Python language password api misuse automated detection method, system, device and medium

Abstract

The application discloses a kind of Python language password API misuse automated detection method, system, equipment and medium, in the scheme provided by the present application, combined with Python language feature reconstruction abstract syntax tree, reconstruct abstract syntax tree according to Python language feature, while guaranteeing function consistency Simplify node representation, to reduce false positive rate and false negative rate in subsequent taint analysis process;Meanwhile, using static taint analysis technology, based on the reconstructed abstract syntax tree, the process and inter-function taint propagation are carried out, and all password API misuse rules are covered by the taint detector, so as to determine the detected password API misuse instance. Overall, the present application fills the blank of the current password API misuse detection for Python application, and has important support and promotion effect on password application security evaluation field.

Description

Technical Field

[0001] The present invention relates to the technical field of Python language-oriented cryptographic API misuse detection, and in particular to a Python language cryptographic API misuse automatic detection method, system, device and medium. Background Art

[0002] Cryptography, as the cornerstone of information system security, provides confidentiality, integrity, authenticity, and non-repudiation-related protections. Cryptography APIs (Application Programming Interfaces), as providers of fundamental cryptographic services, make cryptographic services easily accessible to developers. However, cryptographic APIs can only fulfill their security role if used correctly and in compliance with regulations. In practice, the misuse of cryptographic APIs is widespread. Existing literature indicates that at least 52.26% of open-source Python applications contain at least one cryptographic API misuse. Furthermore, cryptographic API misuse is often difficult to detect. Most developers lack professional cryptographic knowledge and struggle to identify these issues. These misuses do not cause program crashes but remain hidden within the system, revealing security flaws only under specific circumstances. These vulnerabilities often carry serious security consequences. In recent years, cryptographic application security and cryptographic API misuse detection technology have garnered significant attention from both industry and academia.

[0003] At present, common cryptographic API misuse detection tools are mainly divided into two categories: dynamic detection and static detection. Among them, dynamic detection tools are based on the program execution process, and it is difficult to completely cover all cryptographic API statements. In addition, such tools are strongly dependent on the underlying layer and Hook strategy, which can easily lead to missed reports. Therefore, the current mainstream detection tools use static code analysis methods, which have a high code coverage rate and a low missed report rate. Such tools usually convert program files into IR (Intermediate Representation) to extract information flow, and then establish the corresponding data flow between the program execution point and its predecessor or subsequent execution point, and identify cryptographic API misuse through the data flow of the program execution point and the detection strategy.

[0004] Taint analysis is a practical technique for static code analysis that tracks the flow of sensitive data to determine whether information flow policies are effectively implemented. Taint analysis is widely used in practical fields such as system privacy data leakage detection and system security vulnerability discovery. The taint analysis principle is based on a triplet <source, sink, purification function> (<sources,sinks,sanitizers> ). Taint sources refer to the direct introduction of untrusted or confidential data into the system; taint sinks refer to the direct generation of security-sensitive operations (violating data integrity) or the leakage of private data to the outside world (violating data confidentiality); sanitizers refer to the use of data encryption or filtering of harmful operations to prevent data transmission from posing a threat to the information security of the software system. In the detection of cryptographic API misuse, taint analysis aims to evaluate whether the data introduced by the taint source in the program can be directly propagated to the taint sink without passing through the sanitization function. For example, hard-coded key variables are directly fed into the encryption function along the information flow without being generated by a secure random number generator, which leads to security risks such as dangerous cryptographic API operations in the system.

[0005] Existing work generally suffers from shortcomings such as unclear analysis of cryptographic misuse rules, incomplete analysis of cryptographic libraries, and incomplete data flow analysis. Furthermore, existing work primarily designs detection tools for programming languages ​​such as C / C++ and Java, while research on other high-level programming languages ​​(such as Python) is relatively limited. Because various programming languages ​​have different syntactical characteristics, the advanced language features they support can significantly hinder cryptographic API misuse detection. For example, Python's object reference passing feature supports assigning functions to variables and calling the original function by calling the variable with parameters. When it comes to unsafe cryptographic API calls, existing detection tools will produce false negatives. Furthermore, when encountering computable conditional statements, such as those in which the judgment logic is always true or always false, existing detection tools do not perform path-sensitive processing, resulting in false positives. Therefore, it is necessary to design an automated cryptographic API misuse detection solution for the Python programming language. Summary of the Invention

[0006] The purpose of the present invention is to provide a Python language cryptography API misuse automatic detection method, system, device and medium, based on the mainstream Python cryptography library API encapsulation characteristics, to achieve the automatic detection function of cryptography API misuse, to make up for the current situation that there is no Python language cryptography API misuse detection tool, so that the cryptography API misuse risk is shifted to the left during the security development process.

