施方式中，所述修改模块可以进一步用于在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符，并且调整所述口令基中所包含的字母的大小写。
在本发明的另一方面，提供了一种口令校验方法，该口令校验方法可以包括：接收输入的口令；验证所述口令是否满足公开的校验准则；以及在所述口令满足所述公开的校验准则并且是错误的情况下，将所述口令视为攻击。
在本发明的另一方面，提供了一种口令校验装置，该口令校验装置可以包括：接收模块，其被配置用于接收输入的口令；验证模块，其被配置用于验证所述口令是否满足公开的校验准则；以及判定模块，其被配置用于在所述口令满足所述公开的校验准则并且是错误的情况下，将所述口令视为攻击。
在本发明的又一方面，提供了一种计算设备，该计算设备包括处理器和存储器，其中所述存储器上存储有计算机程序指令，所述计算机程序指令适于由所述处理器加载并执行上文所描述的口令生成方法和/或口令校验方法。
在本发明的再一方面，提供了一种计算机可读存储介质，在该计算机可读存储介质上存储有计算机程序指令，其中所述计算机程序指令在由处理器执行时实现上文所描述的口令生成方法和/或口令校验方法。
与现有技术相比，本公开内容的有益效果为：
首先，由于依据本发明示例性实施方式的口令生成方法和装置对口令基进行修改并使经修改的口令基满足公开校验准则，然后将满足该校验准则的经修改的口令基作为口令生成，又由于校验准则是公开的，因而攻击者在进行系统猜测攻击时会使其猜测的口令满足这一公开的校验准则，而对于合法用户而言其记错或错输的口令满足该校验准则的概率极其微小，甚至基本上是不可能的，因此错误且又满足该校验准则的口令极大可能就是攻击者所进行的系统猜测攻击，故此利用依据本发明示例性实施方式的口令生成方法和装置的技术方案所生成的口令能够容易识别出系统猜测攻击。
其次，由于依据本发明示例性实施方式的口令生成方法和装置中所涉及的校验准则是根据口令的语义和/或所用目的而制定的，所用目的进而还可以包含关于用户名、要登录的系统或服务和/或口令的任何特定功能的信息，因此各系统之间的口令不兼容，即一个系统的正确口令是不能满足另一个系统的口令所需满足的校验准则的，从而能够防止人们将一个系统的正确口令输入另一个系统。
再者，校验准则是公开的。系统猜测攻击需要首先验证一个猜测的口令是否满足校验准则。因此，通过提升校验准则的时间复杂度，可以增加系统猜测攻击的时间消耗，增强系统的安全性。
此外，在口令认证密钥交换(PAKE，Password Authenticated Key Exchange)协议中，很可能把单次口令错误作为攻击处理，而本公开内容的技术方案将此限制为满足校验准则的单次口令错误。因此本公开内容的技术方案在诸如PAKE等应用中特别有价值。
另外，在分布式环境中，口令满足公开的校验准则的校验本身可以是分布式的，而不是在中心口令数据库上对口令进行校验，从而使得分布式拒绝服务(DDOS)攻击更困难。
附图说明
在所附权利要求书中具体阐述了本发明的新颖特征。通过参考对在其中利用到本发明原理的说明性实施方式加以阐述的以下详细描述和附图，将会对本发明的特征和优点获得更好的理解。附图仅用于示出实施方式的目的，而并不应当被认为是对本发明的限制。而且在整个附图中，用相同的附图标记表示相同的元素。在附图中：
图1是依据本发明示例性实施方式的口令生成方法的流程图；
图2是依据本发明示例性实施方式的口令生成装置的示意图；
图3是依据本发明示例性实施方式的口令校验方法的流程图；
图4是依据本发明示例性实施方式的口令校验装置的示意图；以及
图5是依据本发明示例性实施方式的计算设备的示意图。
具体实施方式
下面将参照附图更详细地描述本公开内容的示例性实施方式。虽然附图中显示了本公开内容的示例性实施方式，然而应当理解，可以以各种形式实现本公开内容而不应被这里阐述的实施方式所限制。相反，提供这些实施方式是为了能够更透彻地理解本公开内容，并且能够将本公开内容的范围完整地传达给本领域技术人员。在以下详细描述中没有任何内容旨在表明任何特定组件、特征或步骤对于本发明是必不可少的。本领域技术人员将会理解，各种特征或步骤可以彼此替代或结合。
如图1所示，其示出了依据本发明示例性实施方式的口令生成方法的流程图。在图1中，依据本发明示例性实施方式的口令生成方法可以包括：
