Financial bank business security test method, device, equipment and medium

Abstract

The invention relates to a financial banking business safety test method, device, equipment and medium, and belongs to the technical field of financial business safety test, and the method comprises the steps: constructing a safety label of an electronic banking business system according to a safety rule of an EAP platform architecture; setting a security scanner according to the rule of the security label, scanning the code of the bank business system, and feeding back a problem according to a scanning result; according to the version condition of the current banking business system, dynamically generating a security change point, associating the security change point with a security test case library, and performing security test on the banking business system; and analyzing the test result, finding out security vulnerabilities in the banking business system, and repairing the security vulnerabilities according to the priorities. According to the method, the financial bank business security test is carried out in a mode of combining static scanning and dynamic test, the efficiency and accuracy of the financial bank business security test are improved, the test cost is reduced, and security vulnerabilities of a business system are comprehensively covered.

Description

Technical Field

[0001] The present invention relates to a financial banking business security testing method, device, equipment and medium, specifically a financial banking business security testing method, device, equipment and medium based on the combination of static scanning and dynamic testing, belonging to the technical field of financial business security testing. Background Art

[0002] With the rapid development of information technology in the financial and banking industries, business systems are becoming more and more complex, and the security risks they face are also increasing. Traditional business security testing methods mainly include manual testing and single static scanning or dynamic testing, which have problems such as low testing efficiency, incomplete coverage, and high false positive rate. Manual testing requires a lot of manpower and time, and is prone to omissions and errors. Single static scanning can only detect potential security vulnerabilities in the code, but cannot discover security issues at runtime. Single dynamic testing needs to be performed while the system is running, which is costly and may affect the normal operation of the system.

[0003] At present, most business security tests on the market often use productized scanning tools based on unified vulnerability feature rules to scan first, and then conduct manual testing. There is no function to verify the underlying logic of the code. At this time, the program has been released to the test environment or even production, and the cost of problem repair is high, and the risk is relatively large. The rules are also implemented at the business processing logic level, which results in the degree of fragmentation of the business processing logic, which determines the accuracy of the test results. Especially in financial business systems with relatively complex logic, general vulnerability scanning tools fail to closely fit the platform architecture in terms of business logic vulnerabilities, and the false alarm rate is also relatively high. There is a lack of scanning mechanisms based on the underlying processing logic.

[0004] In order to solve the problem of incomplete coverage of business security testing of financial banking business systems, the present invention proposes a financial banking business security testing method, device, equipment and medium. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a financial banking business security testing method, device, equipment and medium, which can improve the efficiency and accuracy of business security testing, reduce testing costs, and comprehensively cover the security vulnerabilities of the business system.

[0006] The technical solution adopted by the present invention to solve the technical problem is: In a first aspect, the present invention provides a financial banking service security testing method, comprising the following steps: Step S1, constructing a security label for the electronic banking business system according to the security rules of the EAP platform architecture; Step S2, according to the rules of the security label, set up a security scanner to scan the code of the banking system, and feedback the problem based on the scanning results; Step S3, dynamically generate security change points according to the current version of the banking business system, and associate them with the security test case library to perform security testing on the banking business system; Step S4, analyzing the test results, finding out the security holes in the banking system, and repairing them according to the priority.

[0007] As a possible implementation of this embodiment, the security tag includes a tag name and tag attributes, and the tag attributes include but are not limited to type, verification rules, and parameters.

[0008] As a possible implementation of this embodiment, the construction of a security label for the electronic banking business system includes: Step S11, determining the security requirements and security policies that the banking system needs to meet; Step S12, defining the attributes required for each security tag according to the security requirements and security policies of the banking system; Step S13, mapping each tag to a corresponding component; Step S14, generating security rules according to security requirements and tag attributes; Step S15, verifying whether the generated security rules can correctly protect the business system from security threats; Step S16: After the security test, the security labels and rules need to be continuously monitored and improved.