[0007] The purpose of the present invention is achieved through the following technical solutions:

[0008] An automated detection method for misuse of a cryptographic API in Python, comprising:

[0009] Obtain a set of misuse rules for the Python language cryptography API based on cryptography security usage specifications;

[0010] Convert the analyzed program file into an abstract syntax tree IR form and reconstruct the abstract syntax tree according to the characteristics of the Python language;

[0011] According to the set of Python language cryptography API misuse rules, mark the taint sources, purification functions and convergence points in the reconstructed abstract syntax tree;

[0012] Combining the marked taint sources, cleansing functions, and convergence points, based on static taint analysis technology, using a taint detector to determine whether the analyzed program file triggers any cryptographic API misuse rule in the cryptographic API misuse rule set, so as to obtain a cryptographic API misuse detection result for the analyzed program file under the corresponding cryptographic API misuse rule;

[0013] The cryptographic API misuse detection result of the analyzed program file is obtained by integrating the cryptographic API misuse rule set of the Python language to obtain the final cryptographic API misuse detection result of the analyzed program file.

[0014] An automated detection system for misuse of cryptographic APIs in Python, including:

[0015] Misuse rule acquisition module, which obtains the Python language cryptography API misuse rule set based on cryptography security usage specifications;

[0016] The program file conversion module is used to convert the analyzed program file into the abstract syntax tree IR form and reconstruct the abstract syntax tree according to the characteristics of the Python language;

[0017] A node initialization module, used to mark taint sources, purification functions, and sinks in the reconstructed abstract syntax tree according to the set of Python language cryptography API misuse rules;

[0018] a misuse detection module, configured to combine the marked taint sources, cleansing functions, and convergence points, and use a taint detector based on static taint analysis technology to determine whether the analyzed program file triggers any cryptographic API misuse rule in the cryptographic API misuse rule set, so as to obtain a cryptographic API misuse detection result for the analyzed program file under the corresponding cryptographic API misuse rule;

[0019] The misuse result generation module is used to integrate the cryptographic API misuse detection results of the analyzed program file under the Python language cryptographic API misuse rule set to obtain the final cryptographic API misuse detection results of the analyzed program file.

[0020] A processing device comprising: one or more processors; a memory for storing one or more programs;

[0021] When the one or more programs are executed by the one or more processors, the one or more processors implement the aforementioned method.

[0022] A readable storage medium stores a computer program, which implements the aforementioned method when the computer program is executed by a processor.

[0023] It can be seen from the technical solutions provided by the present invention that 1) the present invention combines the characteristics of the Python language to reconstruct the abstract syntax tree, reconstructs the abstract syntax tree according to the characteristics of the Python language, simplifies the node representation while ensuring functional consistency, and thus reduces the false alarm rate and missed alarm rate in the subsequent taint analysis process. 2) The present invention utilizes static taint analysis technology, based on the reconstructed abstract syntax tree, to carry out taint propagation within the process and between functions, and uses the taint detector to cover all cryptographic API misuse rules, thereby determining the detected cryptographic API misuse instances. In general, the present invention fills the gap in the current lack of cryptographic API misuse detection for Python applications, and plays an important supporting and promoting role in the field of cryptographic application security assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 A flowchart of an automated detection method for misuse of a cryptographic API in Python provided by an embodiment of the present invention;

[0026] Figure 2 A schematic diagram of an automated detection system for misuse of a cryptographic API in Python provided by an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of a processing device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following is a clear and complete description of the technical solutions in the embodiments of the present invention, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0029] First, the following terms may be used in this article:

[0030] The terms "include," "comprises," "contains," "has," or other similar expressions should be interpreted as non-exclusive. For example, "including certain technical features (such as raw materials, components, ingredients, carriers, dosage forms, materials, dimensions, parts, components, mechanisms, devices, steps, procedures, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products, or manufactured articles, etc.) should be interpreted as including not only the technical features explicitly listed, but also other technical features known in the art that are not explicitly listed.