步骤S101：确定口令基，所述口令基是指要生成的口令所包含的基本信息；
步骤S102：修改所述口令基并使经修改的口令基满足公开的校验准则，其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修改的口令基；以及
步骤S103：将满足所述校验准则的所述经修改的口令基作为所述口令生成。
由上述可知，依据本发明示例性实施方式的口令生成方法首先是确定口令基，然后对口令基进行修改并使经修改的口令基满足公开的校验准则，继而将该经修改的口令基作为口令生成。由于校验准则是公开的，即，公众是可获知该校验准则的，因而攻击者在进行系统猜测攻击时会使其猜测的口令满足这一公开的校验准则，这是因为不满足该校验准则的口令肯定不是正确的口令，而对于合法用户而言其记错或错输的口令满足该校验准则的概率极其微小，甚至基本上是不可能的，因此错误且又满足该校验准则的口令极大可能就是攻击者所进行的系统猜测攻击，故此利用依据本发明示例性实施方式的口令生成方法的技术方案所生成的口令能够精准识别出系统猜测攻击。
所述口令基可以由用户提供或确认，因此，在本发明的一个实施方式中，步骤S101确定口令基可以包括从用户接收口令基。在本发明的另一实施方式中，步骤S101确定口令基可以包括随机生成口令基。在本发明的又一实施方式中，步骤S101确定口令基可以包括根据一定规则形成口令基，所述规则例如可以是口令基为4位字母和2位数字的组合、口令基为要生成的口令所针对的系统名称等等。在本发明的再一个实施方式中，所述规则例如可以是口令基由8位字符构成，其中至少存在1位符号和2位数字等等。可以理解，口令基可以采用本领域已知或者将来可知的任何方式来形成，本发明在此方面并不进行限制。
再参见图1，依据本发明示例性实施方式的口令生成方法对口令基进行修改并使经修改的口令基满足公开的校验准则，在本发明的一个实施方式中， 修改口令基可以包括在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符。在本发明的另一实施方式中，修改口令基可以包括调整所述口令基中所包含的字母的大小写，调整字母的大小写可以包括将所有字母都调整为大写字母、将所有字母都调整为小写字母、将首字母调整为大写字母、将第二个字母和最后一个字母调整为大写字母等等。应当理解，调整字母的大小写的具体方式是本领域技术人员容易想到的，本发明在此方面不作限制。在本发明的又一实施方式中，修改口令基可以包括在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符，并且调整所述口令基中所包含的字母的大小写。
依据本公开内容可知，校验准则是根据口令的语义和/或所用目的制定的，其中口令的语义是指口令所具有的含义。例如，在本发明的一个实施方式中，口令为“mypassword”，其语义为“我的口令”。所用目的包含关于用户名、要登录的系统或服务和/或所述经修改的口令基的任何特定功能的信息，因而容易知道口令所应用于的系统，从而能够防止人们将一个系统的正确口令输入另一个系统。
在本发明的一个实施方式中，口令是针对一个给定口令认证密钥交换(PAKE，Password Authenticated Key Exchange)协议实现方式SPEKE(Simple Password Encrypted Key Exchange，简单口令加密密钥交换)的，该SPEKE是用于将A连接到B，因而该口令的所用目的可以表示为SPEKE.A.B，SPEKE.AtoB，SPEKE-A-B，SPEKE-AtoB，SPEKE.A-B，SPEKE.A/B等等。在本发明的另一实施方式中，口令是针对一个给定PAKE协议实现方式SPAKE(Simple Password Authenticated Key Exchange，简单口令认证密钥交换)的，该SPAKE是用于将A连接到B，因而该口令的所用目的可以表示为SPAKE.A.B，SPAKE.AtoB，SPAKE-A-B，SPAKE-AtoB，SPAKE.A-B，SPAKE.A/B等等。在本发明的又一实施方式中，口令是针对一个给定PAKE协议实现方式Gennaro-Lindell PAKE(GLPAKE)的，该GLPAKE是用于将 A连接到B，因而该口令的所用目的可以表示为GLPAKE.A.B，GLPAKE.AtoB，GLPAKE-A-B，GLPAKE-AtoB，GLPAKE.A-B，GLPAKE.A/B等等。本领域技术人员应当理解，所用目的可以采用本领域已知或者将来可知的任何方式来体现，本发明在此方面并不进行限制。
