Security test method and device, computer equipment and computer readable storage medium

Abstract

The invention relates to a security test method and device, computer equipment and a computer readable storage medium. The method comprises the following steps: updating a cipher suite in an encrypted communication library based on a random number to obtain an updated cipher suite; generating greeting data packets according to the updated cipher suite until the cycle index of the updated cipher suite reaches a preset cycle index threshold value, and obtaining each greeting data packet; sending the greeting data packets to a server, and indicating the server to generate verification fingerprints in batches according to the greeting data packets; and determining a test result of the server based on the test request set corresponding to each verification fingerprint. By adopting the method, the accuracy of the safety test method can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security testing method, apparatus, computer equipment, and computer-readable storage medium. Background Art

[0002] The client and server use the QUIC (Quick UDP Internet Connections) protocol to transmit data. The server receives the request sent by the client and intercepts the request based on the JA3 fingerprint (Just Another SSL / TLS Fingerprint, SSL / TLS stands for Secure Sockets Layer / Transport Layer Security) and the blacklist. However, before performing data transmission, the protection function of the JA3 fingerprint needs to be tested based on the security test method to ensure the security of the server.

[0003] In the current security testing method, the client sends a Client Hello packet to the server. The server receives the Client Hello packet and performs hash processing on the Client Hello packet based on the fingerprint algorithm to obtain a JA3 fingerprint. The JA3 fingerprint is the test sample. Then, the client tests the security of the server based on the test sample and obtains the test result.

[0004] However, the current security testing method uses only one client for testing, and one client can only generate one JA3 fingerprint, that is, the client can only test the security of the server based on one test sample, and the test sample is incomplete, which leads to low accuracy of the test results. Summary of the invention

[0005] Based on this, it is necessary to provide a security testing method, device, computer equipment and computer-readable storage medium to address the above technical problems.

[0006] In a first aspect, the present application provides a security testing method, comprising:

[0007] Update the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite;

[0008] Generate a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet;

[0009] Sending each of the greeting data packets to a server, instructing the server to batch generate verification fingerprints according to each of the greeting data packets;

[0010] The test result of the server is determined based on the test request set corresponding to each of the verification fingerprints.

[0011] In one embodiment, the updating of the cipher suite in the encryption communication library based on the random number to obtain the updated cipher suite includes:

[0012] The encrypted communication library is called by the request middleware, and a random number is generated based on the preset random number range;

[0013] A cipher suite is determined in the encryption communication library, and the random number is added at a target position of the cipher suite to obtain an updated cipher suite.

[0014] In one embodiment, generating a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, to obtain each hello data packet, includes:

[0015] generating a hello packet according to the updated cipher suite, transport layer security version, extension, elliptic curve, and elliptic curve point format;

[0016] Updating the number of cycles of the cipher suite, and determining whether the updated number of cycles reaches a preset number of cycles threshold;

[0017] If the updated number of cycles does not reach the cycle number threshold, the step of updating the cipher suite in the encryption communication library based on the random number is performed until the updated number of cycles reaches the cycle number threshold, thereby obtaining each greeting data packet.

[0018] In one embodiment, before sending each of the greeting data packets to the server, the method further includes:

[0019] Determining whether a target cipher suite is repeated in each of the hello packets;

[0020] If the target cipher suite is repeated, delete the hello data packet containing the repeated target cipher suite;

[0021] Adjusting the range of the random number, and generating a new random number based on the adjusted range of the random number;

[0022] The cipher suite is updated based on the new random number, and a new hello data packet is generated according to the updated cipher suite.

[0023] In one embodiment, the determining the test result of the server based on the test request set corresponding to each verification fingerprint includes:

[0024] Sending a test request set corresponding to each verification fingerprint to the server in batches; the test request set is used to test whether the protection function of the verification fingerprint is normal, and obtain a protection result set;

[0025] Receive the protection result set of each of the test request sets, and determine the test result of the server based on each of the protection result sets.

[0026] In one embodiment, determining the test result of the server based on each of the protection result sets includes:

[0027] Determining an initial test result of the verification fingerprint based on the result quantity of the protection results in each of the protection result sets;

[0028] If the initial test result does not indicate that the test fails, determine that the test result of the server is that the test passes, and determine that the security of the server meets the standard;

[0029] If there is an initial test result that the test fails, the verification fingerprint corresponding to the initial test result is determined as the problem verification fingerprint, and the test result of the server is constructed based on the security failure of the server and the problem verification fingerprint.

[0030] In one embodiment, the determining the initial test result of the verification fingerprint based on the number of protection results in each of the protection result sets includes:

[0031] For each protection result set corresponding to the test request set, determine whether the number of protection results in the protection result set is equal to the number of normal test requests in the test request set;

[0032] If the number of results is equal to the number of normal requests, determining that the initial test result of the verification fingerprint is a test pass;

[0033] If the number of results is not equal to the number of normal requests, it is determined that the initial test result of the verification fingerprint is a test failure.

[0034] In a second aspect, the present application also provides a safety testing device, comprising:

[0035] An update module, used for updating the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite;

[0036] A generating module, configured to generate a hello data packet according to the updated cipher suite, until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet;

[0037] A sending module, used to send each of the greeting data packets to a server, and instruct the server to batch generate verification fingerprints according to each of the greeting data packets;

[0038] A determination module is used to determine the test result of the server based on the test request set corresponding to each verification fingerprint.

