Password application detection method and device, equipment and storage medium

Abstract

The invention provides a password application detection method and device, equipment and a storage medium, and relates to the technical field of information security. The method comprises the following steps: firstly, acquiring log information from a target password cloud platform deployed with a to-be-detected password application, and extracting audit data from the log information of the target password cloud platform; wherein the audit data are user activity records of the to-be-detected password application and performance indexes of the target password cloud platform. And secondly, comparing the audit data with a preset audit condition to generate an audit result. And performing compliance detection on the to-be-detected password application according to a preset compliance condition to generate a compliance result. And finally, determining the audit result and the compliance result as a detection result of the password application to be detected. According to the method, the accuracy of the password application detection result is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a password application detection method, device, equipment and storage medium. Background Art

[0002] Password applications generally refer to applications and software used to manage and protect password data, which are designed to help users generate, store and manage passwords to improve the security of online accounts. However, the rapid development of information technology has reduced the cost of information transmission, and the depth and breadth of data collection have reached an unprecedented level, so that password data is mixed in a large amount of data.

[0003] The existing cryptographic application detection method first obtains the cryptographic data to be detected from the cryptographic application to be detected, and then extracts at least one information from the format information, encoding information, protocol information, and data block information corresponding to the cryptographic data for analysis, and finally determines the security level of the cryptographic data.

[0004] However, the prior art has the technical problem of inaccurate password application detection results. Summary of the invention

[0005] The present application provides a password application detection method, device, equipment and storage medium to solve the technical problem of inaccurate password application detection results in the prior art.

[0006] In a first aspect, the present application provides a password application detection method, comprising:

[0007] Obtaining log information of a target cryptographic cloud platform, where the cryptographic application to be detected is deployed;

[0008] Extracting audit data from the log information of the target cryptographic cloud platform, wherein the audit data is the user activity record of the cryptographic application to be detected and the performance index of the target cryptographic cloud platform;

[0009] Comparing the audit data with preset audit conditions to generate audit results;

[0010] Performing compliance testing on the cryptographic application to be tested according to preset compliance conditions and generating compliance results;

[0011] The audit result and the compliance result are determined as the detection result of the cryptographic application to be detected.

[0012] Optionally, the user activity record includes at least one of the following:

[0013] The user IP, frequency, number of failures of calling the password service interface of the password application to be detected, the number of login failures of users accessing the business system of the password application to be detected, the number of operation failures, and the status parameters of the password device corresponding to the password application to be detected;

[0014] The performance indicators include at least one of the following:

[0015] Disk usage, CPU usage, memory usage, and password resource pool usage.

[0016] Optionally, obtaining log information of the target cryptographic cloud platform includes:

[0017] Based on the probe, the log information is obtained from the target cryptographic cloud platform.

[0018] Optionally, the performing compliance detection on the to-be-detected cryptographic application according to a preset compliance condition to generate a compliance result includes:

[0019] Acquire evaluation data of the cryptographic application to be detected, wherein the evaluation data includes at least one of the following: application cryptographic algorithm, transmission protocol, key information, cryptographic usage information, and qualification information;

[0020] According to the preset compliance condition and the evaluation data, compliance detection is performed on the cryptographic application to be detected to generate the compliance result.

[0021] Optionally, the cryptographic application to be detected is a cryptographic application whose usage duration exceeds a first preset duration or whose remaining validity period is less than a second preset duration, and the first preset duration is greater than the second preset duration.

[0022] Optionally, the method further comprises:

[0023] Storing the detection result of the password application to be detected;

[0024] The detection result of the password application to be detected is displayed on the display screen.

[0025] In a second aspect, the present application provides a password application detection device, comprising:

[0026] An acquisition module, used to acquire log information of a target cryptographic cloud platform, where the cryptographic application to be detected is deployed;

[0027] An extraction module, used to extract audit data from the log information of the target cryptographic cloud platform, wherein the audit data is a user activity record of the cryptographic application to be detected and a performance indicator of the target cryptographic cloud platform;

[0028] A processing module, used to compare the audit data with preset audit conditions and generate audit results;

[0029] A detection module, used to perform compliance detection on the password application to be detected according to preset compliance conditions and generate a compliance result;

[0030] A determination module is used to determine the audit result and the compliance result as the detection result of the cryptographic application to be detected.