在本发明的一个实施方式中，校验准则是口令与所用目的的组合的哈希值在一定范围内，例如在范围[A,B]内。所述一定范围可以根据实际应用情况而定，例如少于所有哈希值的集合的10-3，假定N表示所有的哈希值个数，则(B-A)/N<10-3。在本发明的另一实施方式中，校验准则是口令与所用目的的组合的哈希值为固定值，例如为0。在本发明的又一实施方式中，校验准则是口令基和所用目的的组合的哈希值不超过固定值k，即取值范围为[0,k]。本领域技术人员应当理解，校验准则可以采用本领域已知或者将来可知的任何方式来体现，本发明在此方面并不进行限制。
我们知道口令的被击破难度依赖于口令的不确定性，该不确定性与其提供给攻击者的信息量大小有直接的关系。口令提供的信息量越大，其不确定性就越小，越容易被击破；反之，口令提供的信息量越小，其不确定性就越大，也就越难被击破。1948年，信息论之父美国克劳德·香农提出了“熵”的概念，解决了对信息的量化度量问题。对于一个口令而言，熵越大，其不确定性就越大，也就越难被击破。
为了难于被击破，依据公开内容的技术方案所生成的口令的熵应当大于一般口令的熵。由于所生成的口令的一部分熵被用于满足校验准则，因此依据公开内容的技术方案所生成的口令的熵必然比一般口令的熵大。对于熵的具体取值应根据实际应用需求而定。在本发明的一个实施方式中，修改口令基是在口令基后添加三个大写或小写英文字母，由此增加的变化大概为1200，那么所增加的熵值大致为log21200≈10。在本发明的另一实施方式中，口令基是至少12个字符，修改口令基是修改口令基中的任意6个字符，由此增加的变化大约为100000，那么所增加的熵大致为log2100000≈17。本领域技术人 员根据本公开内容的教导还可以想到其他实施方式，本发明在此方面并不进行限制。
下面通过具体示例来详细描述依据本发明示例性实施方式的口令生成方法的技术方案。在本示例中，要为一个给定PAKE协议实现方式SPEKE生成口令，用于将Alice连接到Bob。首先，确定口令基，该口令基由8个字母、符号和数字组成，例如所确定的口令基为my#$pd12。接着修改口令基，在本示例中按照在口令基结尾处添加4位随机字母的规则来修改口令基，例如，可以将口令基my#$pd12修改为my#$pd12ABCD、my#$pd12abcd、my#$pd12ABde等等。由于本示例应用情景的目的是将Alice连接到Bob，因此将所用目的确定为SPEKE.Alice.Bob，并且公开的校验准则是经修改的口令基和所用目的组合而成的Script的哈希值小于2n-10,其中n是Script哈希值的比特数，Script可以是经修改的口令基与所用目的拼接而成的字符串。在本例中，具体实现如下：
(a)随机生成了4位字母，例如为pske，则得到的经修改的口令基为my#$pd12pske；
(b)计算哈希值x＝hash(Script(“my#$pd12pske”，“SPEKE.Alice.Bob”))；以及
(c)如果x<2n-10,则my#$pd12pske为满足公开的校验准则的经修改的口令基，此时可以将其输出作为用户的口令；否则，重复(a)-(c)操作直到找到满足校验准则的经修改的口令基为止。
如图2所示，其示出了依据本发明示例性实施方式的口令生成装置的示意图。在图2中，一种口令生成装置可以包括确定模块201，用于确定口令基，所述口令基是指要生成的口令所包含的基本信息；修改模块202，用于修改所述口令基，并使经修改的口令基满足公开的校验准则，其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修改的口令基；以及生成模块203，用于将满足所述校验准则的所述经修改的口令基作为所述口令生成。
依据本发明示例性实施方式的口令生成装置首先是由确定模块201确定口令基，然后修改模块202对口令基进行修改并使经修改的口令基满足公开的校验准则，继而由生成模块203将该经修改的口令基作为口令生成。由于校验准则是公开的，即，公众是可获知该校验准则的，因而攻击者在进行系统猜测攻击时会使其猜测的口令满足这一公开的校验准则，这是因为不满足该校验准则的口令肯定不是正确的口令，而对于合法用户而言其记错或错输的口令满足该校验准则的概率极其微小，甚至基本上是不可能的，因此错误且又满足该校验准则的口令极大可能就是攻击者所进行的系统猜测攻击，故此利用依据本发明示例性实施方式的口令生成装置的技术方案所生成的口令能够精准识别出系统猜测攻击。
