一种基于姓名首字母简写结构的口令破解方法

doi:10.3969/j.issn.1000-3428.2017.01.033

摘要/Abstract

摘要： 用户口令猜测研究是口令安全性研究的重要组成部分之一,根据用户个人信息和用户口令之间的联系,分析用户个人信息的结构特点,扩展Weir的概率语境自由语法方法,基于用户姓名首字母简写结构,提出一个概率口令攻击方法。通过训练找到用户姓名首字母简写结构,引入到用户口令结构生成算法中,从而生成新的更有效的口令结构,并使用训练集中学习出来的个人信息,作为简写结构的替换变量进行猜测攻击。采用网上泄露的用户口令数据集设计不同实验场景,实验结果表明,在猜测2 000万次的情况下,该方法的猜测成功率超过了John the Ripper的字典模式,和概率上下文无关文法相比最高提升48.12%。

关键词: 口令破解, 身份认证, 概率口令猜测, 个人信息, 简写结构

Abstract: User password guess research is one of the important parts of password security research.According to the relationship between user’s personal information and user password,analyzes the structural characteristics of the user’s personal information,extends Weir probabilistic context free grammar approach,based on user initials shorthand structure,this paper proposes a probalisitic password attack method.Through training to find the user initials shorthand structure,and introduces it into the user password structure generation algorithm,so as to generate a new more effective password structure,and uses the personal information learnt from the training set to make guess attack as a substitution variable of shorthand structure.User password data set on the Internet is used to design different experimental scenarios.Experimental results show that in the twenty million case of speculation,the guess success rate of the proposed method is far more than John the Ripper wordlist mode,and compared with Weir’s Probabilistic Context-Free Grammar(PCFG) method also has 48.12% increasement.

Key words: password cracking, identity authentication, probalisitic password guess, personal information, shorthand structure

中图分类号:

TP309.2

罗敏,张阳. 一种基于姓名首字母简写结构的口令破解方法[J]. 计算机工程, doi: 10.3969/j.issn.1000-3428.2017.01.033.

LUO Min,ZHANG Yang. A Password Cracking Method Based on Name Initials Shorthand Structure [J]. Computer Engineering, doi: 10.3969/j.issn.1000-3428.2017.01.033.

参考文献

参考文献［1］Suo Xiaoyuan.A Design and Analysis of Graphical Password［J］.Computer Science,2006,8(3):741-749. ［2］Jain A K,Ross A,Prabhakar S.An Introduction to Biometric Recognition［J］.IEEE Transactions on Circuits and Systems for Video Technology,2004,14(1):4-20. ［3］Naor M,Shamir A.Visual Cryptography［C］//Proceedings of Eurocrypto′94.Berlin,Germany:Springer,1994:1-12. ［4］Ito K,Nakajima H,Kobayashi K,et al.A Fingerprint Matching Algorithm Using Phase-only Correlation［J］.IEICE Transactions on Fundamentals of Electronics Communications & Computer Sciences,2004,87(3):682-691. ［5］Herley C,Oorschot P V.A Research Agenda Acknow-ledging the Persistence of Passwords［J］.IEEE Security & Privacy Magazine,2012,10(1):28-36. (下转第200页) (上接第195页) ［6］李恺,张李军,刘义铭.PhpBB网络论坛的安全性分析［J］.通信技术,2013,46(8):98-101. ［7］Wang Ding,Wang Ping.Offline Dictionary Attack on Password Authentication Schemes Using Smart Cards［J］.Information Security,2015,52:221-237. ［8］Houshmand S,Aggarwal S.Building Better Passwords Using Probabilistic Techniques［C］//Proceedings of the 28th Annual Computer Security Applications Conference.New York,USA:ACM Press,2012:109-118. ［9］Spafford E H.Preventing Weak Password Choices［J］.Computers & Security,1992,11(3):273-278. ［10］Helkala K,Snekkenes E.Password Generation and Search Space Reduction［J］.Journal of Computers,2009,4(7):663-669. ［11］Openwall.Bringing Security into Open Computing Environments［EB/OL］.(2015-04-10).http://www.openwall.com/. ［12］Weir M,Aggarwal S,de Medeiros B,et al.Password Cracking Using Probabilistic Context-free Grammars［C］//Proceedings of IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,2009:391-405. ［13］Narayanan A,Shmatikov V.Fast Dictionary Attacks on Passwords Using Time-space Tradeoff［C］//Proceedings of ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2005:364-372. ［14］Brown B J,Callis K.Computer Password Choice and Personality Traits Among College Students［D］.Cape Girardeau,USA:Southeast Missouri State University,2004. ［15］Yampolskiy R V.Analyzing User Password Selection Behavior for Reduction of Password Space［C］//Proceedings of IEEE International Carnahan Conference on Security Technology.Washington D.C.,USA:IEEE Press,2006:109-115. ［16］Malone D,Maher K.Investigating the Distribution of Password Choices［J］.Computer Science,2011,8(3):301-310. ［17］Li Zhigong,Han Weili,Xu Wenyuan.A Large-scale Empirical Analysis of Chinese Web Passwords［C］//Proceedings of the 23rd USENIX Security Symposium.San Diego,USA:USENIX,2014:559-574. 编辑顾逸斐

