Method and device for identifying security risk points of APP typical business process information service

Abstract

The application discloses an APP typical service flow information service security risk point identification method and device, comprising: logically splitting APP function points to obtain function logic, content logic, construction logic and running logic of the APP after logical splitting; determining the relationship between the function logic, the content logic, the running logic and the construction logic of the APP to generate a typical service flow of the APP; and determining an information service security risk point based on the typical service flow of the APP and according to a preset risk point matching rule. The method splits the APP function points logically, determines the relationship between the split logics, determines the typical service flow of the APP, and realizes the identification of the information service security risk point. The result of the method is objective and has strong applicability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet application, and in particular to an APP typical business process information service security risk point identification method and device. BACKGROUND

[0002] The rapid development of mobile Internet has led to the continuous integration of various new technologies and new applications into all aspects of national development and social life, accelerating the speed of information generation and the range of information flow. Mobile Internet application programs (APPs) have become the main carriers of mobile Internet information services. At present, there are a large number of APPs on the market, with various types, rapid updates, and complex business scenarios. There are risks such as spreading rumors, illegally collecting user privacy data, sending harassment and fraud information, and inducing minors to consume. Not only do these risks harm the legitimate rights and interests of users, but they can also have a negative impact on society.

[0003] Current APP information service security risk identification work generally relies on the professional knowledge and work experience of business personnel, and the identification process is prone to omissions, misjudgments, and other situations, and is low in work efficiency, lacking objective and efficient identification methods. SUMMARY

[0004] The embodiments of the present application provide an APP typical business process information service security risk point identification method and device to balance the efficiency of the information service security risk point identification process and the objectivity and accuracy of the identification results.

[0005] The embodiments of the present application provide an APP typical business process information service security risk point identification method, comprising:

[0006] logically splitting the APP function points to obtain the function logic, content logic, construction logic, and running logic of the APP after logical splitting;

[0007] determining the relationships between the function logic, content logic, running logic, and construction logic of the APP to generate a typical business process of the APP;

[0008] based on the typical business process of the APP, determining an information service security risk point according to a preset risk point matching rule.

[0009] In some embodiments, logically splitting the APP function points comprises:

[0010] functionally splitting the APP function points to obtain the basic function logic and the special function logic;

[0011] content- logically splitting the APP function points to obtain the content logic including the information content carrier format, information content publishing form, information content sharing form, and information content production method;

[0012] The APP function points are logically divided to obtain the key characteristics of the APP internal program running;

[0013] The APP function points are logically divided to obtain the general construction logic and the specific construction logic of the APP.

[0014] In some embodiments, the key characteristics of the APP internal program running include: running platform, development language, communication resource, communication protocol, encryption mode, key function and trigger condition.

[0015] In some embodiments, the general construction logic of the APP includes: information flow interface and personal information interface; and the specific construction logic of the APP includes interface information specific to the APP.

[0016] In some embodiments, the preset risk point matching rule is based on relevant laws, regulations, policy documents and industry standards.

[0017] In some embodiments, after determining the information service security risk point according to the preset risk point matching rule, the method further includes: generating a security risk analysis document.

[0018] The embodiment of the application further provides an APP typical business process information service security risk point identification device, including a processor configured to:

[0019] The APP function points are logically divided to obtain the function logic, content logic, construction logic and running logic of the APP after logical division;

[0020] The function logic, content logic, running logic and construction logic of the APP are determined to be related to each other to generate the typical business process of the APP.

[0021] Based on the typical business process of the APP, the information service security risk point is determined according to the preset risk point matching rule.

[0022] The embodiment of the application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the steps of the foregoing method.

[0023] The embodiment of the application provides a two-stage APP typical business process information service security risk point accurate identification method, the APP function points are logically divided, and the relationship between the divided logics is determined, so that the typical business process of the APP is determined, and the information service security risk point is identified.