[0031] Optionally, the extraction module further includes: a calling module, configured to:

[0032] The user IP, frequency, number of failures of calling the password service interface of the password application to be detected, the number of login failures of users accessing the business system of the password application to be detected, the number of operation failures, and the status parameters of the password device corresponding to the password application to be detected;

[0033] The performance indicators include at least one of the following:

[0034] Disk usage, CPU usage, memory usage, and password resource pool usage.

[0035] Optionally, the acquisition module is also used to acquire the log information from the target cryptographic cloud platform based on a probe.

[0036] Optionally, the acquisition module is further used to acquire evaluation data of the cryptographic application to be detected, wherein the evaluation data includes at least one of the following: application cryptographic algorithm, transmission protocol, key information, cryptographic usage information, and qualification information;

[0037] The detection module is further used to perform compliance detection on the cryptographic application to be detected according to the preset compliance condition and the evaluation data, and generate the compliance result.

[0038] Optionally, the cryptographic application to be detected is a cryptographic application whose usage duration exceeds a first preset duration or whose remaining validity period is less than a second preset duration, and the first preset duration is greater than the second preset duration.

[0039] Optionally, the device further comprises: a storage module and a display module.

[0040] The storage module is used to store the detection result of the password application to be detected;

[0041] The display module is used to display the detection result of the password application to be detected on the display screen.

[0042] In a third aspect, the present application provides a password application detection device, including:

[0043] Processor and memory;

[0044] Wherein, the memory stores computer-executable instructions;

[0045] The processor executes the computer-executable instructions stored in the memory to implement the password application detection method as described in the first aspect and various possible implementation methods of the first aspect.

[0046] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement the password application detection method as described in the first aspect and various possible implementation methods of the first aspect.

[0047] In a fifth aspect, the present application provides a computer program product, which includes a computer program, which, when executed by a processor, is used to implement the cryptographic application detection method as described in the first aspect and various possible implementation methods of the first aspect.

[0048] The password application detection method, device, equipment and storage medium provided by the present application obtain log information from the target password cloud platform where the password application to be detected is deployed, and audit data is extracted from the log information of the target password cloud platform. Among them, the audit data is the user activity record of the password application to be detected and the performance index of the target password cloud platform, and the audit data belongs to one of the password data corresponding to the password application. It can be seen that the log information of the target password cloud platform is obtained by a certain systematic preset method and the audit data is extracted from it, and the collected data is no longer disordered. Next, the audit data is compared with the preset audit conditions to generate an audit result. Further, the compliance test is performed on the password application to be detected according to the preset compliance conditions, and the compliance result is generated. Finally, the audit result and the compliance result are determined as the test result of the password application to be detected. Testing the audit data ensures the security of the audit data itself, and the compliance test of the password application ensures the security of the password application when processing the audit data. By performing double testing on the audit data and the password application, the accuracy of the password application detection result is effectively improved to prevent potential security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0050] Figure 1 It is an overall architecture diagram of the password application detection method applicable to the embodiment of the present application;

[0051] Figure 2 A flowchart of a password application detection method provided in an embodiment of the present application;

[0052] Figure 3 A flowchart of an audit data analysis process applicable to an embodiment of the present application;

[0053] Figure 4 It is a functional module diagram of the cryptographic application analysis process to be detected applicable to the embodiment of the present application;

[0054] Figure 5 A schematic diagram of the structure of the password application detection device provided in this application;

[0055] Figure 6 Hardware structure diagram of the cryptographic application detection device provided for this application.

[0056] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0057] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0058] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein, for example.

[0059] In the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0060] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0061] Password apps are tools designed specifically to process password data. Their main functions include generating strong passwords, storing passwords securely, automatically filling passwords, and helping users manage passwords for multiple online accounts. The purpose of these functions is to improve the security of users' online accounts and prevent password leaks and account attacks.

[0062] However, with the rapid advancement of information technology, the ability of data collection has also been significantly enhanced. The system can collect and process more and more detailed data than before, resulting in password data being mixed with other large amounts of data. Since the existing technology does not adopt a systematic method in the process of obtaining the password data to be detected, the obtained password data is disordered and lacks structure. Disordered password data is difficult to manage and analyze, and may lead to information loss or misuse, thus affecting the detection of password data.