[0039] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0040] Update the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite;

[0041] Generate a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet;

[0042] Sending each of the greeting data packets to a server, instructing the server to batch generate verification fingerprints according to each of the greeting data packets;

[0043] The test result of the server is determined based on the test request set corresponding to each of the verification fingerprints.

[0044] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0045] Update the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite;

[0046] Generate a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet;

[0047] Sending each of the greeting data packets to a server, instructing the server to batch generate verification fingerprints according to each of the greeting data packets;

[0048] The test result of the server is determined based on the test request set corresponding to each of the verification fingerprints.

[0049] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0050] Update the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite;

[0051] Generate a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet;

[0052] Sending each of the greeting data packets to a server, instructing the server to batch generate verification fingerprints according to each of the greeting data packets;

[0053] The test result of the server is determined based on the test request set corresponding to each of the verification fingerprints.

[0054] The above-mentioned security testing method, device, computer equipment and computer-readable storage medium update the cryptographic suite in the encryption communication library based on random numbers to obtain an updated cryptographic suite; generate a greeting data packet based on the updated cryptographic suite until the number of cycles for updating the cryptographic suite reaches a preset cycle number threshold, thereby obtaining each greeting data packet; send each of the greeting data packets to the server, instructing the server to batch generate each verification fingerprint based on each of the greeting data packets; and determine the test result of the server based on the test request set corresponding to each of the verification fingerprints. By adopting this method, different greeting data packets can be generated by updating the cryptographic suite with random numbers, thereby simulating the generation of verification fingerprints of each client. Then, by sending the test request set corresponding to each verification fingerprint to the server, the verification fingerprints of multiple clients can be tested at the same time, enriching the test samples and improving the accuracy of the test results. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 An application environment diagram of a security testing method in an embodiment;

[0057] Figure 2 A schematic diagram of a safety testing method in one embodiment;

[0058] Figure 3 A schematic diagram of a process for updating a cipher suite in one embodiment;

[0059] Figure 4 A schematic diagram of a process of generating a greeting data packet in one embodiment;

[0060] Figure 5 A schematic diagram of a flow chart of determining whether each greeting data packet is repeated in one embodiment;

[0061] Figure 6 A schematic diagram of a process for determining a test result in one embodiment;

[0062] Figure 7 A schematic diagram of a process for determining a test result in another embodiment;

[0063] Figure 8 A schematic diagram of a process for determining an initial test result in one embodiment;

[0064] Fig. 9 is a flow chart of sending a greeting data packet in an exemplary embodiment;

[0065] Fig.10 is a structural block diagram of a safety testing device in one embodiment;

[0066] FIG. 11 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0068] The security testing method provided in the embodiment of the present application can be applied to Figure 1 In the safety test system 100 shown. The safety test system 100 includes a client 110 and a server 120. The client 110 communicates with the server 120 through a network. The client 110 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 120 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0069] In an exemplary embodiment, Figure 2 As shown, a safety testing method is provided, which is applied to Figure 1 The client 110 (hereinafter, the reference numeral is omitted, referred to as the client) in the embodiment is used as an example to illustrate the method, which includes the following steps 202 to 208. Among them:

[0070] Step 202: Update the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite.

[0071] Among them, Cipher Suite is a combination of encryption protocols and algorithms used to protect network communication security. It is used in TLS (Transport Layer Security) or SSL (Secure Sockets Layer) to ensure confidentiality, integrity and authentication of data when it is transmitted between the client and the server.

[0072] In implementation, the client generates a random number according to a random number range, and updates the cipher suite in the encryption communication library according to the random number to obtain an updated cipher suite.

[0073] Specifically, the client calls the encryption communication library through the message middleware and determines the cipher suite in the encryption communication library. Then, the client generates a random number and adds the random number to the cipher suite to obtain an updated cipher suite.

[0074] Step 204: Generate a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet.

[0075] The greeting data packet is a Client Hello data packet, and the greeting data packet is used to establish secure communication based on TLS / SSL.

[0076] In implementation, the number of cycles and the cycle number threshold of the cipher suite are pre-set in the client. The client generates a hello data packet according to the updated cipher suite and updates the number of cycles. Then, the client determines whether the updated number of cycles reaches the preset cycle number threshold. If the updated number of cycles reaches the cycle number threshold, the client obtains each hello data packet.

[0077] In an optional embodiment, if the updated cycle number does not reach the cycle number threshold, the client executes the above step 202 until the updated cycle number reaches the cycle number threshold, and the client obtains each greeting data packet.

[0078] Optionally, the cycle number threshold can be set to, but not limited to, 5 according to test requirements. The embodiment of the present application does not limit the cycle number threshold.

[0079] Step 206: Send each greeting data packet to the server, instructing the server to batch generate each verification fingerprint according to each greeting data packet.

[0080] The verification fingerprint is the JA3 fingerprint.