[0009] As a possible implementation manner of this embodiment, the security requirement refers to preventing unauthorized persons or devices from accessing protected areas of the financial banking system and performing unconventional operations.

[0010] As a possible implementation of this embodiment, the security scanner includes static scanning rules and dynamic security testing rules; The static scanning rule refers to a method of using pre-defined rules to detect security issues during the scanning process, scanning the code and resources in the application file system to check whether there are security vulnerabilities; The dynamic security testing rules are to monitor the behavior of the code in real time during the scanning process, test it when the application is actually running, detect whether there are activities with security risks, and determine whether there are security vulnerabilities.

[0011] As a possible implementation of this embodiment, step S3 dynamically generates a security change point according to the version of the current banking business system, and associates it with a security test case library to perform security testing on the banking business system, including: Step S31, collecting banking system related information and security vulnerability information, as well as a security test case library; Step S32, establishing a security model based on the environment and security requirements of the banking system; Step S33, dynamically generating security change points in the banking system; Step S34, associating the generated security change points with the security test case library, determining the security threat points, and generating security test cases; Step S35, perform security testing to detect and repair any known vulnerabilities and security weaknesses; Step S36 monitors the continuous integration and release behavior of the test environment of the banking business system. If a new version is found, it can automatically sense the security change point, start static scanning, generate security test cases, and push them to security testers to perform security testing to ensure the continued security and stability of the system.

[0012] As a possible implementation of this embodiment, during the security test, dynamic testing may be performed in combination with interactive application security testing.

[0013] In a second aspect, an embodiment of the present invention provides a financial banking service security testing device, comprising: A security label building module is used to build a security label for the electronic banking business system according to the security rules of the EAP platform architecture; The code security scanning module is used to set up a security scanner according to the rules of the security label, scan the code of the banking business system, and feedback problems based on the scanning results; The system security testing module is used to dynamically generate security change points according to the current version of the banking business system, and associate them with the security test case library to perform security testing on the banking business system; The test result analysis module is used to analyze the test results, identify security vulnerabilities in the banking system, and repair them according to priority.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to perform steps of any of the above-mentioned financial banking business security testing methods.

[0015] In a fourth aspect, an embodiment of the present invention provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned financial banking business security testing methods are executed.

[0016] The beneficial effects of the technical solution of the embodiment of the present invention are as follows: A financial banking business security testing method of the technical solution of the embodiment of the present invention includes the following steps: step S1, constructing a security label of the electronic banking business system according to the security rules of the EAP platform architecture; step S2, setting a security scanner according to the rules of the security label, scanning the code of the banking business system, and feedback problems according to the scanning results; step S3, dynamically generating security change points according to the version of the current banking business system, and associating them with the security test case library to perform security testing on the banking business system; step S4, analyzing the test results, finding out the security vulnerabilities in the banking business system, and repairing them according to the priority. The present invention adopts a combination of static scanning and dynamic testing to perform financial banking business security testing, which improves the efficiency and accuracy of financial banking business security testing, reduces the testing cost, and comprehensively covers the security vulnerabilities of the business system.

[0017] Compared with the prior art, the present invention has the following characteristics: (1) Improved the efficiency and accuracy of business security testing: Through automated static scanning and dynamic testing, as well as targeted testing based on security tags, security vulnerabilities in business systems can be quickly discovered, reducing false positives and missed negatives.

[0018] (2) Reduced testing costs: Automated testing can reduce manpower and time costs and improve testing efficiency and coverage.

[0019] (3) Relatively comprehensive coverage of business security vulnerabilities: The combination of static scanning and dynamic testing can detect potential security vulnerabilities in the code and security issues at runtime, comprehensively covering the security risks of the business system.

[0020] (4) Improved business system security: By timely discovering and repairing security vulnerabilities, the security of the business system is improved, protecting the company's assets and user privacy.