所述口令基可以由用户提供或确认，因此，在本发明的一个实施方式中，确定模块201可以被配置用于从用户接收口令基。在本发明的另一实施方式中，确定模块201可以被配置用于随机生成口令基。在本发明的又一实施方式中，确定模块201可以被配置用于根据一定规则形成口令基，所述规则例如可以是口令基为4位字母和2位数字的组合、口令基为要生成的口令所针对的系统名称等等。在本发明的再一个实施方式中，所述规则例如可以是口令基由8位字符构成，其中至少存在1位符号和2位数字等等。可以理解，口令基可以采用本领域已知或者将来可知的任何方式来形成，本发明在此方面并不进行限制。
在本发明的一个实施方式中，修改模块202可以被配置用于在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符。在本发明的另一实施方式中，修改模块202可以被配置用于调整所述口令基中所包含的字母的大小写，调整字母的大小写可以包括将所有字母都调整为大写字母、将所有字母都调整为小写字母、将首字母调整为大写字母、将第二个字母和最后一个字母调整为大写字母等等。应当理解，调整字母的大小写的具体方式是本领域技术人员容易想到的，本发明在此方面并不进行限制。在本发明的又一实施方式中，修改模块可以被配置用于在所 述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符，并且调整所述口令基中所包含的字母的大小写。
依据本公开内容可知，校验准则是根据口令的语义和/或所用目的制定的，其中口令的语义是指口令所具有的含义。例如，在本发明的一个实施方式中，口令为“mybirthday”，其语义为“我的生日”。在另一实施方式中，口令的语义为“Alice will communicate with Bob via system A”，则校验准则可以为hash(“Alice will communicate with Bob via system A”，password)，其中password表示口令。所用目的包含关于用户名、要登录的系统或服务和/或所述经修改的口令基的任何特定功能的信息，因而容易知道口令所应用于的系统，从而能够防止人们将一个系统的正确口令输入另一个系统。
在本发明的一个实施方式中，口令是针对一个给定口令认证密钥交换(PAKE，Password Authenticated Key Exchange)协议实现方式SPEKE(Simple Password Encrypted Key Exchange)的，该SPEKE是用于将A连接到B，因而该口令的所用目的可以表示为SPEKE.A.B，SPEKE.AtoB，SPEKE-A-B，SPEKE-AtoB，SPEKE.A-B，SPEKE.A/B等等。在本发明的另一实施方式中，口令是针对一个给定PAKE协议实现方式SPAKE(Simple Password Authenticated Key Exchange)的，该SPAKE是用于将A连接到B，因而该口令的所用目的可以表示为SPAKE.A.B，SPAKE.AtoB，SPAKE-A-B，SPAKE-AtoB，SPAKE.A-B，SPAKE.A/B等等。在本发明的又一实施方式中，口令是针对一个给定PAKE协议实现方式Gennaro-Lindell PAKE(GLPAKE)的，该GLPAKE是用于将A连接到B，因而该口令的所用目的可以表示为GLPAKE.A.B，GLPAKE.AtoB，GLPAKE-A-B，GLPAKE-AtoB，GLPAKE.A-B，GLPAKE.A/B等等。本领域技术人员应当理解，所用目的可以采用本领域已知或者将来可知的任何方式来体现，本发明在此方面并不进行限制。
在本发明的一个实施方式中，校验准则是口令与所用目的的组合的哈希值在一定范围内，例如在范围[A,B]内。所述一定范围可以根据实际应用情况而定，例如少于所有哈希值的集合的10-3，假定N表示所有的哈希值个数， 则(B-A)/N<10-3。在本发明的另一实施方式中，校验准则是口令与所用目的的组合的哈希值为固定值，例如为0。在本发明的又一实施方式中，校验准则是口令基和所用目的的组合的哈希值不超过固定值k，即取值范围为[0,k]。本领域技术人员应当理解，校验准则可以采用本领域已知或者将来可知的任何方式来体现，本发明在此方面并不进行限制。