[0031] The term "consisting of" excludes any technical features not explicitly listed. If used in a claim, this term renders the claim closed, excluding any technical features other than those explicitly listed, except for conventional impurities associated with them. If this term appears only in a clause of a claim, it limits only the elements explicitly listed in that clause; elements listed in other clauses are not excluded from the claim as a whole.

[0032] The following describes in detail a Python language cryptographic API misuse automated detection method, system, device, and medium provided by the present invention. Any content not described in detail in the embodiments of the present invention belongs to the prior art known to professionals in the field. Where specific conditions are not specified in the embodiments of the present invention, the conditions are carried out in accordance with conventional conditions in the art or conditions recommended by the manufacturer. Where the manufacturer of the reagents or instruments used in the embodiments of the present invention is not specified, they are all conventional products that can be purchased commercially.

[0033] Example 1

[0034] The present invention provides an automated detection method for misuse of a Python language cryptographic API. Figure 1 As shown, it mainly includes the following steps:

[0035] Step 1: Obtain a set of Python language cryptography API misuse rules based on cryptography security usage specifications.

[0036] Step 2: Convert the analyzed program file into an abstract syntax tree (IR) form, and reconstruct the abstract syntax tree according to the characteristics of the Python language.

[0037] Step 3: Mark the taint sources, purification functions, and convergence points in the reconstructed abstract syntax tree according to the Python language cryptographic API misuse rule set.

[0038] Step 4. Combining the marked taint sources, purification functions and convergence points, based on static taint analysis technology, use a taint detector to determine whether the analyzed program file triggers any cryptographic API misuse rule in the cryptographic API misuse rule set, so as to obtain the cryptographic API misuse detection result of the analyzed program file under the corresponding cryptographic API misuse rule.

[0039] Step 5: Under the cryptographic API misuse rule set of the Python language, the cryptographic API misuse detection result of the analyzed program file is integrated to obtain the final cryptographic API misuse detection result of the analyzed program file.

[0040] Compared with the prior art, the solution provided by the embodiment of the present invention has the following advantages:

[0041] 1. The present invention combines the characteristics of the Python language to reconstruct the abstract syntax tree, rewriting the abstract syntax tree based on dynamic characteristics, object reference transfer characteristics, formatted strings, With statements, etc., while ensuring functional consistency, simplifying node representation, thereby reducing false positive and false negative rates in the subsequent taint analysis process.

[0042] 2. The present invention utilizes static taint analysis technology to propagate taints within procedures and between functions based on the reconstruction of the abstract syntax tree. The taint detector is used to cover all cryptographic API misuse rules, thereby determining the detected cryptographic API misuse instances.

[0043] In general, this invention fills the gap in the current lack of cryptographic API misuse detection for Python applications, and plays an important supporting and promoting role in the field of cryptographic application security assessment.

[0044] In order to more clearly demonstrate the technical solution and technical effects provided by the present invention, the method provided by the embodiment of the present invention is described in detail below with reference to specific embodiments.

[0045] In the following examples, the API provided by the 21 mainstream cryptographic libraries of Python programming language is sorted out for the password misuse rules, the ternary abstract of static taint analysis is mapped to the Python language-oriented password API misuse detection scheme, the abstract syntax tree is reconstructed to process the high-level features of Python language and the static call relationship between functions in the program file, the static taint analysis technology is used to track the taint data flow along the reconstructed abstract syntax tree, and five kinds of taint detectors are proposed and constructed to cover all the password API misuse rules.

[0046] I. Determine the Python language password API misuse rule set.

[0047] The password misuse rule can provide the basis for password API misuse identification, by sorting out the API and its function of the Python mainstream cryptographic library, five main password API misuse types are extracted, and further analysis of the best practice of the corresponding password API is carried out, and the password misuse rules strongly coupled with the Python password API are sorted out.

[0048] (1) Sort out the API provided by the Python cryptographic library.