[0021] A financial banking business security testing device according to the technical solution of an embodiment of the present invention has the same beneficial effects as a financial banking business security testing method according to the technical solution of an embodiment of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a flow chart of a financial banking business security testing method according to an exemplary embodiment; Figure 2 The figure is a schematic diagram of the structure of a financial banking business security testing device according to an exemplary embodiment. DETAILED DESCRIPTION

[0023] In order to more clearly illustrate the technical features of the solution of the present invention, the present invention is described in detail below through specific implementation methods and in conjunction with the accompanying drawings.

[0024] like Figure 1 As shown, a financial banking service security testing method provided by an embodiment of the present invention includes the following steps: Step S1, constructing a security label for the electronic banking business system according to the security rules of the EAP platform architecture; Step S2, according to the rules of the security label, set up a security scanner to scan the code of the banking system, and feedback the problem based on the scanning results; Step S3, dynamically generate security change points according to the current version of the banking business system, and associate them with the security test case library to perform security testing on the banking business system; Step S4, analyzing the test results, finding out the security holes in the banking system, and repairing them according to the priority.

[0025] As a possible implementation of this embodiment, the security tag includes a tag name and tag attributes, and the tag attributes include but are not limited to type, verification rules, and parameters.

[0026] As a possible implementation of this embodiment, the construction of a security label for the electronic banking business system includes: Step S11, determine the security requirements and security policies that the banking system needs to meet, such as data encryption, identity authentication, access control, etc. These requirements and security policies will serve as the basis for security labels; Step S12, defining the attributes required for each security label according to the security requirements and security policies of the banking business system; these attributes may include information such as user role, function module, risk level, security policy, etc.; Step S13, mapping each tag with a corresponding component; these components may be hardware devices, software applications, network services, etc.; in the mapping process, the dependencies and interactions between components need to be considered; Step S14, generating security rules based on security requirements and label attributes; these rules are used to describe the behaviors and restrictions between components; when generating rules, security and efficiency in different situations need to be considered; Step S15, verify whether the generated security rules can correctly protect the business system from security threats; this can be achieved by simulating attacks and vulnerability scanning; if the rules cannot effectively protect the business system, the rules need to be revised to meet security requirements; Step S16, after the security test, security labels and rules need to be continuously monitored and improved; this can help discover new security vulnerabilities and risks, and update security rules and label attributes in a timely manner to maintain the security of the business system.

[0027] Through the above steps, security labels and rules that comply with the EAP platform architecture security rules can be constructed to ensure the security and reliability of the business system.

[0028] As a possible implementation manner of this embodiment, the security requirement refers to preventing unauthorized persons or devices from accessing protected areas of the financial banking system and performing unconventional operations.

[0029] As a possible implementation of this embodiment, the security scanner includes static scanning rules and dynamic security testing rules; The static scanning rule refers to a method of using pre-defined rules to detect security issues during the scanning process, scanning the code and resources in the application file system to check whether there are security vulnerabilities; The dynamic security testing rules monitor the behavior of the code in real time during the scanning process, test it when the application is actually running, detect whether there are activities with security risks, and determine whether there are security vulnerabilities.

[0030] As a possible implementation of this embodiment, step S3 dynamically generates a security change point according to the version of the current banking business system, and associates it with a security test case library to perform security testing on the banking business system, including: Step S31, collecting banking system related information and security vulnerability information, as well as a security test case library; this information can be obtained through investigation, analysis, interviews, etc.; Step S32, establishing a security model based on the specific environment and security requirements of the banking system; the model should consider various possible attack methods and vulnerability types, as well as how to perform testing and iteration; Step S33, dynamically sense security change points in the banking system; these security change points are for predicted vulnerabilities and security weaknesses; they may include code modifications, configuration changes, log record modifications, etc.; these security change points should be designed to be minimally invasive and implemented without affecting system performance; Step S34, associating the generated security change point with the security test case library; each security change point should have a unique identifier and a descriptive description to facilitate identification and management, and matching to the corresponding security test case; Step S35, perform security testing to detect and repair any known vulnerabilities and security weaknesses; these tests can use the initialization security test cases in the security test case library, or can use newly generated security change points to trigger the test; Step S36 monitors the continuous integration and release behavior of the test environment of the banking business system. If a new version is found, it can automatically sense the security change point, start static scanning, generate security test cases, and push them to security testers to perform security testing to ensure the continued security and stability of the system.

