WO2020206909A1

WO2020206909A1 - Method and apparatus for calculating password strength, and computer-readable storage medium

Info

Publication number: WO2020206909A1
Application number: PCT/CN2019/102812
Authority: WO
Inventors: 徐凌智; 王健宗
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-04-08
Filing date: 2019-08-27
Publication date: 2020-10-15
Also published as: CN110110518B; CN110110518A

Abstract

A method for calculating password strength, comprising: collecting real passwords leaked from a network and a preset type of virtual passwords, and estimating and calculating leakage parameters of the real passwords and virtual passwords by means of a preset first leakage parameter probability analysis model (S1); performing structural analysis on the real passwords and the virtual passwords, and constructing a second leakage parameter analysis model according to the structures of the real passwords and the virtual passwords and the calculated leakage parameters (S2); randomly generating a batch of passwords, and using the second leakage parameter analysis model to calculate leakage parameters of the randomly generated batch of passwords (S3); and using a preset password strength calculation model and the leakage parameters of the randomly generated batch of passwords to calculate a password strength value of a password to be evaluated that is inputted by a user (S4).

Description

Password strength calculation method, device and computer readable storage medium

Based on the Paris Convention, this application declares that it enjoys the priority of the Chinese patent application filed on April 8, 2019 with the application number CN 201910274077.0 and titled "Password Strength Calculation Method, Device and Computer-readable Storage Medium" The whole content is incorporated in this application by reference.

Technical field

This application relates to the field of security technology, and in particular to a method, device and computer-readable storage medium for calculating password strength.

Background technique

Password is one of the most important security authentication methods in current Internet applications. The strength of the password determines the security of user accounts and systems. Since weak passwords are easy to recover from encrypted files, in order to prompt users to choose a stronger password, a common method is to introduce a password strength meter (Strength Meter).

At present, the influencing factors of the password strength value are divided into positive plus points and negative plus points. The bonus items include length, numbers, uppercase and lowercase letters, special symbols, etc. Each factor is assigned a different weight, and the deduction items are: Whether it is a pure number, a pure letter, whether there are repeated symbols, etc., and assign different weights to each factor, and finally the scores of the two factors are simply added and subtracted to obtain the strength value of the password, the larger the value indicates its strength Higher. However, the method of this type of evaluation tool is very simple, with few parameters, and a password with a password strength value of "strong" can not resist dictionary attacks only by simple rules of password characters.

Summary of the invention

This application provides a password strength calculation method, device, and computer-readable storage medium, the main purpose of which is to present accurate calculation results to the user when the user is performing the password strength calculation.

In order to achieve the above objectives, the password strength calculation method provided by this application includes:

Collect real passwords leaked from the network and preset types of virtual passwords, and calculate the leak parameters of the real passwords and virtual passwords through a preset first leak parameter analysis model, where the real passwords include letters, numbers and/or symbols, And the virtual password includes pure letters, pure letters or pure symbols;

Perform structural analysis on the real password and the virtual password, and construct a second leakage parameter analysis model based on the structure of the real password and the virtual password and the calculated leakage parameters;

Randomly generating a batch of passwords, using the second leakage parameter analysis model to calculate the leakage parameters of the randomly generated batch of passwords;

Using a preset password strength calculation model and the leakage parameters of a batch of randomly generated passwords, the password strength value of the password to be analyzed input by the user is calculated.

In addition, in order to achieve the above objective, the present application also provides a password strength calculation device, which includes a memory and a processor, and a password strength calculation program that can be run on the processor is stored in the memory. The following steps are implemented when the calculation program is executed by the processor:

In addition, in order to achieve the above object, the present application also provides a computer-readable storage medium having a password strength calculation program stored on the computer-readable storage medium, and the password strength calculation program can be executed by one or more processors, To achieve the steps of the password strength calculation method described above.