[0063] In addition, after the password data is collected, various relevant information is extracted from the password data for analysis, including format information, encoding information, protocol information, and data block information. By analyzing at least one of the information, the security of the password data during storage, transmission, and processing can be evaluated, and its security level can be determined. Further, by determining the security level, the potential risks of the password data can be identified, and corresponding measures can be taken to improve its security.

[0064] Although extracting at least one information from the format information, encoding information, protocol information, and data block information corresponding to the cryptographic data for analysis is a systematic analysis method, the limitation of this method is that the analysis of its single information may not be able to fully evaluate the comprehensiveness and accuracy of the cryptographic data.

[0065] Furthermore, although the password data is tested, the security of the password application cannot be fully guaranteed. Because even if the password data itself is secure, if there are security vulnerabilities in the password application, attackers can still exploit these vulnerabilities to gain unauthorized access. Therefore, as information technology and security threats continue to evolve, new vulnerabilities and attack methods continue to emerge. It is not comprehensive to only test data passwords, and there will still be technical problems such as inaccurate password application test results.

[0066] In response to the above technical problems, the inventors found in their research on the password application detection process that the detection of password data mainly focuses on the security of encryption, storage and transmission of password data. If only the password data is detected without the password application, the vulnerabilities at the application level may be overlooked, that is, the password application may make errors or unsafe operations when processing the password data. Therefore, in order to further ensure the security of the password application, after completing the detection of the password data, the inventors also conducted relevant compliance tests on the password application. By performing dual detection of the password data and the password application, the accuracy of the password application detection results is improved.

[0067] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0068] In one possible implementation, Figure 1 FIG. 1 is an overall architecture diagram of a password application detection method applicable to an embodiment of the present application. Figure 1 As shown in the figure, the password application detection method is implemented based on the password intelligent supervision and detection system, which includes information collection module, password data analysis module, compliance assessment module, and monitoring and display module. Through the probes deployed on the password cloud platform, the compliance and correctness of the password application qualification algorithm are monitored and analyzed in real time, and the operation status and alarm information of the password application are displayed, so as to help the demand-side enterprises of the password cloud platform to continuously improve the security compliance level of the password application.

[0069] Specifically, in terms of data sources, the log information of the cryptographic cloud platform can be extracted by using probes and reported to the information collection module. The information collection module scientifically classifies the log information, extracts audit data from it, and extracts key information of the audit data by format normalization and information enrichment, and further passes this key information to the cryptographic data analysis module.

[0070] In terms of data analysis, the password data analysis module processes and analyzes audit data by connecting with key information, thereby discovering problems and security risks in the use of passwords on the connected password cloud platform.

[0071] In terms of compliance assessment, a comprehensive assessment of cryptographic applications is conducted after completing the full-process inspection of audit data. The inspection content includes the correctness of cryptographic algorithm implementation, key integrity, transmission protocol security, product qualification status, cryptographic usage and other aspects of compliance.

[0072] In terms of monitoring and display, it mainly includes functions such as alarm management, rule management, and log management.

[0073] Figure 2 Flow chart of the password application detection method provided in the embodiment of the present application. Figure 2 As shown, a password application detection method provided in an embodiment of the present application includes:

[0074] S201. Obtain log information of the target cryptographic cloud platform.

[0075] Among them, the target cryptographic cloud platform deploys the cryptographic application to be tested. Specifically, the target cryptographic cloud platform is a cloud computing platform dedicated to processing cryptography-related applications and services. Various cryptographic algorithms, key management services, encryption / decryption operations, etc. may be running on this platform. The acquired log information usually includes platform activity records, error reports, user operation records, etc. This information is very important for monitoring the platform operation status, diagnosing problems and conducting security audits.

[0076] In a possible implementation, a probe deployed on a target cryptographic cloud platform is used to obtain log information of the target cryptographic cloud platform. The probe can be integrated into an agent or software development kit (SDK) library in the target cryptographic cloud platform, and when the agent or SDK library processes requests and responses, it can simultaneously collect and transmit log information to the probe.