[0031] Through the above steps, banking institutions can timely discover and safely repair potential security holes and weaknesses, thereby improving the security and reliability of banking business systems.

[0032] As a possible implementation of this embodiment, during the security test, dynamic testing may be performed in combination with interactive application security testing.

[0033] like Figure 2 As shown, a financial banking business security testing device provided by an embodiment of the present invention includes: A security label building module is used to build a security label for the electronic banking business system according to the security rules of the EAP platform architecture; The code security scanning module is used to set up a security scanner according to the rules of the security label, scan the code of the banking business system, and feedback problems based on the scanning results; The system security testing module is used to dynamically generate security change points according to the current version of the banking business system, and associate them with the security test case library to perform security testing on the banking business system; The test result analysis module is used to analyze the test results, identify security vulnerabilities in the banking system, and repair them according to priority.

[0034] The construction of the security tag of the present invention relies on the EAP platform architecture, which is highly targeted and adaptable, and can accurately meet specific security requirements. Its stable and reliable characteristics provide a solid foundation for the smooth construction and effective application of security tags. The stability and reliability of the EAP platform architecture provide a reliable operating environment for the construction and application of security tags.

[0035] The financial banking security testing framework of the present invention is divided into a front-end interaction layer, a business logic layer, a data storage layer and an infrastructure layer in terms of overall structure, and its functional components include security label creation and management, a security component library, and interface management, etc. The working principle and logic are that developers automatically generate security labels by the development IDE according to interface attributes, each component in the security component library protects against different security risks according to protection rules, the interface management module establishes a corresponding relationship between the interface and the security label, and the security scanner scans the legality of the security label configuration in the code according to the rules, and the rules can be flexibly configured manually.

[0036] The front-end interaction layer allows users to operate and view security information. The business logic layer has modules such as security label management, security component library management, interface management, and rule formulation. The data storage layer includes security labels, security component libraries, and interface information databases. The infrastructure layer provides hardware and software environments.

[0037] Functionally, security labels can be customized according to interface attributes. The security component library covers multiple important components, such as sensitive information, unauthorized access, and amount verification, and each component protects against specific security risks. Interface management establishes a corresponding relationship between interfaces and security labels to clarify the ownership of security components. Security scanning checks the legitimacy of the code based on rules, and the rules can be manually customized and optimized.

[0038] In terms of working principle, the development IDE automatically generates security labels based on interface attributes, which can be adjusted by security managers. Each security component protects against security risks according to rules. Interface management provides data for security scanning, and the scanner checks the label configuration. If it is inconsistent, it will report an exception. Rules can be optimized as the business changes. The functional modules collaborate to provide security protection for financial business systems with platform stability and low-code convenience.

[0039] Through the convenient features of low code, a solid technical foundation and flexible architecture support have been built for the creation and management of security labels. The development platform reversely customizes a security component library with protection rules according to security attack rules, which covers multiple security components such as sensitive information, unauthorized access, legal amount verification, interface field forward verification, rate check, illegal character verification, etc., and each component has its corresponding security label for identification.

[0040] Sensitive information components strictly follow the financial industry standard "Personal Financial Information Protection Technical Specifications" to encrypt fields containing sensitive content such as customer personal identity information, account passwords, and account data. Using cutting-edge encryption algorithms, even if the data is illegally obtained during transmission or storage, it is difficult to crack and interpret. At the same time, sensitive information is desensitized for display. For example, in the customer information display interface, only some key information is presented, and the rest is blurred, which minimizes the risk of information leakage without interfering with the normal operation of the business.