[0081] In the implementation, the client sends each greeting data packet to the server together, instructing the server to batch generate each verification fingerprint based on each greeting data packet. The server receives each greeting data packet and groups each greeting data packet to obtain each greeting data group. Then, the server generates a verification fingerprint group corresponding to each greeting data group according to a preset fingerprint algorithm. The client initiates a QUIC request or an HTTPS (Hypertext Transfer Protocol Secure) request to the server, thereby establishing a secure connection between the client and the server.

[0082] Specifically, the client and the server are connected via a network. The client sends each greeting data packet to the server via the network connection to instruct the server to generate each JA3 fingerprint in batches. The server receives each greeting data packet via the network connection. Then, the server divides each greeting data packet into each greeting data packet group according to a preset number of groups. Then, the server performs hash processing on the value of each field in each greeting data packet group to obtain a verification fingerprint group.

[0083] In an exemplary embodiment, the server is pre-set with a group number. The group number is 3. The server receives 12 greeting data packets. The server divides each greeting data packet into 4 greeting data packet groups according to preset components. Each greeting data packet contains an updated cipher suite, a transport layer security version (TLS Version), an extension (Extension), an elliptic curve (EllipticCurves (Supported_Groups)) and an elliptic curve point format (Elliptic Curve Point Formats (ec_point_formats), where ec_point_formats represents an elliptic curve point format). There are multiple processing processes in the server. The server simultaneously distributes 3 greeting data packets in 1 greeting data packet group to 3 processing processes, so that 1 processing process can generate JA3 fingerprints based on the greeting data packet, that is, the server can generate each verification fingerprint in batches. Specifically, each processing process in the server formats the greeting data packet, and splices the updated cipher suite, transport layer security version, extension, elliptic curve and elliptic curve format in the greeting data packet together according to the preset field order to obtain a spliced ​​string. The order of the fields is transport layer security version, updated cipher suite, elliptic curve, elliptic curve format, and extension. The processing process then calculates the MD5 (MessageDigest Algorithm 5) hash value of the concatenated string to obtain the JA3 fingerprint.

[0084] Step 208: Determine the test result of the server based on the test request set corresponding to each verification fingerprint.

[0085] In implementation, the client sends each test request set corresponding to each verification fingerprint to the server, and determines the test result of the server based on each test request set, wherein the test result represents the security of the server. If the test result is a test pass, it represents that the security of the server meets the standard. If the test result is not a test pass, it represents that the security of the server does not meet the standard.

[0086] Specifically, in order to speed up the testing process, the client sends a batch of test request sets corresponding to each verification fingerprint to the server, and receives a protection result set corresponding to each test request set. Then, the client determines the test result of the server based on each protection result set.

[0087] In the above security testing method, different greeting packets can be generated by updating the password suite with random numbers, thereby simulating the generation of verification fingerprints of each client. Then, by sending a test request set corresponding to each verification fingerprint to the server, the verification fingerprints of multiple clients can be tested at the same time, enriching the test samples and improving the accuracy of the test results.

[0088] In an exemplary embodiment, Figure 3 As shown, the specific processing process of step 202 includes steps 302 to 304. Among them:

[0089] Step 302: Call the encryption communication library by requesting the middleware, and generate a random number based on a preset random number range.

[0090] In implementation, a random number range is preset in the client. The client establishes a request middleware and calls the encryption communication library through the request middleware. The client generates a random number according to the preset random number range.

[0091] Specifically, the client establishes a request middleware through roundTripper := &http3.RoundTripper. roundTripper := &http3.RoundTripper means assigning http3.RoundTripper to roundTripper. Among them, http3.RoundTripper is an interface for processing HTTP / 3 (Hypertext Transfer Protocol Version 3) requests. HTTP / 3 is a version of HTTP based on the QUIC protocol, which aims to provide faster network connections, better congestion control, and more efficient multiplexing. roundTripper is the established message middleware. Then, the client calls the utls encryption communication library through roundTripper.TLSClientConfig:= &utls.Config. Among them, roundTripper.TLSClientConfig:= &utls.Config means assigning the Config in the encryption database utls to the TLSClientConfig method in the request middleware roundTripper. The utls library is a library in the GO language (an open source programming language) that is specifically used for TLS (Transport Layer Security Protocol) communication. The utls library is a branch of the crypto / tls library, mainly to provide greater flexibility and more functions. The crypto / tls library is a package in the GO language standard library that implements the Transport Layer Security Protocol (TLS) and the Secure Sockets Layer (SSL), which are mainly used for secure communications. The client then generates a random number based on a preset random data range.

[0092] Optionally, the random number range can be, but is not limited to, set to a natural number between [0, 5]. The random number range is set according to the test requirements, and the embodiment of the present application does not limit the random number range.

[0093] Step 304: determine the cipher suite in the encryption communication library, and add a random number at the target position of the cipher suite to obtain an updated cipher suite.

[0094] The target location is generally the end of the cipher suite.

[0095] In the implementation, the client determines the cipher suite in the cryptographic communication library and then adds a random number to the end of the cipher suite to obtain an updated cipher suite.

[0096] A typical Cipher Suite usually includes the following parts:

[0097] Key exchange algorithm: used to securely exchange session keys between the client and the server. Common key exchange algorithms include: Elliptic Curve Diffie-Hellman (ECDH), etc.

[0098] Authentication algorithm: used to verify the identities of both communicating parties.