[0077] Exemplarily, the log information acquired by the probe may include business data and management data. Among them, business data may include application programming interface (API) data, user information data, and authentication information data; management data may include cryptographic device status monitoring, server status monitoring, key quantity usage monitoring, and key status monitoring.

[0078] S202. Extract audit data from the log information of the target cryptographic cloud platform.

[0079] Among them, the audit data is used to ensure the security, compliance and reliability of the target cryptographic cloud platform, including user activity records of the cryptographic applications to be tested and the performance indicators of the target cryptographic cloud platform.

[0080] Specifically, the user activity record of the cryptographic application to be detected includes at least one of the following: the Internet Protocol (IP) of the user who calls the cryptographic service interface of the cryptographic application to be detected, the frequency, the number of failures, the number of login failures of the user who accesses the business system of the cryptographic application to be detected, the number of operation failures, and the state parameters of the cryptographic device corresponding to the cryptographic application to be detected. The performance indicators include at least one of the following: disk usage, central processing unit (CPU) usage, memory usage, and cryptographic resource pool usage.

[0081] It is understandable that the log information obtained by the probe includes a large amount of data, which are not all data corresponding to the cryptographic application to be detected, so it is necessary to extract the required data from all the obtained data. Specifically, this embodiment adds labels to different types of data in the log information obtained by the probe, and systematically classifies the data, so as to more effectively extract audit-related data.

[0082] Furthermore, since the audit data may come from the log information of different components in the target cryptographic cloud platform, the formats of these audit data may be different. In order to reduce parsing errors and data processing problems caused by inconsistent formats, these audit data in different formats can be converted into a unified format through format normalization.

[0083] In addition, the audit data extracted from the log information may be too concise or too technical to be directly understood. Therefore, in order to enhance the availability, accuracy and analysis depth of the data, the audit data is enriched to improve its comprehensibility.

[0084] Exemplarily, information enrichment processing of audit data can be performed by adding contextual information to audit data, such as converting user identification (ID) into user name, converting IP address into address location, etc., to make audit data more intuitive and easy to understand. It can also be performed by adding more dimensions and attributes to audit data, such as adding detailed information of timestamp, detailed description of operation type, etc., to make audit data analysis more comprehensive and in-depth.

[0085] It is worth noting that the execution subject of this step can be implemented as Figure 1 The information collection module shown.

[0086] S203: Compare the audit data with the preset audit data to generate an audit result.

[0087] In this step, the audit data after format normalization and information enrichment is sent to Figure 1The data storage analysis unit and the audit data analysis unit in the password data analysis module shown. The audit data sent to the data storage analysis unit is securely stored by the secure storage layer in the password intelligent supervision and detection system to ensure that the audit data is protected at all stages of transmission, processing and storage to prevent unauthorized access, tampering or loss.

[0088] Next, the audit data is analyzed by the audit data analysis unit in the password data analysis module, and the audit data is compared with the preset audit data to generate an audit result.

[0089] In one possible implementation, Figure 3 is a flowchart of the audit data analysis process applicable to the embodiment of the present application, such as Figure 3 As shown, the specific steps are as follows:

[0090] Step a1: Obtain the log information of the business system of the target cryptographic cloud platform through the probe.

[0091] Step a2: The probe sends the acquired log information to the password intelligent supervision and detection system.

[0092] Step a3: extract audit data from the log information through the data collection module of the password intelligent supervision and detection system.

[0093] Exemplarily, the data collection module may collect all data in the log information through a preset protocol, wherein the preset protocol may be a Simple Network Management Protocol (SNMP), a Representational State Transfer (REST)-based protocol RESTful, or the like.

[0094] Furthermore, labels are added to all collected data to extract audit data from them.

[0095] Step a4: The data collection module sends the audit data to the password data analysis module so as to determine whether there is any abnormal behavior in the audit data through the audit data analysis unit in the password data analysis module.

[0096] Exemplarily, abnormal behaviors include business abnormalities, resource abnormalities, system abnormalities, and operation abnormalities.

[0097] Among them, business anomalies include log anomalies, specifically anomalies in the caller IP (such as different from the provided IP), anomalies in the call frequency (such as more than 5 calls initiated per second), etc.; and failure to call the cryptographic service interface, such as more than 10 failures of the cryptographic service interface every 30 seconds.

