大规模泄密事件频发，攻击者越来越容易获得用户真实密码信息，利用这些真实密码及用户在设置密码中的行为倾向，攻击者可以大幅提高其攻击效率。利用可用性较好的密码创建规则约束用户行为是提高用户密码安全性的重要手段，使用户设置的密码在整体密码空间上趋于均匀分布，以提高用户密码抵抗猜解攻击的能力。文章在大规模真实数据集的基础上，从强度和可记忆度两个维度定量分析了国内用户密码的安全性及可记忆性，提出了能根据用户历史密码数据动态约束用户密码设置行为的密码创建规则：若用户采用纯数字密码，则密码长度不应低于7位，大写字母+小写字母组合的密码应避开6位和8位，大写字母+特殊字符的组合推荐使用9位。实验结果表明，在该密码创建规则的约束下，用户创建的密码具有高安全性和高可记忆性的优点。%For the serials of massive password leaks, an attacker can obtain user password more and more easily. Using the real password which relfecting user behavior tendency, an attacker can greatly improve their attack efifciency. Password creation policy which was used for restrict user behavior is an important means to improve user password security. It enable password set by the user tending to be uniform in the overall spatial distribution in order to improve resistance to guess and attack the user's password. Based on a large-scale data set, this paper makes a quantitative analysis on domestic user password security and memorability, thus puts forward to create the rules that according to the behavior of the user setting password and password history which dynamically constraints the user's behavior. The password should comprise at least seven numbers if using a digital password. The number of password characters is not six or eight if using uppercase and lowercase combination. The length of uppercase and special character combination should be nine. The password is good in both high safety and high memorability if respectively using lowercase, uppercase and lowercase combination, and uppercase and special character combination. The threshold of password memorability and safety is 14.21 and 19.17 respectively. The password should conduct dictionary check. The experimental results show that, under the constraint of the password creation rules, user password has the advantages of high safety and high memorability.
展开▼