[0099] Encryption algorithm: used to encrypt data to ensure the confidentiality of data transmission.

[0100] Message Authentication Code (MAC) or integrity protection algorithm: used to ensure the integrity of data and prevent data from being tampered with during transmission. Common algorithms include SHA-256, SHA-384, etc.

[0101] In an exemplary embodiment, a typical Cipher Suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, which means as follows: TLS: Use TLS protocol; ECDHE: Use Elliptic Curve Diffie-Hellman for key exchange. RSA: Use RSA algorithm (Rivest-Shamir-Adleman algorithm, an asymmetric encryption algorithm) for authentication; AES_128_GCM: Use 128-bit AES (Advanced Encryption Standard, a symmetric encryption algorithm) encryption algorithm, using GCM mode (Galois / Counter Mode); SHA256: Use SHA-256 (a cryptographic hash function used to generate digital digests (also called hash values ​​or fingerprints), SHA stands for "Secure Hash Algorithm", and 256 means that the secure hash algorithm generates a 256-bit hash value) for integrity protection. The random number generated by the client is 5. The client adds the random number 5 to the end of the cipher suite to obtain the updated cipher suite, which is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256_5.

[0102] In an optional embodiment, the target position may also be the beginning of the cipher suite, that is, the client adds a random number at the beginning of the cipher suite to obtain an updated cipher suite.

[0103] In this embodiment, the cipher suite is updated by random numbers, and the cipher suite of each client is simulated and generated, so as to facilitate the subsequent simulation and generation of the greeting data packet of each client.

[0104] In an exemplary embodiment, Figure 4As shown, the specific processing process of step 204 includes steps 402 to 406. Among them:

[0105] Step 402, generating a hello data packet according to the updated cipher suite, transport layer security version, extension, elliptic curve and elliptic curve point format.

[0106] The Hello Packet is the first packet in the TLS / SSL handshake process, sent by the client to the server to start a secure connection. The Transport Layer Security Version is the highest TLS / SSL version supported by the client. The Elliptic Curve is the elliptic curve encryption algorithm supported by the client. The Elliptic Curve Point Format is the representation format of the elliptic curve point supported by the client.

[0107] In the implementation, the client combines the updated cipher suite, transport layer security version, extension, elliptic curve, and elliptic curve format to generate a hello packet to initiate a secure connection between the client and the server.

[0108] Specifically, the client generates a greeting packet based on the Handshake Type, Length, TLS Version, Session ID, Cipher Suites, Compression Methods, Extensions, Elliptic Curve, and Elliptic Curve Format.

[0109] Step 404: Update the cycle count of the cipher suite and determine whether the updated cycle count reaches a preset cycle count threshold.

[0110] In implementation, the number of cycles and the cycle number threshold of the cipher suite are pre-set in the client. The cycle number is set to 0. The client adds the number of cycles of the current cipher suite and 1 to obtain the updated number of cycles. Then, the client determines whether the updated number of cycles is greater than or equal to the cycle number threshold. If the updated number of cycles is less than the cycle number threshold, the client determines that the updated number of cycles does not reach the cycle number threshold. If the updated number of cycles is greater than or equal to the cycle number threshold, the client determines that the updated number of cycles reaches the cycle number threshold. A greeting data packet represents a scenario in which a client establishes a secure connection with a server. Therefore, by generating each greeting data packet, it is possible to simulate the generation of multiple scenarios in which a client establishes a secure connection with a server.

[0111] In an exemplary embodiment, the number of cycles of the current cipher suite is 11, and the cycle number threshold is 12. The client performs an addition operation on the cycle number 11 of the current cipher suite and 1 to obtain an updated cycle number 12. Then, the client determines whether the updated cycle number is greater than or equal to the cycle number threshold. Since the updated cycle number is equal to the cycle number threshold, the client determines that the updated cycle number reaches the cycle number threshold.

[0112] In an optional embodiment, if the updated cycle number reaches the cycle number threshold, the client stops generating the greeting data packet and executes the above step 206. The specific processing process of step 206 has been specifically described in the above embodiment, and will not be repeated in this embodiment of the present application.

[0113] Step 406, if the updated number of cycles does not reach the cycle number threshold, the step of updating the cipher suite in the encryption communication library based on the random number is performed until the updated number of cycles reaches the cycle number threshold, and each greeting data packet is obtained.

[0114] The cycle number threshold is the number of greeting data packets.

[0115] In implementation, if the updated number of cycles does not reach the cycle number threshold, the client determines that a sufficient number of greeting packets have not been generated, and executes the above step 202 until the updated number of cycles reaches the cycle number threshold, and the client obtains the number of greeting packets equal to the cycle number threshold. The specific processing process of step 202 has been specifically described in the above embodiment, and the embodiment of the present application will not be repeated here.

[0116] In an exemplary embodiment, the updated number of cycles is 10. The cycle number threshold is 12. At this time, since the updated number of cycles 10 is less than the cycle number threshold 12, the client determines that the updated number of cycles does not reach the cycle number threshold. Then, the client executes the above step 202 to generate more greeting data packets until the updated number of cycles reaches the cycle number threshold. The client obtains 12 greeting data packets.