[0098] Resource anomalies include host status abnormalities, such as user IP and disk usage exceeding 90%, user IP and CPU usage exceeding 80% on average within 30 minutes, user IP and memory usage exceeding 70% on average within 30 minutes, etc.; and resource pool status abnormalities, such as the cryptographic resource pool (cryptographic hardware, container) usage exceeding 80%, abnormal information returned by the cryptographic device status, etc.

[0099] System anomalies include more than 5 consecutive login failures within 3 minutes, unauthorized access, etc. Operation anomalies include more than 5 system operation failures within 10 seconds, etc.

[0100] It is worth noting that the audit data analysis unit in the password data analysis module includes a data processing part and a data analysis part. Further, if there is no abnormal behavior in the audit data, step a5 is executed; if there is abnormal behavior in the audit data, step a6 is executed.

[0101] Step a5: The audit data analysis unit sends the audit data to the data processing part.

[0102] Specifically, the data processing part performs routine processing on normal audit data, such as data cleaning, data analysis and other routine operations, and extracts basic information related to encryption and transmission in the audit data, such as cryptographic data type, cryptographic algorithm type, transmission protocol type, cryptographic algorithm, etc.

[0103] Step a6: The audit data analysis unit sends the audit data to the data analysis part.

[0104] Specifically, the data analysis part conducts in-depth analysis of abnormal audit data. In addition to extracting basic information of the audit data, it also identifies detailed information related to the abnormal behavior, such as abnormal behavior type, user information, device information, operation type, etc.

[0105] Step a7: After the data processing part and the data analysis part complete the relevant operations on the audit data, the relevant information of the audit data is sent to the monitoring and display module for display.

[0106] Among them, the relevant information of the audit data extracted by the data processing part and the data analysis part is the audit result generated after comparing the audit data with the preset audit data.

[0107] In a possible implementation, if the relevant information received by the monitoring and display module is sent by the data analysis part, alarm management can also be performed to inform the user that the audit data corresponding to the relevant information is abnormal.

[0108] It should be noted that in the above process of analyzing audit data, in order to achieve efficient, reliable and scalable data stream processing, the data involved in the entire process can be sent to the Kafka message queue for transmission. Since Kafka is used to process high-throughput data streams, it can process millions of messages per second while maintaining low latency, which makes it very suitable for application scenarios that require fast and real-time data transmission.

[0109] In addition, the corresponding data in the data processing part, data analysis part, and monitoring and display module can all be sent to the secure storage layer in the cryptographic intelligent supervision and detection system for safe preservation.

[0110] S204: Perform compliance testing on the cryptographic application to be tested according to preset compliance conditions and generate compliance results.

[0111] Specifically, firstly, the evaluation data of the cryptographic application to be tested is obtained, wherein the evaluation data includes at least one of the following: application cryptographic algorithm, transmission protocol, key information, cryptographic usage information, and qualification information. Secondly, according to the preset compliance conditions and the evaluation data, the compliance test is performed on the cryptographic application to be tested, and the compliance result is generated.

[0112] Exemplarily, compliance testing may include compliance in terms of correctness of cryptographic algorithm implementation, key integrity, transmission protocol security, product qualifications, cryptographic usage, etc.

[0113] Among them, the correctness of the cryptographic algorithm is specifically implemented as follows:

[0114] The cryptographic algorithm types include Data Encryption Standard (DES), Advanced Encryption Standard (AES), Message-Digest Algorithm 5 (MD5), Secure Hash Algorithm (SHA), Rivest Cipher 2 (RC2), Rivest Cipher 4 (RC4), RSA, ECC, SM1, SM2, SM3, and SM4.

[0115] According to the usage of cryptographic algorithms, cryptographic algorithm analysis is conducted. The analysis results include three categories: weak cryptographic algorithms, domestic cryptographic algorithms, and foreign cryptographic algorithms. The specific analysis is as follows:

[0116] (1) Weak cryptographic algorithms: using cryptographic algorithms such as DES, RC2, RC4, MD5, SHA, or cryptographic algorithms with a security strength of less than 80 bits;

[0117] (2) Domestic cryptographic algorithms: Use national cryptographic algorithms, including SM1, SM2, SM3, and SM4;

[0118] (3) Foreign cryptographic algorithms: Use foreign cryptographic algorithms, including RSA, AES, and ECC.

