基于随机Petri网模型的远程口令破解和防御分析

Analyse of Remote Password Crack and Defence Based the Stochastic Petri Net

分析网络应用中基于口令的身份认证流程,指出其存在的漏洞,详细分析在帐户锁定策略下远程口令破解的过程,分析帐户锁定对口令破解的影响。使用随机Petri网建立基于系统状态变化的过程模型,利用位置中token数和弧权来模拟帐户锁定阀值和触发锁定,利用循环来模拟多次攻击和防御过程,定义3个主要参数和1个评价指标,量化分析参数和指标的关系,评价不同防御策略下攻击和防御的性能,帮助用户改善防御措施,提高网络安全性。

The paper analyzes the flow of identity authentication based password in the network application and indicates the existent leak in the flow.It analyzes particularly the process of remote password crack with the account lock policy and analyzes the account lock's effect on password crack.It founds the process model based on the system state change with the Stochastic Petri Nets.It simulates the account lock valve and touch lock off with the token's number in the place and the arc's power.It simulates many times attack and defense process with the circle.It defines three parameters and one evaluation measure.It quantitatively analyzes the relation between parameters and measure.It evaluates the performance of attack and defense under the different defence policies.It helps users to improve the defence steps and enhance the network security.