基于社工信息的口令生成与安全性分析  

Password Generation and Security Analysis based on Social Engineering

作　　者：高强[1] 李啸[2] 胡勇[2] 吴少华[2] 

机构地区：[1]国家计算机网络与信息安全管理中心,北京100029 [2]四川大学电子信息学院,四川成都610064

出　　处：《通信技术》2017年第7期1511-1516,共6页Communications Technology

摘　　要：文本口令是现今网络信息系统用户身份认证的关键凭据。为评估用户口令的安全性,运用分词算法将获取的口令样本中的每条口令拆分成可理解的口令因子组合,通过分析口令样本中各口令的口令因子组成规律,利用关联规则挖掘用户口令的设置规则。根据设置规则,结合社会工程学收集的信息,利用k-gram算法生成口令字典。通过实验验证,借助社工信息生成的口令字典,在特定应用场景中针对性强,具有更好的破解效果,为检测口令安全性提供了一种新的手段。Text password is the crucial credentials of user identity authentication in the modern network information systems. For evaluating the security of user password, each password of the acquired password simple is split into an understandable combination of password factors by word segmentation algorithm, and via analyzing the combination rule of each password factor in password sample, the setting rules of user password may be mined by using association rules. Based on setting rules and in combination with the information collected by social engineering, the password dictionary is generated with k-gram algorithm. Experiment indicates that the password dictionary generated with the help of social engineering information has strong pertinence and crack effect in the specific application scence, thus provide a new means for the detection of password security.

关 键 词：口令安全性 社会工程 口令因子 分词算法 k-gram 口令破解 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]