[0117] In this embodiment, when the number of cycles does not reach the cycle number threshold, different updated cipher suites can be used to simulate the generation of greeting packets of different clients on one client, which is convenient for the subsequent concurrent generation of various verification fingerprints and enriches the test samples. Furthermore, the security of the server is tested through various verification fingerprints, which improves the accuracy of the test results.

[0118] In an exemplary embodiment, before sending the greeting data packets to the server, the greeting data packets need to be checked to ensure that each greeting data packet is different. Figure 5As shown, before step 206 is executed, the specific processing process of the safety testing method also includes steps 502 to 508. Among them:

[0119] Step 502: Determine whether the target cipher suite is repeated in each hello data packet.

[0120] The remaining greeting data packets are the greeting data packets in the greeting data packets except the current greeting data packet.

[0121] In implementation, the client determines, for each hello packet, whether the cipher suite in the hello packet is repeated with the cipher suites in the other hello packets in each hello packet. If the cipher suite in the hello packet is repeated with the cipher suites in the other packets, the client determines the repeated cipher suite as the target cipher suite.

[0122] In an exemplary embodiment, since the range of the random number is set too small and the number of hello packets to be generated is too large, the hello packets may be repeated, that is, the cipher suites in the hello packets may be repeated. In order to prevent the hello packets from being repeated, the client determines each hello packet in each hello packet as the current hello packet, and determines whether the cipher suite in the current hello packet is repeated with the cipher suites in the remaining hello packets. If the cipher suite in the hello packet is repeated with the cipher suites in the remaining hello packets, the client determines the repeated cipher suite as the target cipher suite.

[0123] In an optional embodiment, if there is no target cipher suite duplication, the client continues to execute step 206. The specific processing process of step 206 has been described in detail in the above embodiment, and will not be repeated in this embodiment of the present application.

[0124] Step 504: If there is a duplicate target cipher suite, delete the hello data packet containing the duplicate target cipher suite.

[0125] In implementation, if there is a target cipher suite duplication, the client determines that the hello packet containing the target cipher suite is the target hello packet, and deletes the duplicate target hello packets, leaving only one target hello packet.

[0126] In an exemplary embodiment, if there are three repeated target cipher suites, the client determines the hello packet where the target cipher suite is located as the target hello packet for each repeated target cipher suite. Then, the client deletes two of the three target hello packets, leaving one target hello packet.

[0127] Step 506: adjust the range of the random number, and generate a new random number based on the adjusted range of the random number.

[0128] The deletion quantity is the number of deleted target greeting data packets.

[0129] In implementation, the client adjusts the range of random numbers upward to obtain an adjusted range of random numbers, so that the adjusted range of random numbers is larger than the range of random numbers before adjustment. Then, the client generates a new random number based on the adjusted range of random numbers and the number of deletions.

[0130] In an exemplary embodiment, the number of deletions is 2. The range of random numbers is [0, 5]. The client adjusts the range of random numbers upward so that the range of the adjusted random numbers is [0, 10]. Then, the client generates two new random numbers, 8 and 9, respectively, using the adjusted range of random numbers.

[0131] Step 508: Update the cipher suite based on the new random number, and generate a new hello data packet according to the updated cipher suite.

[0132] In implementation, the client calls the encryption communication library by requesting the middleware, determines the cipher suite in the encryption communication library, and adds a new random number at the target position of the cipher suite to obtain an updated cipher suite. Then, the client generates a new greeting data packet according to the updated cipher suite, transport layer security version, extension, elliptic curve, and elliptic curve point format. The process of generating a new greeting data packet according to the new random number is the same as the process of generating the greeting data packet, which has been described in detail in steps 202 to 204, and will not be repeated in this embodiment of the present application.

[0133] In this embodiment, by detecting whether the cipher suites of each hello data packet are repeated, and regenerating a new hello data packet when a repeated cipher suite is detected, it is ensured that each hello data packet is not repeated, thereby achieving the simulation generation of verification fingerprints of different clients.

[0134] In an exemplary embodiment, Figure 6 As shown, the specific processing process of step 208 includes steps 602 to 604. Among them:

[0135] Step 602: Send a test request set corresponding to each verification fingerprint to the server in batches.

[0136] The test request set is used to test whether the protection function of the verification fingerprint is normal and obtain the protection result set. Each test request set contains normal test requests and abnormal test requests. The abnormal test request exists in the blacklist of the protection fingerprint.

[0137] In implementation, the client obtains each test request set corresponding to each verification fingerprint. The client divides each test request set corresponding to each verification fingerprint into each test request set group. Then, the client sends each test request set group to the server. The server receives each test request group, and performs protection processing on the test request set group according to each verification fingerprint group, and obtains a protection result set for each test request set.

[0138] Specifically, a number of groups is pre-set in the client. The number of groups is the same as the number of groups set in the server. The client obtains the test request set corresponding to each verification fingerprint and obtains each test request set. The client divides each test request set into test request groups according to the preset number of groups, and sends each test request set group to the server. The server processes the normal test requests in each test request set in the test request set group according to the verification fingerprint group, obtains the protection result set, and intercepts the abnormal test requests in the test request set.