[0041] The over-authorization component is mainly used to control the user's transaction permissions. With the help of authentication and verification of user sessions and identities, the transaction functions that users can access and the scope of data requested are strictly controlled. For example, during user login and operation, user behavior is monitored in real time. Once an attempt to operate beyond the permission is detected, it is immediately intercepted and an alarm is issued.

[0042] The amount legality verification component focuses on conducting strict reviews of business operations involving amounts. In the financial transaction system, multi-dimensional verification is implemented on the input amount value. First, check whether the range of the amount is reasonable to prevent large transactions that exceed the business license or unreasonable small transactions. Second, verify whether the format of the amount is correct and conforms to the standard format of the currency.

[0043] The interface field forward verification component can ensure that the data transmitted by the interface is accurate. When different system modules exchange data through the interface, the component will perform strict forward verification on the fields of the input interface. Carefully check whether the length of the field meets the requirements to prevent system errors caused by data that is too long or too short. At the same time, verify whether the type of the field is accurate, for example, a numeric field cannot contain non-numeric characters, and a text field cannot exceed the specified length.

[0044] The rate check component is committed to ensuring that the rate calculation and application in the business are accurate and compliant. In business scenarios involving rates, such as handling fees and interest rates, this component will strictly check the rate calculation process and the necessity of sending rate request messages. Ensure that the rate value complies with business regulations and legal and regulatory requirements to avoid damage to customer interests or increased bank operating risks due to incorrect rate calculations.

[0045] The illegal character check component can effectively prevent malicious code injection and illegal character input. When the user inputs data or the system receives external data, the component will conduct a comprehensive (SQL injection, XSS attack) illegal character check on the input content. Detect whether there are special characters, script codes or malicious instructions that may cause security vulnerabilities in the system. Strictly filter the query statements entered by the user to remove characters that may be used to attack the database.

[0046] At the same time, the corresponding relationship between interfaces and security labels is established at the security baseline layer, that is, the system clarifies the necessary usage scenarios of security labels and clearly defines the relationship between security components and interface types. For example, if an interface belongs to an accounting interface, the system will automatically configure an unauthorized label in the developed code. Then, based on the clear correspondence between interfaces and security labels, scanning rules are formulated for them.

[0047] The security scanner is a script tool with interface and security label forward matching rules. When the scanner is running, the system will compare the label configuration in the detected code with the rules in the scanner for consistency. If there is a mismatch, an exception report will be output. The scanner can be executed manually and also supports use in CI (continuous integration) gates.

[0048] Security tags include tag names and attributes, such as type, validation rules, parameters, etc. Security tags can be dynamically generated during the development phase, and are bound to security components upstream and static security scanning rules downstream.

[0049] The dynamic generation of security tags during the development phase means that developers can choose to automatically load or define corresponding security protection codes through the development IDE based on interface properties.

[0050] The upstream is bound to the security component, and there is a one-to-one correspondence between the security label and the security component. The security label serves as an identification for the security component. Each security component has its own unique function and purpose, which can clearly indicate the type of security protection provided by the component. For example, the label "Sensitive Information Protection" clearly indicates that the corresponding security component is used to protect sensitive information. Through security labels, developers, security managers, and systems can quickly and accurately identify specific security components at runtime, so that they can be quickly called when corresponding security protection is needed.

[0051] The downstream is bound to the static security scanning rules of the interface, and the rules of the security scanner come from the code configuration check of the security label rules. In other words, the optimization and improvement of security labels can positively promote the rule iteration of the security scanner. Similarly, the rule evolution of the security scanner can also promote the continuous optimization of security labels and improve security quality.

[0052] Sustainable iteration layer: including the sustainable iteration of security components, business rules, and security labels. The iteration of security components is upgraded as the demand changes; business rules mainly refer to the definition of the field data dictionary in each interface, which directly affects the verification rules of security labels; labels can be added, extended, modified, or deleted. In short, the platform component library provides the system's protection rules, and there is a corresponding relationship between labels and platform component libraries. Specific static scanning rules need to be defined based on business rules.