The password strength calculation method, device and computer readable storage medium proposed in this application, when a user evaluates the strength of a password, calculate the leakage parameters of the password to be analyzed by the user according to the preset first leakage parameter analysis model, and use the password The strength calculation model calculates the strength of the user's password to be analyzed, so that the user can present accurate calculation results.

Description of the drawings

FIG. 1 is a schematic flowchart of a password strength calculation method provided by an embodiment of this application;

2 is a schematic diagram of the internal structure of a password strength calculation device provided by an embodiment of the application;

Fig. 3 is a schematic diagram of modules of a password strength calculation program in a password strength calculation device provided by an embodiment of the application.

FIG. 4 is a schematic diagram of the generation process of the second leakage parameter analysis model in the password strength calculation method provided by an embodiment of the application.

The realization, functional characteristics, and advantages of the purpose of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

detailed description

It should be understood that the specific embodiments described here are only used to explain the application, and are not used to limit the application.

This application provides a method for calculating password strength. Referring to FIG. 1, it is a schematic flowchart of a password strength calculation method provided by an embodiment of this application. The method can be executed by a device, and the device can be implemented by software and/or hardware.

In this embodiment, the password strength calculation method includes:

S1. Collect real passwords leaked from the network and preset types of virtual passwords, and calculate the leak parameters of the real passwords and virtual passwords through a preset first leak parameter analysis model.

In a preferred embodiment of this application, the password is also referred to as a plaintext password which refers to a text or string that is not encrypted. It is a term that can be understood by ordinary people. It is a cryptographic term. Generally speaking, the plaintext password of a password is a meaningful character Or a set of bits, or a message that can be obtained through some public coding standard. The password usually includes Arabic numerals of different lengths, uppercase and lowercase letters, special symbol sets, etc.

In a preferred embodiment of the present application, the real password includes letters, numbers and/or symbols, and the virtual password includes pure letters, pure letters or pure symbols.

In a preferred embodiment of the present application, the leakage parameter is described by taking the leakage probability as an example, and the preset first leakage parameter analysis model is a Markov model. The Markov model believes that there is a connection between characters and characters in a password, and generally knowing the first few characters in a password can predict the next character in the password. Therefore, this application can use the Markov model of n-gram to estimate the probability of the nth character in the password through the prefix string of n-1 length.

The preferred embodiment of the present application constructs an n-gram database using the real password leaked from the collected network and a preset type of virtual password.

Further, this application selects one of the passwords S from the n-gram database. Assuming that the password S consists of a character sequence {W ₁ , W ₂ …W _m }, then in the password S, the first n-1 When a character appears, the probability of the nth character can be expressed as:

P(W _n |W ₁ ,...W _n-1 )=P(W _n |W _n-i+1 ,...W _n-1 ).

Therefore, the probability that the password S is arranged according to the above character sequence is:

P(S)=P(W ₁ W ₂ …W _m )=P(W ₁ )P(W ₂ |W ₁ )…P(W _m |W _m-i+1 ,…W _m-1 ),

Wherein, the P(W _m |W _m-i+1 ,...W _m-1 ) refers to the probability of W _m appearing when the character strings W _m-i+1 ,...W _m-1 appear.

Based on the number of large-scale passwords, the maximum likelihood estimation is used to obtain the leakage probability of the password S, and the leakage probability of the password S can be expressed as:

Therefore, according to the above method, the leakage probability of each real password and virtual password can be calculated.

S2. Perform structural analysis on the real password and virtual password, and construct a second leakage parameter analysis model based on the structure of the real password and virtual password and the calculated leakage parameters.

The preferred embodiment of the application analyzes the structure of the real password leaked from the network, and obtains the structure L of the real password and the virtual password by counting the number of letters, numbers and/or symbols contained in the real password and the virtual password. _m D _n S _i , where L represents a letter, D represents a number, S represents a symbol, m, n, and i are natural numbers, respectively representing the number of letters, numbers, and symbols in the real password and the virtual password. For example, the passwords Abc1234^, qwe456&, etc. can be expressed as a password structure of L ₃ D ₄ S ₁ (that is, 3 letters, 4 numbers, and 1 symbol).

