| 摘要 |
A password audit system is provided for determining the strength of user passwords in a computer system, application or network to which users have access via a user identification and password. The password audit system may include: an interface for establishing a data connection between the password audit system and the computer system, application or network, configured to retrieve cipher text user passwords stored thereon; a central processing unit, configured to successively generate different plain text passwords, encode them into corresponding cipher text passwords, and compare the encoded cipher text passwords to a given one of the retrieved cipher text passwords, until a match is found or a predetermined time has elapsed; and data storage means for storing data relating to the strength of the user passwords, the strength being dependent on the employed method to generate the different plain text passwords and/or the time needed to find a match. |
| 主权项 |
1. A password audit system for determining the strength of user passwords in a computer system, application or network to which a plurality of users have access via a user identification and password, the password audit system comprising:
an interface for establishing a data connection between the password audit system and the computer system, application or network, being configured to retrieve cipher text user passwords stored on the computer system, application or network; a central processing unit, being configured to successively generate different plain text passwords by means of one or more dictionaries and by random combinations of characters, encode the plain text passwords into corresponding cipher text passwords with an encryption algorithm, and compare the encoded cipher text passwords to a given one of the retrieved cipher text passwords, until a match is found or a predetermined time has elapsed; and data storage means for storing data relating to the strength of each of the user passwords without storing the passwords themselves, the strength being dependent on the employed method to generate the different plain text passwords and the time needed to find a match,wherein the components of the password audit system are enclosed in a housing which is separate from the computer system, application or network. |