[0119] If it meets the above three types of cryptographic algorithms, the cryptographic algorithm is deemed to be implemented correctly, otherwise it is deemed to be incorrect.

[0120] The specific implementation of key integrity is as follows:

[0121] (1) When the business system is used for the first time, the key needs to be encrypted and uploaded to the password intelligent supervision and detection system. The server receives the key of the business system, decrypts it and matches it with the corresponding business system ID. Then, the business system ID and the decrypted original key are used to generate a hash value using the SM3 method, and then the signature value M1 is generated using SM2 and stored in the corresponding database according to the corresponding business system ID.

[0122] (2) When the business system uses the password intelligent supervision and detection system, it will encrypt and upload the key in the corresponding place. The password intelligent supervision and detection system will transmit the received key to the server. After the server decrypts it, it uses the manufacturer ID and the decrypted original key to generate a hash value using the SM3 method. Then use SM2 to generate the signature value M2, and then use the business system ID to retrieve the corresponding signature value M1 stored in the database. M1 and M2 are compared. If the comparison result passes, it proves that the key is complete.

[0123] The specific implementation of transmission protocol security is as follows:

[0124] The transmission protocol types include Guomi Secure Sockets Layer Version 1 (GMSSLv1), Transport Layer Security Version (TLSv1), TLSv1.2, and TLSv1.3. If it meets one of the above transmission protocol types, it is considered to be a secure transmission protocol, otherwise it is not secure.

[0125] The specific implementation method of product qualification is as follows: the business system first needs to upload the relevant qualification certificate of the password application. The password intelligent supervision and detection system will check and verify the validity period of the password application's qualifications. If it has not expired, it is normal. If it has expired or not uploaded, it will prompt a dangerous behavior event.

[0126] The specific implementation of password usage is as follows:

[0127] (1) Key status: the number of keys allocated and used by cryptographic devices, including the number of symmetric keys, asymmetric keys, and the corresponding number of currently used keys;

[0128] (2) Cryptographic service status: The cryptographic service usage status of the cryptographic cloud platform is synchronized to the cryptographic intelligent supervision and detection system, so that the cryptographic intelligent supervision and detection system can view the total number of current cryptographic service calls in real time;

[0129] (3) Cryptographic device status: The total number of cryptographic devices currently managed by the cryptographic cloud platform is synchronized to the cryptographic intelligent supervision and detection system, so that the cryptographic intelligent supervision and detection system can view the total number of currently used cryptographic devices in real time;

[0130] (4) Business application status: The cryptographic cloud platform includes business applications such as database encryption system, electronic signature server, data certificate system, mobile phone shield system, Secure Sockets Layer Virtual Private Network (SSL-VPN) system, key management system, and database encryption system. The access volume of various business applications is summarized, and the access volume of each type of business application can be viewed in real time in the cryptographic intelligent supervision and detection system.

[0131] In a possible implementation, in addition to performing compliance testing on the cryptographic application to be tested, a correlation analysis may be further performed on the cryptographic application to be tested. Figure 4 is a functional module diagram of the cryptographic application analysis process to be detected applicable to the embodiment of the present application, such as Figure 4 As shown, the analysis process of the password application to be detected is implemented based on the event collection module, the event analysis module, and the post-correlation analysis module.

[0132] Specifically, the event collection module is used to obtain the cryptographic applications to be detected and conduct compliance detection on the cryptographic applications to be detected. Further, the event analysis module is used to analyze the detection results of the compliance detection to obtain compliant cryptographic applications and non-compliant cryptographic applications, wherein an alarm can also be issued for non-compliant cryptographic applications. Next, the post-correlation analysis module is used to conduct correlation analysis on the historical events corresponding to the cryptographic applications to be detected with a large time span (such as more than 3 years), and finally generate compliance results.

[0133] Among them, the historical events corresponding to the password application to be detected may include potential security risk events, dangerous behavior events and critical security events.