In the preferred embodiment of the present application, based on the calculated leakage probability of each real password, the probability of all the real passwords with the same password structure is averaged to obtain the probability corresponding to the password structure. For example, according to the average operation, the leakage probability of the password structure L ₃ D ₄ S ₁ is 0.3, and the leakage probability of the password structure D6 is 0.7.

In a preferred embodiment of the present application, the average operation may adopt a weighted average algorithm.

Further, as described above, the virtual passwords described in this application only contain letters, Arabic numerals or special symbols. Therefore, the probability corresponding to the password structure of each virtual password can be obtained by using the Markov model described above. For example, in a virtual password composed of 6 pure numbers, the leakage probability of the password 123456 is 0.8, and the leakage probability of the password 111111 is 0.2.

Further, the leakage parameter is explained by taking the leakage probability as an example. The preferred embodiment of the application will form the second according to the probability corresponding to the password structure obtained by the real password and the leakage probability corresponding to the password structure obtained by each virtual password. Leak parameter analysis model. In detail, this application generates a basic probability table based on the structure of each real password and the corresponding leakage probability, and generates a segmented probability table ST based on the structure of each virtual password and the corresponding leakage probability, and uses the following The formula forms the second leakage parameter analysis model:

P(S)=P(S′)*P(L _m )*P(D _n )*P(S _i ),

Wherein, the value of P(S′) is taken from the basic probability table BT, and the values of P(L _m ), P(D _n ) and P(S _i ) are taken from the segment probability table ST.

As shown in Figure 4, for the password abc1234^, using the second leakage parameter analysis model formula described in this application, the leakage probability can be obtained as:

P(abc1234 ^{^} )

＝P(S→L ₃ D ₄ S ₁ )*P(L ₃ →abc)*P(D ₄ →1234)*P(S ₁ → ^{^} )

=0.3*0.7*0.6*0.1=0.126.

S3. A batch of passwords is randomly generated, and the leakage parameters of the randomly generated batch of passwords are calculated by using the second leakage parameter analysis model.

The leakage parameters described in the preferred embodiment of the application illustrate the application by taking the leakage probability as an example. A batch of passwords are randomly generated, and it is assumed that each randomly generated password consists of N characters, where S _i represents the i-th character, Q _i represents the occurrence probability of the character. A password containing N characters S ₁ , S ₂ ,..., S _N is randomly selected. It constitutes a complete password S as follows:

S=(S ₁ ,S ₂ ,…,S _I ,…,S _N ),

Further, a preferred embodiment of the present application analyzes the structure of the randomly generated password, and calculates the leakage probability of each password in the batch of randomly generated passwords through the above-mentioned second leakage parameter analysis model.

S4. Using a preset password strength calculation model and the leaked parameters of a batch of randomly generated passwords, the password strength value of the password to be analyzed input by the user is calculated.

In a preferred embodiment of the present application, the leakage parameter is described by taking the leakage probability as an example, and the preset password strength calculation model may be the Monte Carlo method. The Monte Carlo method is also called random sampling method, which is a calculation method based on statistical theory and probability. The main idea of the Monte Carlo method is to use the random numbers on the computer to represent the probability parameters of the system components, and at the same time to simulate the actual operation of the system on the Monte Carlo simulator, observe for a period of time, and give the approximate value of the solution. That is, it is expressed by the standard deviation of the estimated value. Since the sampling times of the Monte Carlo method have nothing to do with the scale of the system, there is no rapid growth relationship between the number of system states and the number of system components.

Further, in a preferred embodiment of the present application, the formula of the preset password strength calculation model is as follows:

Where α is the password to be evaluated, Θ is a batch of randomly generated passwords, n is the number of randomly generated passwords, p(.) is the estimated probability of the password, CΔ is the estimated number of guesses, which can be regarded as the password Strength value.