在本公开内容的一个方面，公开了一种口令校验方法。如图3所示，其示出了依据本发明示例性实施方式的口令校验方法。在图3中，依据本发明示例性实施方式的一种口令校验方法可以包括：
步骤S301：接收输入的口令；
步骤S302：验证所述口令是否满足公开的校验准则；以及
步骤S303：在所述口令满足所述公开的校验准则并且是错误的情况下，将所述口令视为攻击。
由此可知，首先接收到输入的口令，然后验证该口令是否满足公开的校验准则，如果口令满足公开的校验准则并且该口令本身是错误的，也就是说该口令不是所针对系统的口令，则将该口令视为攻击。换言之，即只将满足校验准则的输错的口令视为是攻击，而不会将用户记错、忘记口令等情形输入错误的口令视为攻击，从而可以精准地识别出攻击。
在本公开内容的另一方面，还公开了一种口令校验装置。如图4所示，其示出了依据本发明示例性实施方式的口令校验装置。在图4中，依据本发明示例性实施方式的一种口令校验装置可以包括：接收模块401，其被配置用于接收输入的口令；验证模块402，其被配置用于验证所述口令是否满足公开的校验准则；以及判定模块403，其被配置用于在所述口令满足所述公开的校验准则并且是错误的情况下，将所述口令视为攻击。该口令校验装置的接收模块401可以接收输入的口令，由验证模块402对输入的口令进行验证，即验证该口令是否满足公开的校验准则，如果口令满足公开的校验准则并且口令本身是错误的，则判断模块403将该口令视为攻击。
在公开内容的一个方面还公开了一种计算设备，如图5所示，该计算设备500包括处理器501和存储器502，其中所述存储器502上存储有计算机程序指令5020，所述计算机程序指令5020适于由所述处理器501加载并执行上文所描述的口令生成方法和/或上文所描述的口令校验方法。再如图1所示，该口令生成方法可以包括：步骤S101：确定口令基，所述口令基是指要生成的口令所包含的基本信息；步骤S102：修改所述口令基并使经修改的口令基满足公开的校验准则，其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修改的口令基；以及步骤S103：将满足所述校验准则的所述经修改的口令基作为所述口令生成。由于上文已经详细描述了口令生成方法的技术方案，因此不再赘述。另外，口令校验方法在上文也已详细描述，在此不再赘述。
在本公开内容的另一方面，还提供了一种计算机可读存储介质，在该计算机可读存储介质上存储有计算机程序指令，其中所述计算机程序指令在由
处理器执行时实现如上文所描述的口令生成方法和/或口令校验方法。由于上文已经详细描述了口令生成方法和口令校验方法的技术方案，因此不再赘述。
在一些实施方式中，计算机可读存储介质是数字处理设备的有形组件。在另一些实施方式中，计算机可读存储介质可选地是可从数字处理设备移除的。在一些实施方式中，举非限制性示例而言，计算机可读存储介质可以包括U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、闪速存储器、可编程存储器(PROM)、可擦除可编程存储器(EPROM)、固态存储器、磁碟、光盘、云计算系统或服务等。
在本文所提供的说明书中，说明了大量具体细节。然而，应当理解，本公开内容的实施方式可以在没有这些具体细节的情况下实践。在一些实施方式中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
本领域技术人员应当理解，本公开内容中所记载的各个步骤可以按照不同的顺序执行，和/或并行执行。此外，方法实施方式可以包括附加的步骤和/或省略执行示出的步骤，本发明的范围在此方面不受限制。
虽然本文已经示出和描述了本发明的优选实施方式，但对于本领域技术人员显而易见的是，这样的实施方式只是以示例的方式提供的。本领域技术人员现将会在不偏离本发明的情况下想到许多更改、改变和替代。应当理解，在实践本发明的过程中可以采用对本文所描述的本发明实施方式的各种替代方案。以下权利要求旨在限定本发明的范围，并因此覆盖这些权利要求范围内的方法和结构及其等同项。