[0139] In an exemplary embodiment, the server is a Web (World Wide Web, Global Wide Area Network) application firewall. Each JA3 fingerprint is configured in the Web application protection wall, and there is a blacklist in each JA3 fingerprint. The client obtains the test request set corresponding to each JA3 fingerprint and obtains each test request set. The client divides each test request set into each test request group according to the preset number of groups, and sends each test request set group to the Web application protection wall. The Web application protection wall intercepts the abnormal test requests in each test request set in the test request set group according to the blacklist interception in the JA3 fingerprint, and releases the normal test requests in the test request set to obtain the protection result set of the normal test request. By configuring the JA3 fingerprint, it is verified whether the server can accurately intercept the requests matching the JA3 fingerprint blacklist when accessing the QUIC protocol with multiple different JA3 fingerprints, and release other requests that do not match the blacklist.

[0140] In an optional embodiment, the server is a DDoS (Distributed Denial of Service attack) high defense. The DDoS high defense in the server configures each JA3 fingerprint for the target port, and there is a blacklist in each JA3 fingerprint. The client obtains the test request set corresponding to each JA3 fingerprint and obtains each test request set. The client divides each test request set into each test request group according to the preset number of groups, and sends each test request set group to the DDoS high defense through the target port. The DDoS high defense intercepts the abnormal test request in each test request set in the test request set group according to the blacklist interception in the JA3 fingerprint, and releases the normal test request in the test request set to obtain the protection result set of the normal test request. By configuring the JA3 fingerprint, it is verified whether the DDoS high defense can accurately parse the JA3 fingerprint of the QUIC protocol accessed through the target port, and correctly intercept the request that matches the JA3 fingerprint blacklist, and does not affect the access of the QUIC request that does not match the blacklist.

[0141] Step 604, receiving the protection result set of each test request set, and determining the test result of the server based on each protection result set.

[0142] In implementation, the server sends the protection result set of each test request set to the client. The client receives the protection result set corresponding to each test request set. Then, the client determines the initial test result of the verification fingerprint for each protection result set, and determines the test result of the server based on each initial test result.

[0143] Specifically, the server sends the protection result set of each test request set to the client through a network connection. The client receives each protection result set. Each protection result set represents the interception result of a verification fingerprint and is also the initial test result of the verification fingerprint. The client determines the initial test result of the verification fingerprint based on the number of protection results in each protection result set. Then, the client determines the test result of the server based on each initial test result, thereby determining the security of the server.

[0144] In this embodiment, by sending each test request set to the server in batches, concurrent verification of verification fingerprints is achieved. In addition, since the server generates the verification fingerprints of each client, there is no need to frequently modify the verification fingerprint protection configuration and reload the configuration during the test process, which improves the test efficiency and is more suitable for actual online usage scenarios.

[0145] In an exemplary embodiment, Figure 7 As shown, the specific processing process of determining the test result of the server based on each protection result set in step 604 includes steps 702 to 706. Among them:

[0146] Step 702: determining an initial test result of the verification fingerprint based on the result quantity of the protection results in each protection result set.

[0147] In implementation, the client determines the test request set corresponding to each protection result set, and then determines the initial test result of the verification fingerprint according to the number of normal requests of the normal test request set and the number of protection results in the protection result set.

[0148] Specifically, the client determines the test request set corresponding to each protection result set in each protection result set. Then, the client counts the normal test requests in the test request set to obtain the number of normal requests, and counts the protection results in the protection result set to obtain the number of results. Then, the client determines whether the number of results is equal to the number of normal requests, obtains the judgment result, and determines the initial test result of the verification fingerprint according to the judgment result.

[0149] Step 704: If there is no initial test result indicating that the test fails, determine that the test result of the server is that the test passes, and determine that the security of the server meets the requirements.

[0150] During implementation, the client determines whether there is an initial test result that fails the test among the initial test results. If there is no initial test result that fails the test, that is, all initial test results are passed, the client determines that the test result of the server is passed. At the same time, the client determines that the security of the server meets the standard. Security compliance means that the server can accurately intercept requests that match the JA3 fingerprint blacklist when configuring QUIC protocol or HTTPS protocol access with multiple different JA3 fingerprints, and release other requests that do not match the blacklist.

[0151] Step 706: If there is an initial test result that the test fails, the verification fingerprint corresponding to the initial test result is determined as the problem verification fingerprint, and the test result of the server is constructed based on the security failure of the server and the problem verification fingerprint.

[0152] In implementation, if there is an initial test result that fails the test, the client will use the initial test result that fails the test as the target initial test result, and the verification fingerprint corresponding to the target initial test result as the problem verification fingerprint. Then, the client determines that the security of the server does not meet the standard, and constructs the information that the security of the server does not meet the standard and the problem verification result corresponding to the target initial test result as the test result of the server.

[0153] In an optional embodiment, the client feeds back the test result of the server to the target user through an interface, so that the target user adjusts the question verification fingerprint according to the test result.

[0154] Optionally, the client can send the test result to the terminal of the target user by SMS or email. The target user can be, but is not limited to, a tester. The embodiment of the present application does not limit the notification method and the target user.

[0155] In this embodiment, the test results of the server are determined by the initial test results of each verification fingerprint, which clarifies whether the protection function of the verification fingerprint in the server is normal, and effectively verifies the verification fingerprint protection effect of the QUIC protocol.