In a preferred embodiment of the present application, the above random password leakage probability set and the user password leakage probability to be evaluated are input into the password strength calculation model, and the number of password guesses for the user password to be evaluated is calculated. The more guesses there are, The stronger the password, the fewer guesses and the weaker the password.

This application also provides a password strength calculation device. Referring to FIG. 2, it is a schematic diagram of the internal structure of a password strength calculation device provided by an embodiment of this application.

In this embodiment, the password strength calculation device 1 may be a PC (Personal Computer, personal computer), or a terminal device such as a smart phone, a tablet computer, or a portable computer, or a server. The password strength calculation device 1 at least includes a memory 11, a processor 12, a communication bus 13, and a network interface 14.

Wherein, the memory 11 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc. The memory 11 may be an internal storage unit of the password strength calculation device 1 in some embodiments, such as a hard disk of the password strength calculation device 1. In other embodiments, the memory 11 may also be an external storage device of the password strength calculation device 1, for example, a plug-in hard disk equipped on the password strength calculation device 1, a smart media card (SMC), and a secure digital (Secure Digital). Digital, SD) card, flash card (Flash Card), etc. Further, the memory 11 may also include both an internal storage unit of the password strength calculation device 1 and an external storage device. The memory 11 can be used not only to store application software and various data installed in the password strength calculation device 1, such as the code of the password strength calculation program 01, etc., but also to temporarily store data that has been output or will be output.

The processor 12 may be a central processing unit (CPU), controller, microcontroller, microprocessor or other data processing chip in some embodiments, and is used to run the program code or processing stored in the memory 11 Data, such as execution of password strength calculation program 01, etc.

The communication bus 13 is used to realize the connection and communication between these components.

The network interface 14 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface), and is usually used to establish a communication connection between the device 1 and other electronic devices.

Optionally, the device 1 may also include a user interface. The user interface may include a display (Display) and an input unit such as a keyboard (Keyboard). The optional user interface may also include a standard wired interface and a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode, organic light emitting diode) touch device, etc. Among them, the display can also be appropriately called a display screen or a display unit, which is used to display the information processed in the password strength calculation device 1 and to display a visualized user interface.

Figure 2 only shows the password strength calculation device 1 with components 11-14 and the password strength calculation program 01. Those skilled in the art will understand that the structure shown in Figure 1 does not constitute a limitation on the password strength calculation device 1 It may include fewer or more components than shown, or a combination of some components, or a different component arrangement.

In the embodiment of the device 1 shown in FIG. 2, the password strength calculation program 01 is stored in the memory 11; when the processor 12 executes the password strength calculation program 01 stored in the memory 11, the following steps are implemented:

Step 1: Collect real passwords leaked from the network and preset types of virtual passwords, and calculate the leak parameters of the real passwords and virtual passwords through a preset first leak parameter analysis model.

In a preferred embodiment of this application, the password is also called a plaintext password which refers to a text or string that is not encrypted. It is a term that can be understood by ordinary people. It is a cryptographic term. Generally speaking, the plaintext password of a password can be simply considered as meaningful characters. Or a set of bits, or a message that can be obtained through some public coding standard. The password usually includes Arabic numerals of different lengths, uppercase and lowercase letters, special symbol sets, etc.

P(W _n |W ₁ ,...W _n-1 )=P(W _n |W _n-i+1 ,...W _n-1 ).

Step 2: Analyze the structure of the real password and the virtual password, and construct a second leakage parameter analysis model based on the structure of the real password and the virtual password and the calculated leakage parameters.

The preferred embodiment of the present application analyzes the structure of the real password leaked from the network, and obtains the structure L of the real password and the virtual password by counting the number of letters, numbers and/or symbols contained in the real password and the virtual password. _m D _n S _i , where L represents a letter, D represents a number, S represents a symbol, m, n, and i are natural numbers, respectively representing the number of letters, numbers, and symbols in the real password and the virtual password. For example, the passwords Abc1234^, qwe456&, etc. can be expressed as a password structure of L ₃ D ₄ S ₁ (that is, 3 letters, 4 numbers, and 1 symbol).