Claims (18)

  1. 一种口令生成方法，其包括：
    确定口令基，所述口令基是指要生成的口令所包含的基本信息；
    修改所述口令基，并使经修改的口令基满足公开的校验准则，其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修改的口令基；以及
    将满足所述校验准则的所述经修改的口令基作为所述口令生成。
  2. 如权利要求1所述的口令生成方法，其中所述所用目的包含关于用户名、要登录的系统或服务和/或所述口令的任何特定功能的信息。
  3. 如权利要求2所述的口令生成方法，其中所述校验准则是所述口令与所述所用目的的组合的哈希值在一定范围内。
  4. 如权利要求2所述的口令生成方法，其中所述校验准则是所述口令与所述所用目的的组合的哈希值为固定值。
  5. 如权利要求1至4中任一项所述的口令生成方法，其中所述修改口令基包括在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符。
  6. 如权利要求1至4中任一项所述的口令生成方法，其中所述修改口令基包括调整所述口令基中所包含的字母的大小写。
  7. 如权利要求1至4中任一项所述的口令生成方法，其中所述修改口令基包括在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符，并且调整所述口令基中所包含的字母的大小写。
  8. 一种口令生成装置，其包括：
    确定模块，用于确定口令基，所述口令基是指要生成的口令所包含的基本信息；
    修改模块，用于修改所述口令基，并使经修改的口令基满足公开的校验准则，其中所述校验准则是根据口令的语义和/或所用目的制定用于筛选和验证所述经修改的口令基；以及
    生成模块，用于将满足所述校验准则的所述经修改的口令基作为所述口令生成。
  9. 如权利要求8所述的口令生成装置，其中所述所用目的包含关于用户名、要登录的系统或服务和/或所述口令的任何特定功能的信息。
  10. 如权利要求9所述的口令生成装置，其中所述校验准则是所述口令与所述所用目的的组合的哈希值在一定范围内。
  11. 如权利要求9所述的口令生成装置，其中所述校验准则是所述口令与所述所用目的的组合的哈希值为固定值。
  12. 如权利要求8至11中任一项所述的口令生成装置，其中所述修改模块进一步用于在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符。
  13. 如权利要求8至11中任一项所述的口令生成装置，其中所述修改模块进一步用于调整所述口令基中所包含的字母的大小写。
  14. 如权利要求8至11中任一项所述的口令生成装置，其中所述修改模块进一步用于在所述口令基的开始处、结尾处或者在所述口令基中的任何位置处添加词语、数字、符号和/或字符，并且调整所述口令基中所包含的字母的大小写。
  15. 一种口令校验方法，其包括：
    接收输入的口令；
    验证所述口令是否满足公开的校验准则；以及
    在所述口令满足所述公开的校验准则并且是错误的情况下，将所述口令视为攻击。
  16. 一种口令校验装置，其包括：
    接收模块，其用于接收输入的口令；
    验证模块，其用于验证所述口令是否满足公开的校验准则；以及
    判定模块，其用于在所述口令满足所述公开的校验准则并且是错误的情况下，将所述口令视为攻击。
  17. 一种计算设备，其包括处理器和存储器，其中所述存储器上存储有计算机程序指令，所述计算机程序指令适于由所述处理器加载并执行如权利要求1至7中任一项所述的口令生成方法和/或如权利要求15所述的口令校验方法。
  18. 一种计算机可读存储介质，其上存储有计算机程序指令，其中所述计算机程序指令在由处理器执行时实现如权利要求1至7中任一项所述的口令生成方法和/或如权利要求15所述的口令校验方法。
PCT/CN2017/100683 2017-07-07 2017-09-06 口令生成方法和装置以及口令校验方法和装置 WO2019006848A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710553163 2017-07-07
CN201710553163.6 2017-07-07

