【摘要】 文本口令具有实现简单、可部署性强的优点，是当前最主要的身份认证技术之一，口令安全至关重要，合理的口令生成策略有助于提升口令安全。文章针对已有基于频率的口令策略生成器HTPG中因为仅使用频率作为口令分类标准，从而只反映了口令的流行性的问题，设计了基于频率和熵的口令策略生成器框架（FEPG），创新性地引入熵作为口令复杂性的衡量标准，通过Zipf分布和正态分布构建了基于频率和熵的口令四分类方法，并使用口令强度评价工具zxcvbn验证了四分类的有效性。FEPG通过比较弱口令与低频高熵口令的差异，提供了一套修改策略，并在模拟用户修改口令行为后，使用概率上下文无关语法（PCFG,probabilisticcontext-freegrammar）进行测试，结果表明，经过FEPG强化的口令比经过HTPG强化的口令被成功猜测的比例下降了69.30%，验证了FEPG的有效性。更多还原

【Abstract】 Text password has the advantages of simple implementation and strong deployability, it is one of the most important identity authentication technologies currently, and password security is of great significance. A reasonable password generation strategy helps to improve password security. For the existing frequency-based password policy generator, only frequency is used as the password classification criterion, which only reflects the popularity of passwords, a password policy generator framework based on frequency and entropy(FEPG) is designed, innovatively introducing entropy as the measurement standard of the password complexity, and a password four-classification method based on frequency and entropy is constructed through the Zipf distribution and normal distribution, and the password strength evaluation tool(zxcvbn) is used to verify the effectiveness of the four classifications. The FEPG provides the modification strategies by comparing the difference between weak passwords, low-frequency and highentropy passwords, and after simulating the usersmodifying their passwords, the probabilistic context-free grammar(PCFG) algorithm is adopted for testing, The test results show that, the proportion of successfully guessed passwords after the FEPG enhancement decreased by 69.30% compared to those after the HTPG enhancement, validating the effectiveness of the FEPG.更多还原