[0134] For example, potential security risk events refer to historical events of cryptographic applications to be tested that have been used for more than 3 years and whose remaining validity period is less than 3 months. Dangerous behavior events refer to unsafe events detected by the intelligent cryptographic supervision and detection system, including illegal use of cryptographic algorithms, incomplete keys, insecure transmission protocols, expired product qualifications, etc. Critical security events refer to dangerous behavior events detected by the intelligent cryptographic supervision and detection system. If they are not rectified within 3 months, they will be upgraded to critical security events.

[0135] It can be seen that the password application to be detected should be a password application whose usage time exceeds the first preset time or whose remaining validity period is less than the second preset time, and the first preset time is greater than the second preset time. In combination with the above example, for example, the first preset time can be set to 3 years and the second preset time can be set to 3 months.

[0136] S205. Determine the audit results and compliance results as the detection results of the cryptographic application to be detected.

[0137] Further, the detection results of the password application to be detected can be stored, such as storing the detection results in a secure storage layer in the password intelligent supervision and detection system. In addition, the detection results can also be displayed and warned on a display screen to inform the user of abnormal password applications.

[0138] The password application detection method provided by the present application obtains log information from the target password cloud platform where the password application to be detected is deployed based on the probe, and extracts audit data from all data corresponding to the log information through a systematic method to ensure that the obtained audit data is no longer disordered. Among them, the audit data is the user activity record of the password application to be detected and the performance index of the target password cloud platform, and the audit data belongs to one of the password data corresponding to the password application. Next, the audit data is compared with the preset audit conditions, which can be understood as judging the abnormal behavior of the audit data and generating corresponding audit results. Further, the password application to be detected is subjected to compliance detection according to the preset compliance conditions, and the correlation analysis is performed to generate the corresponding compliance results, and finally the audit results and compliance results are determined as the detection results of the password application to be detected for storage and display. Detecting the audit data ensures the security of the audit data itself, while the compliance detection of the password application ensures the security of the password application when processing the audit data. By performing double detection on the audit data and the password application, the accuracy of the password application detection results is effectively improved to prevent potential security threats.

[0139] Figure 5 This is a schematic diagram of the structure of the password application detection device provided in this application. Figure 5As shown, the password application detection device 500 includes: an acquisition module 501, an extraction module 502, a processing module 503, a detection module 504, and a determination module 505;

[0140] Wherein, the acquisition module 501 is used to obtain log information of a target cryptographic cloud platform, where the cryptographic application to be detected is deployed;

[0141] Extraction module 502, used to extract audit data from the log information of the target cryptographic cloud platform, the audit data being user activity records of the cryptographic application to be detected and performance indicators of the target cryptographic cloud platform;

[0142] Processing module 503, used to compare the audit data with the preset audit conditions and generate audit results;

[0143] A detection module 504, configured to perform compliance detection on the cryptographic application to be detected according to a preset compliance condition and generate a compliance result;

[0144] The determination module 505 is used to determine the audit results and the compliance results as the detection results of the cryptographic application to be detected.

[0145] Optionally, the extraction module 502 further includes: a calling module 506, configured to:

[0146] The Internet Protocol IP, frequency, number of failures of the user who calls the cryptographic service interface of the cryptographic application to be tested, the number of login failures of the user who accesses the business system of the cryptographic application to be tested, the number of operation failures, and the status parameters of the cryptographic device corresponding to the cryptographic application to be tested;

[0147] The performance indicators include at least one of the following:

[0148] Disk usage, central processing unit cpu usage, memory usage, password resource pool usage.

[0149] Optionally, the acquisition module 501 is further used to acquire log information from the target cryptographic cloud platform based on the probe.

[0150] Optionally, the acquisition module 501 is further used to acquire evaluation data of the cryptographic application to be detected, the evaluation data including at least one of the following: application cryptographic algorithm, transmission protocol, key information, cryptographic usage information, and qualification information;

[0151] The detection module 504 is further used to perform compliance detection on the cryptographic application to be detected according to preset compliance conditions and evaluation data, and generate a compliance result.

[0152] Optionally, the password application to be detected is a password application whose usage time exceeds a first preset time or whose remaining validity period is less than a second preset time, and the first preset time is greater than the second preset time.