[0156] In an exemplary embodiment, Figure 8 As shown, the specific processing process of step 702 includes steps 802 to 806. Among them:

[0157] Step 802: for each protection result set corresponding to the test request set, determine whether the number of protection results in the protection result set is equal to the number of normal requests in the test request set.

[0158] In implementation, the client determines the number of protection results in the protection result set corresponding to each test request set. At the same time, the client determines the number of normal requests of normal test requests in the test request set. Then, the client determines whether the number of results is equal to the number of normal requests.

[0159] Specifically, since the verification fingerprint is used to intercept requests in the blacklist. Therefore, the server will intercept abnormal test requests in the test request set, and process normal test requests to obtain protection results. It is only necessary to determine whether the server has intercepted correctly based on the number of protection results, that is, whether the verification fingerprint has passed the test. For each protection result set corresponding to the test request set, the client counts the protection results in the protection result set to obtain the number of results. At the same time, the client counts the normal test requests in the test request set to obtain the number of normal requests. Then, the client determines whether the number of results is equal to the number of normal requests to obtain a judgment result.

[0160] Step 804: If the number of results is equal to the number of normal requests, it is determined that the initial test result of the verification fingerprint is a test pass.

[0161] In implementation, if the number of results is equal to the number of normal requests, the client determines that the server successfully intercepts normally and determines the initial test result of the verification fingerprint as a test pass.

[0162] Step 806: If the number of results is not equal to the number of normal requests, determine that the initial test result of the verification fingerprint is a test failure.

[0163] In implementation, if the number of results is not equal to the normal number of requests, the client determines that there is an abnormal interception phenomenon on the server side, and determines the initial test result of the verification fingerprint as a test failure.

[0164] In this embodiment, the number of normal requests and the number of protection results of normal test requests are used to determine whether the verification fingerprint can normally intercept abnormal requests and whether the function of the protection fingerprint is normal, which facilitates the subsequent determination of the security of the server.

[0165] In an exemplary embodiment, Fig. 9 FIG. 1 is a flow chart of sending a greeting data packet in an exemplary embodiment. Fig. 9 As shown, a method for sending a greeting data packet is provided, the method comprising:

[0166] Step 901, import the utls library.

[0167] Step 902, create a for loop and set a loop count threshold.

[0168] Step 903, create a 9-digit random number M.

[0169] Step 904, establish message middleware through http3.RoundTripper.

[0170] Step 905, construct a Cipher Suite, and write a random number M to the end of the Cipher Suite.

[0171] Step 906, roundTripper is passed to http.Client, a greeting data packet is generated, and an http request is initiated.

[0172] Step 907, update the number of cycles, N=N+1;

[0173] Step 908, determine whether the updated number of cycles is greater than the cycle number threshold. If the updated number of cycles is greater than the cycle number threshold, end the method. If the updated number of cycles is less than or equal to the cycle number threshold, execute the above step 903.

[0174] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0175] Based on the same inventive concept, the embodiment of the present application also provides a safety test device for implementing the safety test method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more safety test device embodiments provided below can refer to the limitations on the safety test method above, and will not be repeated here.

[0176] In an exemplary embodiment, Fig.10 As shown, a security testing device 1000 is provided, comprising: an updating module 1001, a generating module 1002, a sending module 1003 and a determining module 1004, wherein:

[0177] The updating module 1001 is used to update the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite.

[0178] The generating module 1002 is used to generate a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet.

[0179] The sending module 1003 is used to send each greeting data packet to the server, and instruct the server to batch generate each verification fingerprint according to each greeting data packet.

[0180] The determination module 1004 is used to determine the test result of the server based on the test request set corresponding to each verification fingerprint.

[0181] In an exemplary embodiment, the update module 1001 includes:

[0182] The first generating submodule is used to call the encryption communication library through the request middleware and generate a random number based on a preset random number range.

[0183] The first adding submodule is used to determine the cipher suite in the encryption communication library and add a random number at a target position of the cipher suite to obtain an updated cipher suite.

[0184] In an exemplary embodiment, the generating module 1002 includes:

[0185] The second generation submodule is used to generate a hello data packet according to the updated cipher suite, transport layer security version, extension, elliptic curve and elliptic curve point format.

[0186] The second updating submodule is used to update the number of cycles of the cipher suite and determine whether the updated number of cycles reaches a preset cycle number threshold.

[0187] The first execution submodule is used to execute the step of updating the cipher suite in the encryption communication library based on the random number if the updated cycle number does not reach the cycle number threshold, until the updated cycle number reaches the cycle number threshold, thereby obtaining each greeting data packet.

[0188] In an exemplary embodiment, the safety testing device 1000 further includes:

[0189] The judging module is used to judge whether the target cipher suite is repeated in each hello data packet.

[0190] The generating module is used for deleting the greeting data packet containing the repeated target cipher suite if there is a repeated target cipher suite.

[0191] The adjustment module is used to adjust the range of the random number and generate a new random number based on the adjusted range of the random number.

[0192] The second generating module is used to update the cipher suite based on the new random number and generate a new hello data packet according to the updated cipher suite.