[0049] This part mainly includes the classification of the type of cryptographic library and the function of cryptographic library. In terms of the type of cryptographic library, it is classified according to the source of the cryptographic library, which is specifically divided into three basic categories: official standard cryptographic service library, cryptographic suite library and single-function third-party cryptographic library. In terms of the function of the cryptographic library, it is classified according to the supported cryptographic service function, which is specifically divided into five basic categories: symmetric cryptographic algorithm, asymmetric cryptographic algorithm, hash algorithm, SSL / TLS function and pseudo-random number generator function. As shown in Table 1, the API and the function of the 21 mainstream cryptographic libraries of Python language are sorted out in the embodiment of the application. Generally speaking, the mainstream cryptographic library API sorted out in the application covers most of the password use scenarios. In addition, the application considers the scalability of the new type of cryptographic library API, and uses the YAML file for easy configuration.

[0050] Table 1: Python language mainstream cryptographic library API and function sorting

[0051]

[0052]

[0053] (2) Summarize the password misuse in Python project.

[0054] In the embodiment of the application, five types of password misuse are summarized, which are described as follows

[0055] 1) Use weak security strength password algorithm:

[0056] 2) Using cryptographic algorithms with weak parameter configurations;

[0057] 3) Using cryptographic algorithms with weak randomness;

[0058] 4) Use weak SSL / TLS protocol algorithms;

[0059] 5) Other misuse situations.

[0060] (3) Combining the classification results with the password misuse in Python projects and based on the cryptographic security usage specifications, a set of Python language password API misuse rules is obtained.

[0061] In this embodiment of the present invention, 17 rules are compiled for the Python language, covering the five aforementioned password misuse scenarios. It should be noted that since the password library API maintains functional consistency across programming languages, the password rule descriptions in this embodiment are partially identical to those in existing descriptions for other programming languages, while some are different.

[0062] Table 2: Password misuse detection rules for Python language

[0063]

[0064]

[0065] As shown in Table 2, this embodiment of the present invention summarizes 17 password misuse detection rules for the Python language, dividing password misuse situations into the following 5 categories and 17 rules:

[0066] a) Rules related to weak security strength: It is prohibited to use insecure hash cryptographic algorithms, insecure symmetric cryptographic algorithms, and insecure asymmetric cryptographic algorithms.

[0067] Specifically: According to NIST SP 800-57, cryptographic algorithms with an estimated maximum security strength of less than 112 bits (e.g., 80 bits) are no longer considered adequate. R-01, R-02, and R-03 focus on CWE-327 (Use of Broken or Compromised Cryptographic Algorithms) and prohibit the use of insecure hashing algorithms (such as MD2, MD4, MD5, SHA-1, and RIPEMD-160), insecure symmetric cryptographic algorithms (such as RC2, RC4, DES, Blowfish, and IDEA), and insecure asymmetric cryptographic algorithms (such as RSA-1024, ECDSA-P192, and DSA-1024).

[0068] b) Weak parameter configuration rules: Do not use the PKCS#1v1.5 padding algorithm in RSA, do not use the ECB working mode in symmetric encryption algorithms, and do not use fewer than 1000 iterations in the PBE algorithm.

[0069] Specific: Cryptographic libraries often provide developers with various parameter options in specific APIs. However, it is important to be aware that some parameters may not be secure. R-04 prohibits the use of PKCS#1-v1.5 padding in the RSA algorithm (such as the PyCryptodome library) because it is vulnerable to chosen ciphertext attacks. In addition, it is recommended to use RSA with optimized asymmetric encryption padding (OAEP) for encryption and the probabilistic signature scheme (PSS) for signing. R-05 prohibits the use of ECB mode in symmetric ciphers (such as the M2Crypto library) due to its predictability and lack of diffusion. R-06 requires password-based key derivation functions to have at least 1000 iterations (such as the cryptography library).

[0070] c) Rules related to weak randomness: Do not use insecure pseudo-random number generators, do not use predictable / hard-coded salt values ​​and passwords in the PBE algorithm, do not use predictable / hard-coded keys, do not use non-random IVs in CBC and CFB working modes, do not use non-unique IVs / Nonces / Counters in CTR, OFB, GCM, and XTS working modes.

[0071] Specifically: Various cryptographically critical parameters, such as salts, keys, and initialization vectors (IVs), should be randomly generated. R-07 prohibits the use of cryptographically insecure pseudorandom number generators (PRNGs) in security contexts, such as key derivation and key agreement. Python provides both insecure PRNGs (such as the random library) and secure PRNGs (such as the secrets library). Because the random library is designed for modeling and simulation rather than security, the secrets library should be used in preference. R-08 prohibits the use of constant passwords / salts in PBE, as this defeats the purpose of adding randomness to derived keys. R-09 prohibits the use of predictable / constant cryptographic keys; keys should be derived from secure PRNGs rather than hard-coded in the program. R-10 and R-11 address the use of IVs in block ciphers. IVs are random numbers used to randomize encryption. Predictable IVs can lead to security vulnerabilities, such as the BEAST attack. Specifically, IVs / nonce / counters in CTR, OFB, GCM, and XTS modes should be unique, while IVs in CBC and CFB modes should be randomly generated.