[0053] Security components are software modules or function sets designed to protect system security. They can be called as independent modules or work together with other security components or system functions to ensure the security of the development process. For example, in a mobile banking system, security components can be integrated into key links such as unauthorized protection of user login transactions, protection of sensitive information, and security protection of transaction data transmission to achieve multi-faceted security protection.

[0054] Business rules refer to the embodiment of the system's business functions in technical processing logic. Developers implement business rules by defining program execution logic to ensure that business operations are performed in the system in a prescribed manner.

[0055] The sustainable iteration of security components, business rules, and security labels influence and promote each other. The iteration of business needs requires corresponding security components to meet the needs of security protection. Business rules determine the internal logic of security components. For example, in a transfer transaction, since the account interface is required, according to the label configuration rules, the account interface needs to be configured with an unauthorized label. This label will perform a consistency check on the payer account sent in the message request and the payment account in the session to ensure that the payer is the person himself. In addition, the security label plays an identification role for the security component, which is convenient for developers to call.

[0056] In the logic control layer, add security access control in the CI of the test environment to intercept and prevent code with security vulnerabilities from being released to the test environment, reducing security escapes. In the logic control layer, the blocking rules of the CI security access control are defined, and the whitelist exemption mechanism for special circumstances is clarified. It can be configured according to needs, automatically perform static scanning, and generate test reports, and shift business security testing left to the automated pipeline and security access control. During the continuous integration process, when the security access control finds that there is a problem with the label defined in a certain program interface, it will perform blocking control and send the exception information to the relevant person in charge through the internal email service for processing. At this time, in order not to affect the overall security and functionality of the program, the problematic version will also be rolled back. From the start of execution to report generation, the entire process does not require human participation.

[0057] During the continuous integration phase of the test environment, the CI tool will execute the security scanner to check the legality of the security label configuration in the code. During the test phase, security change points are discovered through incremental code inspection to facilitate security testing: Scanning rules can be manually customized and optimized. For example, if an interface adds an account field, then it is necessary to add a scan item for this field to the scanner's rules to ensure that the rules can maintain accuracy as the business changes.

[0058] Analyze the code differences between the current version and the previous version, form security change points through internal algorithm analysis, and push them to the person in charge of security testing to assign testing tasks.

[0059] Security change points are generated from the code difference analysis results of the previous and next versions, including specific incremental changes in interface names, field names, transaction names, etc. The system exports these change points, associates them with the security test case library, and generates manual test cases.

[0060] During the dynamic execution phase of the test case, it can be handed over to the security tester for manual execution, or it can be combined with IAST (interactive application security testing) for dynamic testing to simulate various attack scenarios and detect the security of the system. Targeted testing is carried out based on security tags to improve the accuracy and efficiency of the test. IAST (interactive application security testing) is a new application security testing technology that combines the advantages of dynamic application security testing (DAST) and static application security testing (SAST). It performs security testing when the application is running, can more accurately discover security vulnerabilities, and has less impact on application performance. By inserting agents or bytecode enhancement technology into the application to achieve security monitoring, it can detect a variety of security vulnerabilities, such as SQL injection, cross-site scripting attacks, etc.

[0061] An electronic device provided by an embodiment of the present invention includes a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to perform steps of any of the above-mentioned financial banking business security testing methods.

[0062] Specifically, the above-mentioned memory and processor can be general-purpose memory and processor, which are not specifically limited here. When the processor runs the computer program stored in the memory, the above-mentioned financial banking business security testing method can be executed.

[0063] Those skilled in the art will appreciate that the structure of the computer device does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently.

[0064] Corresponding to the method for starting the above-mentioned application, an embodiment of the present invention further provides a storage medium on which a computer program is stored. When the computer program is run by a processor, the steps of any of the above-mentioned financial banking business security testing methods are executed.