[0193] In an exemplary embodiment, the determination module 1004 includes:

[0194] The first sending submodule is used to send a test request set corresponding to each verification fingerprint to the server in batches; the test request set is used to test whether the protection function of the verification fingerprint is normal to obtain a protection result set.

[0195] The first receiving submodule includes receiving a protection result set of each test request set, and determining a test result of the server based on each protection result set.

[0196] In an exemplary embodiment, the first receiving submodule includes a second receiving submodule and a first determining submodule. The first determining submodule includes:

[0197] The second determination submodule is used to determine the initial test result of the verification fingerprint based on the result quantity of the protection results in each protection result set.

[0198] The third determination submodule is used to determine that the test result of the server is passed if there is no initial test result of test failure, and determine that the security of the server meets the standard.

[0199] The fourth determination submodule is used to determine the verification fingerprint corresponding to the initial test result as the problem verification fingerprint if the initial test result is a test failure, and construct the test result of the server based on the security failure of the server and the problem verification fingerprint.

[0200] In an exemplary embodiment, the second determining submodule includes:

[0201] The first judgment submodule is used to judge, for each protection result set corresponding to the test request set, whether the number of protection results in the protection result set is equal to the number of normal requests in the test request set.

[0202] The fifth determination submodule is used to determine that the initial test result of the verification fingerprint is a test pass if the number of results is equal to the number of normal requests.

[0203] The sixth determination submodule is used to determine that the initial test result of the verification fingerprint is a test failure if the result quantity is not equal to the normal request quantity.

[0204] Each module in the above-mentioned safety test device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module above.

[0205] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG11. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a security testing method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0206] Those skilled in the art will understand that the structure shown in FIG. 11 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0207] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0208] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0209] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0210] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0211] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0212] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A safety testing method, characterized in that: The method comprises: Update the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite; Generate a hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each hello data packet; Sending each of the greeting data packets to a server, instructing the server to batch generate verification fingerprints according to each of the greeting data packets; The test result of the server is determined based on the test request set corresponding to each of the verification fingerprints.

2. The method according to claim 1, characterized in that The method of updating the cryptographic suite in the encryption communication library based on the random number to obtain the updated cryptographic suite includes: The encrypted communication library is called by the request middleware, and a random number is generated based on the preset random number range; A cipher suite is determined in the encryption communication library, and the random number is added at a target position of the cipher suite to obtain an updated cipher suite.

3. The method according to claim 1, characterized in that The generating of the hello data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, to obtain each hello data packet, includes: generating a hello packet according to the updated cipher suite, transport layer security version, extension, elliptic curve, and elliptic curve point format; Updating the number of cycles of the cipher suite, and determining whether the updated number of cycles reaches a preset number of cycles threshold; If the updated number of cycles does not reach the cycle number threshold, the step of updating the cipher suite in the encryption communication library based on the random number is performed until the updated number of cycles reaches the cycle number threshold, thereby obtaining each greeting data packet.

4. The method according to claim 1, characterized in that: Before sending each of the greeting data packets to the server, the method further includes: Determining whether a target cipher suite is repeated in each of the hello packets; If the target cipher suite is repeated, delete the hello data packet containing the repeated target cipher suite; Adjusting the range of the random number, and generating a new random number based on the adjusted range of the random number; The cipher suite is updated based on the new random number, and a new hello data packet is generated according to the updated cipher suite.

5. The method according to claim 1, characterized in that The determining the test result of the server based on the test request set corresponding to each verification fingerprint includes: Sending a test request set corresponding to each verification fingerprint to the server in batches; the test request set is used to test whether the protection function of the verification fingerprint is normal, and obtain a protection result set; Receive the protection result set of each of the test request sets, and determine the test result of the server based on each of the protection result sets.

6. The method according to claim 5, characterized in that Determining the test result of the server based on each of the protection result sets includes: Determining an initial test result of the verification fingerprint based on the number of results of the protection results in each of the protection result sets; If the initial test result does not indicate that the test fails, determine that the test result of the server is that the test passes, and determine that the security of the server meets the standard; If there is an initial test result that the test fails, the verification fingerprint corresponding to the initial test result is determined as the problem verification fingerprint, and the test result of the server is constructed based on the security failure of the server and the problem verification fingerprint.

7. The method according to claim 6, characterized in that The determining the initial test result of the verification fingerprint based on the result quantity of the protection results in each of the protection result sets includes: For each protection result set corresponding to the test request set, determine whether the number of protection results in the protection result set is equal to the number of normal test requests in the test request set; If the number of results is equal to the number of normal requests, determining that the initial test result of the verification fingerprint is a test pass; If the number of results is not equal to the number of normal requests, it is determined that the initial test result of the verification fingerprint is a test failure.

8. A safety testing device, characterized in that: The device comprises: An update module, used for updating the cipher suite in the encryption communication library based on the random number to obtain an updated cipher suite; A generating module, configured to generate a greeting data packet according to the updated cipher suite until the number of cycles of updating the cipher suite reaches a preset cycle number threshold, thereby obtaining each greeting data packet; A sending module, used to send each of the greeting data packets to a server, and instruct the server to batch generate verification fingerprints according to each of the greeting data packets; A determination module is used to determine the test result of the server based on the test request set corresponding to each verification fingerprint.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images