[0072] d) Rules related to weak SSL / TLS protocols: It is prohibited to skip certificate / hostname verification in the SSL / TLS protocol, it is prohibited to use insecure SSL / TLS protocol versions or cipher suites, and it is prohibited to turn off SSL / TLS protocol certificate verification warnings.

[0073] Specifically: Due to the widespread use of SSL / TLS, there are numerous cryptographic misuse risks associated with it. R-12 requires proper validation of certificates and hostnames during network connections. Bypassing certificate validation or accepting all hostnames is considered unsafe. For example, in the requests library, a number of methods (such as POST and GET) can bypass validation by setting the verify parameter to false. R-13 prohibits the use of insecure SSL / TLS protocol versions (such as SSLv2.0, SSLv3.0, and TLSv1.0) and insecure cipher suites that are vulnerable to the BEAST and CRIME attacks. Furthermore, because CBC mode is vulnerable to padding oracle attacks in client / server scenarios, cipher suites containing CBC mode (such as AES-CBC) and weak ciphers (such as DES and RC4) are unsafe. Furthermore, several libraries (such as urllib3 and requests) provide mechanisms to suppress all unsafe warnings. Specifically, if the disable_warnings function is called, certificate verification failures are ignored. R-14 describes this unsafe scenario.

[0074] e) Other related rules: It is prohibited to use insecure plain text protocols, it is prohibited to bind services to all network interfaces, and it is prohibited to use unverified JWT.

[0075] Specifically: The remaining password API misuse rules are grouped together. R-15 restricts insecure protocols (e.g., HTTP, FTP, TELNET, LDAP) because they are plaintext in nature. It is recommended to choose corresponding encrypted protocols such as HTTPS, SFTP, SSH, and LDAPS. R-16 is concerned that binding to all network interfaces may accidentally expose services to traffic on unintended interfaces. R-17 emphasizes the significant risk to user identity privacy when JWT is not securely verified in authentication and authorization scenarios.

[0076] 2. Generate and reconstruct the abstract syntax tree of the program file.

[0077] In the embodiment of the present invention, Python program files are analyzed. After obtaining the Python program files, the analyzed program files are converted into an abstract syntax tree (IR) format. The IR is then reconstructed based on the characteristics of the Python language to simplify nodes and establish connections between nodes. The details are as follows:

[0078] (1) For dynamic features, the purpose of reconstructing the abstract syntax tree is to identify the parameter values ​​in dynamic methods and the fully qualified names of the methods in the cryptographic API. For example, the dynamic package import method of importlib is converted into an import call node based on its parameters.

[0079] Specifically, when reconstructing the abstract syntax tree based on dynamic features, the main considerations include: two dynamic features: the getattr method and the importlib method.

[0080] When refactoring the getattr method, the built-in dynamic attribute acquisition method getattr loads the attributes of the object at runtime. By refactoring the getattr node in the abstract syntax tree into a call node, the fully qualified API name is combined to match the password API call process;

[0081] When refactoring the importlib method, the built-in dynamic library import method importlib imports the specified library at runtime. By reconstructing the importlib node in the abstract syntax tree into an import node, the fully qualified API name is obtained in combination with the library's import relationship to match the password API call process.

[0082] (2) In view of the object reference transfer feature, the abstract syntax tree is reconstructed to establish relationships between nodes to track the calling process.

[0083] Specifically, when reconstructing the abstract syntax tree based on the object reference transfer feature, a variable definition-use mapping table is constructed. After the variable has been assigned multiple times, the original value is found through the mapping table to implement alias propagation. The variables include regular variables and function variables.

[0084] When refactoring a regular variable, the left value (variable name) of the assignment statement in the regular variable assignment operation is used as the key in the mapping table, and the right value (variable value) of the assignment statement is used as the value in the mapping table to construct a regular variable definition-use mapping table;

[0085] When refactoring function variables, the left value of the assignment statement (variable name) in the function variable assignment operation is used as the key in the mapping table, the right value of the assignment statement (function name) is used as the value in the mapping table, and the constructor variable definition - use the mapping table.

