用启发式策略检测口令安全

Improving password security with heuristic method

针对现有口令安全措施中存在的问题进行了分析,提出一种利用启发式策略检测口令安全的方法,该方法模拟社交工程破解口令的逻辑推理过程,利用启发式策略指导口令核的检测过程,从而有针对性的选择口令核字典,缩小搜索空间,再利用计算机的强计算能力完成变形重组工作,提高效率.以攻击者的思维、角度来考虑安全问题,假定攻击者在了解用户有关信息的情况下,模拟攻击者破解口令的智能推导过程来检验口令的安全性.同时,还描述了利用此方法实现的一个原型系统,实验表明,它可以改进口令检测的效果和效率.

A new model is proposed for improving password security with a heuristic method which tries to find out the password core by reasoning just like a hacker usually does in social engine and then transforms the password core into kinds of passwords to check whether the right one is in them. With this model the design and implementation of an audit tool called PassChecker are described. With this method the PassChecker can improve the efficiency and efficacy of checking weak passwords.