[0153] Optionally, the password application detection device 500 further includes: a storage module 507, a display module 508,

[0154] The storage module 507 is used to store the detection result of the password application to be detected;

[0155] The display module 508 is used to display the detection result of the password application to be detected on the display screen.

[0156] It should be understood that the extraction module 502 can be implemented as Figure 1 The information collection module and processing module 503 shown can be implemented as Figure 1 The password data analysis module and the detection module 504 shown can be implemented as Figure 1 The compliance assessment module shown.

[0157] The password application detection device provided in the embodiment of the present application can be used to execute the password application detection method in any of the above embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0158] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0159] Figure 6 The hardware structure diagram of the password application detection device provided for this application. Figure 6 As shown, the password application detection device 600 includes:

[0160] Processor 601 and memory 602;

[0161] Memory stores computer-executable instructions;

[0162] The processor executes the computer execution instructions stored in the memory 602, so that the password application detection device executes the password application detection method as described above.

[0163] It should be understood that the processor 601 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), ASICs, etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor. The memory 602 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a disk or an optical disk.

[0164] The password application detection device provided in the embodiment of the present application can be used to execute the password application detection method provided in any of the above method embodiments. Its implementation principles and technical effects are similar and will not be repeated here.

[0165] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the password application detection method as described above.

[0166] The embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it is used to implement the password application detection method as described above.

[0167] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0168] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0169] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0170] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0171] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0172] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0173] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0174] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0175] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A password application detection method, characterized in that: include: Obtaining log information of a target cryptographic cloud platform, where the cryptographic application to be detected is deployed; Extracting audit data from the log information of the target cryptographic cloud platform, wherein the audit data is a user activity record of the cryptographic application to be detected and a performance indicator of the target cryptographic cloud platform; Comparing the audit data with preset audit conditions to generate audit results; Performing compliance testing on the cryptographic application to be tested according to preset compliance conditions and generating compliance results; The audit result and the compliance result are determined as the detection result of the cryptographic application to be detected.

2. The method according to claim 1, characterized in that: The user activity record includes at least one of the following: The Internet Protocol IP, frequency, and number of failures of the user who calls the cryptographic service interface of the cryptographic application to be detected, the number of login failures and operation failures of the user who accesses the business system of the cryptographic application to be detected, and the status parameters of the cryptographic device corresponding to the cryptographic application to be detected; The performance indicators include at least one of the following: Disk usage, central processing unit cpu usage, memory usage, password resource pool usage.

3. The method according to claim 1 or 2, characterized in that: The obtaining of log information of the target cryptographic cloud platform includes: Based on the probe, the log information is obtained from the target cryptographic cloud platform.

4. The method according to claim 1 or 2, characterized in that: The step of performing compliance testing on the password application to be tested according to the preset compliance condition and generating a compliance result includes: Acquire evaluation data of the cryptographic application to be detected, wherein the evaluation data includes at least one of the following: application cryptographic algorithm, transmission protocol, key information, cryptographic usage information, and qualification information; According to the preset compliance condition and the evaluation data, compliance detection is performed on the cryptographic application to be detected to generate the compliance result.

5. The method according to claim 4, characterized in that The password application to be detected is a password application whose usage time exceeds a first preset time or whose remaining validity period is less than a second preset time, and the first preset time is greater than the second preset time.

6. The method according to claim 1 or 2, characterized in that: The method further comprises: Storing the detection result of the password application to be detected; The detection result of the password application to be detected is displayed on the display screen.

7. A password application detection device, characterized in that: include: An acquisition module, used to acquire log information of a target cryptographic cloud platform, where the cryptographic application to be detected is deployed; An extraction module, used to extract audit data from the log information of the target cryptographic cloud platform, wherein the audit data is a user activity record of the cryptographic application to be detected and a performance indicator of the target cryptographic cloud platform; A processing module, used to compare the audit data with preset audit conditions and generate audit results; A detection module, used to perform compliance detection on the detection password application according to preset compliance conditions and generate a compliance result; A determination module is used to determine the audit result and the compliance result as the detection result of the cryptographic application to be detected.

8. A password application detection device, characterized in that: Applied to a security platform, comprising: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the password application detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the password application detection method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The invention comprises a computer program, which is used to implement the password application detection method according to any one of claims 1 to 6 when executed by a processor.

Images