[0065] The application startup device provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The device provided in the embodiment of the present application, its implementation principle and the technical effect produced are the same as those in the aforementioned method embodiment. For the sake of brief description, the parts not mentioned in the device embodiment can refer to the corresponding contents in the aforementioned method embodiment. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0066] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0067] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0068] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0069] In addition, each functional module in the embodiments provided in the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0070] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0071] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0072] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0073] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A financial banking business security testing method, characterized in that: The steps include: Step S1, constructing a security label for the electronic banking business system according to the security rules of the EAP platform architecture; Step S2, according to the rules of the security label, set up a security scanner to scan the code of the banking system, and feedback the problem based on the scanning results; Step S3, dynamically generate security change points according to the current version of the banking business system, and associate them with the security test case library to perform security testing on the banking business system; Step S4, analyzing the test results, finding out the security holes in the banking system, and repairing them according to the priority.

2. The financial banking business security testing method according to claim 1, characterized in that: The security tag includes a tag name and tag attributes, and the tag attributes include but are not limited to type, verification rules, and parameters.

3. The financial banking business security testing method according to claim 1, characterized in that: The security label for constructing the electronic banking system includes: Step S11, determining the security requirements and security policies that the banking system needs to meet; Step S12, defining the attributes required for each security tag according to the security requirements and security policies of the banking system; Step S13, mapping each tag with a corresponding component; Step S14, generating security rules according to security requirements and tag attributes; Step S15, verifying whether the generated security rules can correctly protect the business system from security threats; Step S16: After the security test, the security labels and rules need to be continuously monitored and improved.

4. The financial banking business security testing method according to claim 3, characterized in that: The security requirement is to prevent unauthorized persons or devices from accessing protected areas of the financial banking system and performing non-routine operations.

5. The financial banking business security testing method according to claim 1, characterized in that: The security scanner includes static scanning rules and dynamic security testing rules; The static scanning rule refers to a method of using pre-defined rules to detect security issues during the scanning process, scanning the code and resources in the application file system to check whether there are security vulnerabilities; The dynamic security testing rules are to monitor the behavior of the code in real time during the scanning process, test it when the application is actually running, detect whether there are activities with security risks, and determine whether there are security vulnerabilities.

6. The financial banking business security testing method according to any one of claims 1 to 5, characterized in that: The step S3 dynamically generates security change points according to the current version of the banking business system, and associates them with the security test case library to perform security testing on the banking business system, including: Step S31, collecting banking system related information and security vulnerability information, as well as a security test case library; Step S32, establishing a security model based on the environment and security requirements of the banking system; Step S33, dynamically sensing security change points in the banking system; Step S34, associating the generated security change points with the security test case library, determining the security threat points, and generating security test cases; Step S35, perform security testing to detect and repair any known vulnerabilities and security weaknesses; Step S36 monitors the continuous integration and release behavior of the test environment of the banking business system. If a new version is found, it can automatically sense the security change point, start static scanning, generate security test cases, and push them to security testers to perform security testing to ensure the continued security and stability of the system.

7. The financial banking business security testing method according to claim 6, characterized in that: During security testing, dynamic testing can be performed in conjunction with interactive application security testing.

8. A financial banking security testing device, characterized in that: include: A security label building module is used to build a security label for the electronic banking business system according to the security rules of the EAP platform architecture; The code security scanning module is used to set up a security scanner according to the rules of the security label, scan the code of the banking business system, and feedback problems based on the scanning results; The system security testing module is used to dynamically generate security change points according to the current version of the banking business system, and associate them with the security test case library to perform security testing on the banking business system; The test result analysis module is used to analyze the test results, identify security vulnerabilities in the banking system, and repair them according to priority.

9. An electronic device, characterized in that: It includes a processor, a memory and a bus, the memory stores machine-readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, and the processor executes the machine-readable instructions to perform the steps of the financial banking business security testing method as described in any one of claims 1-7.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, executes the steps of the financial banking business security testing method as described in any one of claims 1 to 7.

Images