[0086] (3) In view of the formatted string feature, the abstract syntax tree is reconstructed by parsing the formatted string into a String node.

[0087] Specifically, when reconstructing the abstract syntax tree based on the characteristics of the formatted string, three types of formatted strings are mainly considered: C-printf style formatted strings, format style formatted strings, and interpolation formatted strings (f-string style) formatted strings; among them:

[0088] For C-style formatted strings, the C-style percent placeholders are mapped to the following variables in order to form an integrated string.

[0089] For the formatting string of the formatting style, the bracket placeholders are matched with the variables in the format method in order to form an integrated string;

[0090] For a formatted string in the interpolation format string style, convert the interpolation format string style string into a formatted string in the formatting style by matching square brackets, and then convert it into an integrated string.

[0091] (4) For the With statement feature, the abstract syntax tree is restructured by integrating additional var nodes in the With statement body to accurately locate the temporary assignment of the as clause. This approach helps identify aliasing behavior and enhances the recognition of fully qualified API names.

[0092] Specifically, the abstract syntax tree is reconstructed according to the characteristics of the With statement, the as clause in the With statement is reconstructed into a special assignment statement, and the variable node is used to record in the context established by the With statement.

[0093] 3. Mark the taint sources, purification functions, and sinks according to the cryptographic API misuse rules.

[0094] In an embodiment of the present invention, the underlying cryptographic library API and associated parameters in the upper-layer cryptographic misuse rules for taint analysis of the cryptographic application are determined. The Python-based cryptographic application uses pattern matching technology to traverse the leaf nodes of the abstract syntax tree to match the fully qualified names of related call methods to mark the taint analysis role.

[0095] As shown in Table 3, the present invention defines the source, sink, or sanitizer roles played by Python cryptography library APIs in the taint analyzer. By conducting an in-depth analysis of the APIs and their parameters of 21 Python cryptography libraries, considering the fully qualified names of the APIs involved in each rule, and using pattern matching technology to mark specific roles when traversing the abstract syntax tree nodes.

[0096] Table 3: Python cryptography library APIs and their role as source, sink, or sanitizer in taint analyzers

[0097]

[0098]

[0099] 4. Static stain analysis.

[0100] In an embodiment of the present invention, based on the static taint analysis technology, it is determined whether the program file triggers any cryptographic API misuse rule in the cryptographic API misuse rule set, so as to obtain the cryptographic API misuse detection result of the program file under the cryptographic API misuse rule. Specifically, based on the reconstructed abstract syntax, the cryptographic API misuse detection based on static taint analysis is performed for the cryptographic misuse rules in the cryptographic application. Based on the above-mentioned parsing and reconstruction of the program file to obtain the abstract syntax tree, the source node corresponding to the rule is located in the reconstructed abstract syntax tree, and the taint propagation is performed with the source node as the starting point. Specifically, the layer-order traversal of the abstract syntax tree is performed, and the taint propagation is carried out within the process and between methods of the intermediate nodes of the purification function or assignment propagation, and finally the taint detection is performed at the convergence point according to the taint detector.

[0101] In an embodiment of the present invention, the following five taint detectors are proposed to cover all cryptographic API misuse rules.

[0102] (1) An unsafe function call detector, used to identify unsafe cryptographic API calls in the program file.

[0103] Specifically, the crypto libraries usually provide multiple API choices for developers. However, to be compatible with old systems, these libraries can contain certain insecure API functions. This detector inspects the call nodes in the abstract syntax tree and matches the fully qualified name with the patterns defined by the API. For example, when the md5 function in the hashlib library is used, the detector triggers a warning alert. There are other insecure function calls, such as insecure symmetric cipher algorithms (R-02) and insecure padding algorithms for RSA (R-04). For rule R-05, the pyaes library provides an insecure AESModeOfOperationECB API for direct invocation. Regarding rule R-14, the present invention considers that the use of APIs such as urllib3.disable_warning and requests.packages.urllib3.disable_warnings to suppress SSL / TLS certificate validation warnings is considered insecure. For R-15, the present invention detects library calls that provide insecure protocols (such as FTP and HTTP) (such as ftplib, http.client).