[0024] The above description is only a summary of the technical solutions of the present application. In order to enable a more thorough understanding of the technical means of the present application, the present application can be implemented according to the content of the specification, and in order to enable the above and other purposes, features and advantages of the present application to be more apparent and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0025] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are intended to further assist in understanding the preferred embodiments, and are not intended to limit the present application thereto. Moreover, like reference numerals designate like parts throughout the several views in the drawings. In the drawings:

[0026] Figure 1 The basic flowchart of the information service security risk point identification method of the embodiments of the present application is shown in Figure 1.

[0027] Figure 2 The general flowchart of the information service security risk point identification method of the embodiments of the present application is shown in Figure 2. DETAILED DESCRIPTION

[0028] Exemplary embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the present disclosure are shown. It is to be understood that the present disclosure can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0029] The embodiments of the present application provide an APP typical business process information service security risk point identification method, as shown in Figure 1, comprising the following steps: Figure 1

[0030] In step S101, the APP function point is logically split to obtain the function logic, content logic, construction logic and running logic of the APP after logical splitting.

[0031] In some embodiments, logically splitting the APP function point comprises: functionally logically splitting the APP function point to split and obtain basic function logic and special function logic; content logically splitting the APP function point to obtain content logic including information content carrier format, information content publishing form, information content sharing form and information content production method; running logically dividing the APP function point to obtain the key characteristics of the internal program running of the APP; and construction logically dividing the APP function point to obtain the general construction logic and specific construction logic of the APP.

[0032] In the specific example, logically splitting the APP function point comprises: ​

[0033] Step one: function logic splitting of APP function points, divided into basic and specific function logic. The basic function logic refers to the basic function points required to build APP that almost all content production type APPs have; the specific function logic refers to the function points specific to a certain type of APP that are significantly different from other types of APPs.

[0034] Step two: content logic division of APP function points. Content logic mainly includes information content carrier format, information content publishing form, information content sharing form, and information content production method, etc.

[0035] Step three: running logic division of APP function points. Running logic refers to the key characteristics of the APP internal program running. In some embodiments, the key characteristics of the APP internal program running mainly include: running platform, development language, communication resources, communication protocol, encryption method, key function, and trigger condition, etc.

[0036] Step four: construction logic division of APP function points, divided into general construction logic and specific construction logic. The general construction logic refers to the function point aggregation method that content production type APPs usually have, such as information flow interface, personal information interface, etc.; the specific construction logic of the APP includes the interface information specific to the APP. Specifically, the specific construction logic refers to the function point aggregation method specific to a certain type of APP that is significantly different from other types of APPs, such as video playing interface, friend circle interface, group chat interface, etc.

[0037] In step S102, the relationship between the function logic, content logic, running logic, and construction logic of the APP is determined to generate the typical business process of the APP. The business process in this example refers to a series of actions completed by different function points combined to meet the application needs of users. There are not only strict sequence limitations between function points, but also clear responsibility definitions, and then the logic chain formed by each function point completes the entire business process according to the execution order and respective responsibilities.

[0038] In step S103, based on the typical business process of the APP, the information service security risk points are determined according to the preset risk point matching rules.

[0039] The method of the present application abstracts and analyzes the APP function points in terms of function logic, content logic, construction logic, and running logic, then extracts a small number of typical business processes with high aggregation degree, matches the corresponding business risk points, and then forms a risk identification method with wide coverage and strong applicability.

[0040] In some embodiments, as Figure 2As shown, the preset risk point matching rule is formulated based on relevant laws and regulations, policy documents and industry standards. In some embodiments, after determining the information service security risk point according to the preset risk point matching rule, the method further includes generating a security risk analysis document.

[0041] Specifically, in this example, the information service security risk point is automatically analyzed and determined based on the typical business process and the preset risk point matching rule. The matching rule is formulated according to relevant laws and regulations, policy documents and industry standards. Through the preset rule, objective and unified standard analysis of all APPs can be realized, and human factor interference can be avoided to the greatest extent. Finally, a security risk analysis document is formed for business personnel to refer to.