P(S)=P(S′)*P(L _m )*P(D _n )*P(S _i ),

As shown in Figure 4, for the password abc1234^, using the password probability model formula described in this application, the leakage probability can be obtained as:

P(abc1234 ^{^} )

=0.3*0.7*0.6*0.1=0.126.

Step 3: Generate a batch of passwords randomly, and use the second leakage parameter analysis model to calculate the leakage parameters of the randomly generated batch of passwords.

S=(S ₁ ,S ₂ ,…,S _I ,…,S _N ),

Step 4: Using a preset password strength calculation model and the leaked parameters of a batch of randomly generated passwords, the password strength value of the password to be analyzed input by the user is calculated.

In a preferred embodiment of the present application, the leakage parameter is described by taking the leakage probability as an example, and the preset password strength calculation model may be the Monte Carlo method. The Monte Carlo method is also called random sampling method, which is a calculation method based on statistical theory and probability. The main idea of the Monte Carlo method is to use the random numbers on the computer to represent the probability parameters of the system components, and at the same time to simulate the actual operation of the system on the Monte Carlo simulator, observe for a period of time, and give the approximate value of the solution. That is, it is expressed by the standard deviation of the estimated value. Since the sampling times of the Monte Carlo method have nothing to do with the scale of the system, there is no relationship between the number of system states and the number of system components.

Optionally, in other embodiments, the password strength calculation program can also be divided into one or more modules, one or more modules are stored in the memory 11, and are executed by one or more processors (in this embodiment The processor 12) is executed to complete the application. The module referred to in the application refers to a series of computer program instruction segments capable of completing specific functions, and is used to describe the execution process of the password strength calculation program in the password strength calculation device.

For example, referring to FIG. 3, which is a schematic diagram of the program modules of the password strength calculation program in an embodiment of the password strength calculation device of this application. In this embodiment, the password strength calculation program can be divided into a password acquisition module 10 and a structure The analysis module 20, the password preset module 30, and the strength evaluation module 40 are illustratively:

The password acquisition module 10 is used to collect real passwords leaked from the network and preset types of virtual passwords, and estimate and calculate the leak probability parameters of the real passwords and virtual passwords through the preset first leak parameter probability analysis model, wherein The real password includes letters, numbers and/or symbols, and the virtual password includes pure letters, pure letters or pure symbols.

The structure analysis module 20 is configured to: perform structure analysis on the real password and the virtual password, and form a second leakage parameter analysis model according to the structure of the real password and the virtual password and the calculated leakage parameter probability.

The password preset module 30 is configured to randomly generate a batch of passwords, and use the second leakage parameter analysis model to calculate the leakage probability of the randomly generated batch of passwords.

The strength evaluation 40 is used for: using a preset password strength calculation model and the leakage probability of a batch of randomly generated passwords to estimate the password strength value of the password to be evaluated input by the user.

The functions or operation steps implemented when the program modules such as the password acquisition module 10, the structure analysis module 20, the password preset module 30, and the search strength evaluation module 40 are executed are substantially the same as those in the foregoing embodiment, and will not be repeated here.

In addition, an embodiment of the present application also proposes a computer-readable storage medium having a password strength calculation program stored on the computer-readable storage medium, and the password strength calculation program can be executed by one or more processors to achieve the following operating:

The specific implementation of the computer-readable storage medium of the present application is basically the same as the foregoing embodiments of the password strength calculation device and method, and will not be repeated here.

It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments. And the terms "include", "include" or any other variants thereof in this article are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements not only includes those elements, but also includes The other elements listed may also include elements inherent to the process, device, article, or method. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, device, article or method that includes the element.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better.的实施方式。 Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM) as described above. , Magnetic disk, optical disk), including several instructions to make a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the method described in each embodiment of the present application.