Publications (1)

Publication Number Publication Date
WO2019006848A1 true WO2019006848A1 (zh) 2019-01-10

Family

ID=64950442

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/100683 WO2019006848A1 (zh) 2017-07-07 2017-09-06 口令生成方法和装置以及口令校验方法和装置

Country Status (1)

Country Link
WO (1) WO2019006848A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11914698B2 (en) 2021-08-25 2024-02-27 Kyndryl, Inc. Unique password policy creation

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020184217A1 (en) * 2001-04-19 2002-12-05 Bisbee Stephen F. Systems and methods for state-less authentication
CN101188495A (zh) * 2007-12-04 2008-05-28 魏恺言 一种实现强口令认证方式的安全系统及方法
CN101420298A (zh) * 2008-09-08 2009-04-29 北京飞天诚信科技有限公司 协商密钥的方法和系统
CN101667917A (zh) * 2009-09-28 2010-03-10 张师祝 一种动态口令输入规则
CN105096128A (zh) * 2014-05-05 2015-11-25 胡宗锋 一种身份码辅以验证口令的商品防伪方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020184217A1 (en) * 2001-04-19 2002-12-05 Bisbee Stephen F. Systems and methods for state-less authentication
CN101188495A (zh) * 2007-12-04 2008-05-28 魏恺言 一种实现强口令认证方式的安全系统及方法
CN101420298A (zh) * 2008-09-08 2009-04-29 北京飞天诚信科技有限公司 协商密钥的方法和系统
CN101667917A (zh) * 2009-09-28 2010-03-10 张师祝 一种动态口令输入规则
CN105096128A (zh) * 2014-05-05 2015-11-25 胡宗锋 一种身份码辅以验证口令的商品防伪方法及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11914698B2 (en) 2021-08-25 2024-02-27 Kyndryl, Inc. Unique password policy creation

Similar Documents

Publication Publication Date Title
CN109417553B (zh) 经由内部网络监视来检测使用泄漏证书的攻击
JP6701364B2 (ja) パスワードなしのコンピュータログインのサービス支援モバイルペアリングのためのシステム及び方法
US10574648B2 (en) Methods and systems for user authentication
US11336641B2 (en) Security enhanced technique of authentication protocol based on trusted execution environment
EP3466024B1 (en) Distinguishing vertical brute force attacks from benign errors
US11122047B2 (en) Invitation links with enhanced protection
Kontaxis et al. Sauth: Protecting user accounts from password database leaks
US10320848B2 (en) Smart lockout
US9673979B1 (en) Hierarchical, deterministic, one-time login tokens
JP2017517200A (ja) パスワードベース認証
US10897353B2 (en) Computer-implemented method for generating passwords and computer program products of same
US9935940B1 (en) Password security
CN104683354A (zh) 一种基于标识的动态口令系统
US9202038B1 (en) Risk based authentication
US20220286446A1 (en) Authentication credential with embedded authentication information
CN111382422B (zh) 在非法访问用户数据的威胁下更改账户记录的密码的系统和方法
EP3977703A1 (en) Protection of online applications and webpages using a blockchain
Al Kabir et al. An overview of the present and future of user authentication
Mandlekar et al. Survey on fog computing mitigating data theft attacks in cloud
US11159566B2 (en) Countering phishing attacks
WO2019006848A1 (zh) 口令生成方法和装置以及口令校验方法和装置
KR20150104667A (ko) 인증 방법
Singh et al. Lightweight cryptography approach for multifactor authentication in internet of things
Nam et al. On the Security of a Simple Three‐Party Key Exchange Protocol without Server’s Public Keys
US11652705B1 (en) Access control for network services

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17916677

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17916677

Country of ref document: EP

Kind code of ref document: A1