[0042] The embodiment of the application provides a two-stage APP typical business process information service security risk point accurate identification method. The method performs logical splitting on APP function points, determines the relationship between the split logical points, determines the typical business process of the APP, and realizes identification of the information service security risk point. The result of the method is objective and has strong applicability. The method can be widely applied to rapid batch verification of mobile application program typical business process information service security risk points.

[0043] The embodiment of the application also provides an APP typical business process information service security risk point identification device. The device includes a processor configured to:

[0044] The processor performs logical splitting on the APP function points to obtain the function logic, content logic, construction logic and running logic of the APP after logical splitting.

[0045] The processor determines the relationship between the function logic, content logic, running logic and construction logic of the APP to generate the typical business process of the APP.

[0046] The processor determines the information service security risk point according to a preset risk point matching rule based on the typical business process of the APP.

[0047] The embodiment of the application also provides a computer readable storage medium. The computer readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the method described above are implemented.

[0048] It should be noted that, in this document, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a" does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0049] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0050] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and the necessary general hardware platform, and of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a plurality of instructions for causing a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the methods described in the various embodiments of the present application.

[0051] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, and the above-mentioned specific embodiments are only illustrative and not restrictive. Those skilled in the art can make many forms under the inspiration of the present application without departing from the purpose of the present application and the scope protected by the claims, and these all belong to the protection of the present application.

Claims

1. A method for identifying security risk points of APP typical business process information service, characterized in that, The method comprises the following steps: performing logical splitting on the APP function points to obtain function logic, content logic, construction logic and running logic of the APP after the logical splitting; determining the relationships between the function logic, the content logic, the running logic and the construction logic of the APP to generate a typical business process of the APP; judging information service security risk points according to a preset risk point matching rule based on the typical business process of the APP, the preset risk point matching rule being formulated based on relevant laws, regulations, policy documents and industry standards; the logical splitting on the APP function points comprises: performing function logic splitting on the APP function points to obtain basic function logic and special function logic; performing content logic splitting on the APP function points to obtain content logic including information content carrier format, information content publishing form, information content sharing form and information content production mode; performing running logic splitting on the APP function points to obtain key characteristics of internal program running of the APP, the key characteristics of internal program running of the APP including running platform, development language, communication resource, communication protocol, encryption mode, key function and trigger condition; performing construction logic splitting on the APP function points to obtain general construction logic and specific construction logic of the APP.

2. The method for identifying security risk points of APP typical business process information service according to claim 1, wherein, The general construction logic of the APP includes information flow interface and personal information interface, and the specific construction logic of the APP includes interface information specific to the APP.

3. The method for identifying security risk points of APP typical business process information service according to claim 1, characterized in that, After judging the information service security risk points according to the preset risk point matching rule, the method further comprises the step of generating a security risk analysis document.

4. An APP typical business process information service security risk point identification device, characterized in that, The processor is configured to: perform logical splitting on the APP function points to obtain function logic, content logic, construction logic and running logic of the APP after the logical splitting; determine the relationships between the function logic, the content logic, the running logic and the construction logic of the APP to generate a typical business process of the APP; judge information service security risk points according to a preset risk point matching rule based on the typical business process of the APP, the preset risk point matching rule being formulated based on relevant laws, regulations, policy documents and industry standards; the logical splitting on the APP function points comprises: performing function logic splitting on the APP function points to obtain basic function logic and special function logic; performing content logic splitting on the APP function points to obtain content logic including information content carrier format, information content publishing form, information content sharing form and information content production mode; performing running logic splitting on the APP function points to obtain key characteristics of internal program running of the APP, the key characteristics of internal program running of the APP including running platform, development language, communication resource, communication protocol, encryption mode, key function and trigger condition; performing construction logic splitting on the APP function points to obtain general construction logic and specific construction logic of the APP.

5. A computer readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium and is executed by the processor to implement the steps of the method according to any one of claims 1 to 3.

Images