[1]	牛淑芬, 杨平平, 谢亚亚, 王彩芬, 杜小妮. 电子邮件系统中指定服务器的关键字搜索加密方案[J]. 计算机工程, 2020, 46(10): 137-142,150.
[2]	王泽,陈永乐,王潇健. 基于CSI的WLAN认证及攻击定位方案[J]. 计算机工程, 2019, 45(6): 181-187.
[3]	安亚巍,罗顺,朱智慧. 基于马尔可夫链的口令破解算法[J]. 计算机工程, 2018, 44(11): 119-122.
[4]	蒋存波,孔祥丽,金红,焦阳. 具有射频识别功能的嵌入式低功耗智能钥匙设计[J]. 计算机工程, 2017, 43(7): 54-59.
[5]	杨小东,安发英,杨平,刘婷婷,王彩芬. 基于无证书签名的云端跨域身份认证方案[J]. 计算机工程, 2017, 43(11): 128-133,145.
[6]	张新运,许艳,崔杰. 车载网中基于无证书签名的匿名认证协议[J]. 计算机工程, 2016, 42(3): 18-21,28.
[7]	何梦,吴仲城,李芳. 基于在线手写签名的密钥生成方法[J]. 计算机工程, 2016, 42(10): 164-168.
[8]	毛雅佼,孙达志. 一种新的RFID 标签所有权转移协议[J]. 计算机工程, 2015, 41(3): 147-150,166.
[9]	巩博儒，赵运磊，Rudolf Fleischer，王晓阳. Schnorr方案推广及其在格密码学中的应用[J]. 计算机工程, 2014, 40(4): 130-135,140.
[10]	傅镜艺,马兆丰,黄勤龙,杨义先. 基于Android 的移动终端安全管理系统[J]. 计算机工程, 2014, 40(11): 77-82.
[11]	赵跃华, 黄淑美. 基于双线性对的WSN密钥协商和认证协议[J]. 计算机工程, 2012, 38(9): 121-124.
[12]	隆笑, 王景成, 赵广磊, 胡霆, 张震玮, 何军, 于长健. 基于哈希函数的正弦投影身份认证方案[J]. 计算机工程, 2012, 38(9): 125-126,130.
[13]	丁清, 朱敏, 闫二辉. 一种安全高效的WAPI改进策略[J]. 计算机工程, 2012, 38(3): 153-155.
[14]	李爱国, 冯国松. 一种安全的USB2.0设备控制器设计[J]. 计算机工程, 2012, 38(24): 288-290.
[15]	王娟, 郑淑丽, 操漫成, 方元康. 基于无证书密钥协商的Kerberos改进协议[J]. 计算机工程, 2012, 38(23): 127-130,136.