The above are only preferred embodiments of this application, and do not limit the scope of this application. Any equivalent structure or equivalent process transformation made using the content of the description and drawings of this application, or directly or indirectly used in other related technical fields , The same reason is included in the scope of patent protection of this application.

Claims

A method for calculating password strength, characterized in that the method includes:

Collect real passwords leaked from the network and preset types of virtual passwords, and calculate the leak parameters of the real passwords and virtual passwords through a preset first leak parameter analysis model, where the real passwords include letters, numbers and/or symbols, And the virtual password includes pure letters, pure letters or pure symbols;

Perform structural analysis on the real password and the virtual password, and construct a second leakage parameter analysis model based on the structure of the real password and the virtual password and the calculated leakage parameters;

Randomly generating a batch of passwords, using the second leakage parameter analysis model to calculate the leakage parameters of the randomly generated batch of passwords;

Using a preset password strength calculation model and the leakage parameters of a batch of randomly generated passwords, the password strength value of the password to be analyzed input by the user is calculated.
The password strength calculation method according to claim 1, wherein the preset first leakage parameter analysis model is a Markov model, and the collection of real passwords leaked from the network and preset types of virtual passwords is passed The preset first leakage parameter analysis model to calculate the leakage parameters of the real password and the virtual password includes:

Constructing an n-gram database using the real password and the virtual password;

Select one of the passwords S from the n-gram database, the password S consists of a character sequence {W 1 , W 2 …W m }, n is greater than 2, and m is a positive integer greater than 2;

According to the Markov model, use the first n-1 characters in the password S to estimate the parameter of the nth character in the password:

P(W n |W 1 ,...W n-1 )=P(W n |W n-i+1 ,...W n-1 ), i is a positive integer smaller than n and m;

Obtain the parameters of the password S arranged according to the above-mentioned character sequence:

P(S)=P(W 1 W 2 …W m )=P(W 1 )P(W 2 |W 1 )…P(W m |W m-i+1 ,…W m-1 ),

Wherein, the P(W m |W m-i+1 ,...W m-1 ) refers to the parameter that W m appears when the character string W m-i+1 ,...W m-1 appears;

Based on the large-scale number of passwords, the maximum likelihood calculation is used to obtain the leakage parameters of the password S, and the leakage parameters of the password S are expressed as:
The password strength calculation method according to claim 1, wherein the structural analysis of the real password and the virtual password comprises:

The structure L m D n S i of the real password and the virtual password is obtained by counting the number of letters, numbers and/or symbols contained in the real password and the virtual password, where L represents a letter, D represents a number, and S represents Symbols, m, n, and i are natural numbers, respectively representing the number of letters, numbers, and symbols in the real password and the virtual password.
The password strength calculation method according to claim 3, wherein the construction of the second leakage parameter analysis model according to the structure of the real password and the virtual password and the calculated leakage parameters includes:

According to the structure of each real password mentioned above and the corresponding leaked parameters, generate a basic parameter table;

According to the structure of each virtual password and the corresponding leakage parameters, a segmented parameter table is generated;

Use the following formula to form the second leakage parameter analysis model:

P(S)=P(S′)*P(L m )*P(D n )*P(S i ),

Wherein, the value of P(S′) is taken from the basic parameter table, and the values of P(L m ), P(D n ) and P(S i ) are taken from the segment parameter table.
8. The password strength calculation method according to claim 4, wherein the password strength calculation model formula is:

Among them, α is the password to be evaluated, Θ is the randomly generated batch of passwords, n is the number of randomly generated passwords, p(.) is the password calculation parameter, and CΔ is the number of guesses to be calculated for the password calculation, That is, the password strength value.
The password strength calculation method according to claim 2, wherein the structural analysis of the real password and the virtual password comprises:

The structure L m D n S i of the real password and the virtual password is obtained by counting the number of letters, numbers and/or symbols contained in the real password and the virtual password, where L represents a letter, D represents a number, and S represents Symbols, m, n, and i are natural numbers, respectively representing the number of letters, numbers, and symbols in the real password and the virtual password.
8. The password strength calculation method according to claim 1, wherein the preset password strength calculation model is Monte Carlo.
A password strength calculation device, characterized in that the device includes a memory and a processor, the memory stores a password strength calculation program that can be run on the processor, and the password strength calculation program is processed by the processor. The following steps are implemented when the device is executed:

Collect real passwords leaked from the network and preset types of virtual passwords, and calculate the leak parameters of the real passwords and virtual passwords through a preset first leak parameter analysis model, where the real passwords include letters, numbers and/or symbols, And the virtual password includes pure letters, pure letters or pure symbols;

Perform structural analysis on the real password and the virtual password, and construct a second leakage parameter analysis model based on the structure of the real password and the virtual password and the calculated leakage parameters;

Randomly generating a batch of passwords, using the second leakage parameter analysis model to calculate the leakage parameters of the randomly generated batch of passwords;

Using a preset password strength calculation model and the leakage parameters of a batch of randomly generated passwords, the password strength value of the password to be analyzed input by the user is calculated.
8. The password strength calculation device according to claim 8, wherein the preset first leakage parameter analysis model is a Markov model, and the collection of real passwords leaked from the network and preset types of virtual passwords is passed The preset first leakage parameter analysis model to calculate the leakage parameters of the real password and the virtual password includes:

Constructing an n-gram database using the real password and the virtual password;

Select one of the passwords S from the n-gram database, the password S consists of a character sequence {W 1 , W 2 …W m }, n is greater than 2, and m is a positive integer greater than 2;

According to the Markov model, use the first n-1 characters in the password S to estimate the parameter of the nth character in the password:

P(W n |W 1 ,...W n-1 )=P(W n |W n-i+1 ,...W n-1 ), i is a positive integer smaller than n and m;

Obtain the parameters of the password S arranged according to the above-mentioned character sequence:

P(S)=P(W 1 W 2 …W m )=P(W 1 )P(W 2 |W 1 )…P(W m |W m-i+1 ,…W m-1 ),

Wherein, the P(W m |W m-i+1 ,...W m-1 ) refers to the parameter that W m appears when the character string W m-i+1 ,...W m-1 appears;

Based on the large-scale number of passwords, the maximum likelihood calculation is used to obtain the leakage parameters of the password S, and the leakage parameters of the password S are expressed as:
8. The password strength calculation device of claim 8, wherein the structural analysis of the real password and the virtual password comprises:

The structure L m D n S i of the real password and the virtual password is obtained by counting the number of letters, numbers and/or symbols contained in the real password and the virtual password, where L represents a letter, D represents a number, and S represents Symbols, m, n, and i are natural numbers, respectively representing the number of letters, numbers, and symbols in the real password and the virtual password.
The password strength calculation device according to claim 10, wherein the construction of the second leakage parameter analysis model according to the structure of the real password and the virtual password and the calculated leakage parameters comprises:

According to the structure of each real password mentioned above and the corresponding leaked parameters, generate a basic parameter table;

According to the structure of each virtual password and the corresponding leakage parameters, a segmented parameter table is generated;

Use the following formula to form the second leakage parameter analysis model:

P(S)=P(S′)*P(L m )*P(D n )*P(S i ),

Wherein, the value of P(S′) is taken from the basic parameter table, and the values of P(L m ), P(D n ) and P(S i ) are taken from the segment parameter table.
The password strength calculation device according to claim 11, wherein the password strength calculation model formula is:

Among them, α is the password to be evaluated, Θ is the randomly generated batch of passwords, n is the number of randomly generated passwords, p(.) is the password calculation parameter, and CΔ is the number of guesses to be calculated for the password calculation, That is, the password strength value.
The password strength calculation device according to claim 9, wherein the structural analysis of the real password and the virtual password comprises:

The structure L m D n S i of the real password and the virtual password is obtained by counting the number of letters, numbers and/or symbols contained in the real password and the virtual password, where L represents a letter, D represents a number, and S represents Symbols, m, n, and i are natural numbers, respectively representing the number of letters, numbers, and symbols in the real password and the virtual password.
8. The password strength calculation device according to claim 8, wherein the preset password strength calculation model is Monte Carlo method.
A computer-readable storage medium, wherein the computer-readable storage medium includes a password strength calculation program, and when the password strength calculation program is executed by a processor, the following steps can be implemented:

Collect real passwords leaked from the network and preset types of virtual passwords, and calculate the leak parameters of the real passwords and virtual passwords through a preset first leak parameter analysis model, where the real passwords include letters, numbers and/or symbols, And the virtual password includes pure letters, pure letters or pure symbols;

Perform structural analysis on the real password and the virtual password, and construct a second leakage parameter analysis model based on the structure of the real password and the virtual password and the calculated leakage parameters;

Randomly generating a batch of passwords, using the second leakage parameter analysis model to calculate the leakage parameters of the randomly generated batch of passwords;

Using a preset password strength calculation model and the leakage parameters of a batch of randomly generated passwords, the password strength value of the password to be analyzed input by the user is calculated.
15. The computer-readable storage medium of claim 15, wherein the preset first leakage parameter analysis model is a Markov model, and the collected real passwords leaked from the network and preset types of virtual passwords, The calculation of the leakage parameters of the real password and the virtual password by the preset first leakage parameter analysis model includes:

Constructing an n-gram database using the real password and the virtual password;

Select one of the passwords S from the n-gram database, the password S consists of a character sequence {W 1 , W 2 …W m }, n is greater than 2, and m is a positive integer greater than 2;

According to the Markov model, use the first n-1 characters in the password S to estimate the parameter of the nth character in the password:

P(W n |W 1 ,...W n-1 )=P(W n |W n-i+1 ,...W n-1 ), i is a positive integer smaller than n and m;

Obtain the parameters of the password S arranged according to the above-mentioned character sequence:

P(S)=P(W 1 W 2 …W m )=P(W 1 )P(W 2 |W 1 )…P(W m |W m-i+1 ,…W m-1 ),

Wherein, the P(W m |W m-i+1 ,...W m-1 ) refers to the parameter that W m appears when the character string W m-i+1 ,...W m-1 appears;

Based on the large-scale number of passwords, the maximum likelihood calculation is used to obtain the leakage parameters of the password S, and the leakage parameters of the password S are expressed as:
15. The computer-readable storage medium of claim 15, wherein the structural analysis of the real password and the virtual password comprises:

The structure L m D n S i of the real password and the virtual password is obtained by counting the number of letters, numbers and/or symbols contained in the real password and the virtual password, where L represents a letter, D represents a number, and S represents Symbols, m, n, and i are natural numbers, respectively representing the number of letters, numbers, and symbols in the real password and the virtual password.
17. The computer-readable storage medium according to claim 17, wherein the construction of the second leakage parameter analysis model according to the structure of the real password and the virtual password and the calculated leakage parameters comprises:

According to the structure of each real password mentioned above and the corresponding leaked parameters, generate a basic parameter table;

According to the structure of each virtual password and the corresponding leakage parameters, a segmented parameter table is generated;

Use the following formula to form the second leakage parameter analysis model:

P(S)=P(S′)*P(L m )*P(D n )*P(S i ),

Wherein, the value of P(S′) is taken from the basic parameter table, and the values of P(L m ), P(D n ) and P(S i ) are taken from the segment parameter table.
The computer-readable storage medium of claim 18, wherein the password strength evaluation model formula is:

Where α is the password to be evaluated, Θ is the randomly generated batch of passwords, n is the number of randomly generated passwords, p(.) is the estimated probability of the password, CΔ is the estimated number of guesses for the password to be evaluated, That is, the password strength value.
15. The computer-readable storage medium of claim 15, wherein the preset password strength calculation model is Monte Carlo method.