[0104] (2) Parameter value detector for identifying specific cryptographic API calls in the program file and determining insecure parameter value calls.

[0105] Specifically, in Python crypto libraries, user-defined methods are usually used to specify specific cryptographic primitives, such as key size in asymmetric algorithms and iteration count in PBE. This detector processes numerical parameters as direct sources of taint, with specific function calls as sinks, to analyze feature parameter configurations. For example, API for key generation in asymmetric cryptographic algorithms usually generates key pairs of different sizes using various parameters (such as key_size, bits), and developers lacking knowledge of cryptography may generate weak keys by setting insufficient size values in the API. The iteration count for password-based key derivation methods should exceed 1,000 (R-06).

[0106] (3) Parameter option detector for identifying specific cryptographic API calls in the program file and determining insecure parameter option calls.

[0107] Specifically, the detector identifies insecure option properties that violate established rules as potential sources of concern when parameters go beyond simple numerical values ​​and include specific complex properties for selection. For example, with R-03, the cryptographic API uses attribute curves (such as ecdsa.NIST192p) to represent different key lengths for elliptic curve cryptography algorithms. With R-05, R-10, and R-11, they derive from the same API and offer different encryption mode options, such as Crypto.Cipher.AES.MODE_ECB. With R-12 and R-13, they address SSL / TLS version and verification issues. Libraries often provide many insecure SSL / TLS versions (such as OpenSSL.SSL.TLSv1_METHOD) and allow disabling certificate verification during network connections (such as by setting ssl.CERT_NONE to the cert_reqs parameter in urllib3.PoolManager).

[0108] (4) A randomness detector for identifying specific cryptographic API calls in the program file and determining hard-coded parameter calls and insecure random number generator API calls.

[0109] Specifically, the weak randomness covered by the Crypto API Misuse Rules (R-07 to R-11) requires that keys, initialization vectors, and salt values ​​have sufficient randomness to ensure strong security. The detector involves two steps when detecting parameters passed to the sink. First, determine whether the parameters have been filtered through a clean point (e.g., secrets.token_bytes). Second, evaluate whether the parameters are marked as tainted, indicating the use of insecure pseudo-random number generator (PRNG) methods (e.g., random libraries) or constant objects (e.g., hard-coded strings or bytes). In particular, in R-10 and R-11, it is essential to implement a two-layer detection check for randomness, which involves tracking parameter options (e.g., Cryptodome.Cipher.DES.MODE_CTR) to confirm the encryption mode and performing detailed randomness checks on the initialization vector.

[0110] (5) A specific structure detector for identifying specific cryptographic API calls in the program file and determining unsafe specific structure calls.

[0111] Specifically, the detector performs preliminary structural parsing to assess rule violations when detecting API parameters that display a specific structure (such as a tuple, dictionary, or formatted string). For example, in R-15, the request.post function requires that parameters (such as url) are HTTP links, which are verified by matching their string values ​​with regular expressions. In addition, in R-16, the bind method in the socket library requires an address parameter, which is a tuple containing an IP address and a port number for socket binding. Further, in R-17, the jwt.decode function includes an options dictionary parameter that provides extended decoding and verification options (for example, handling unverified JWT signatures).

[0112] 5. Obtain the results of the password API misuse detection.

[0113] In the embodiment of the present invention, based on the password misuse rules set in the password misuse rule set and combined with the judgment method for each password misuse rule in the fourth part above, the password API misuse detection result of the program file is obtained.

[0114] The above-mentioned solution provided by the embodiment of the present invention can determine the cryptographic misuse rules that are strongly coupled with the Python language by sorting out the cryptographic algorithm APIs and cryptographic functions of the mainstream Python cryptographic library, and at the same time specifically reconstruct the abstract syntax tree to adapt to the advanced characteristics of the Python dynamic language, thereby designing an automatic detection method for cryptographic API misuse based on taint analysis technology, and providing a comprehensive and intuitive cryptographic application security assessment mechanism for applications developed based on the Python language.

[0115] Through the description of the above embodiments, those skilled in the art will clearly understand that the above embodiments can be implemented through software or by using software plus a necessary general-purpose hardware platform. Based on this understanding, the technical solutions of the above embodiments can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, a USB flash drive, a mobile hard disk, etc.) and includes a number of instructions for causing a computer device (such as a personal computer, a server, or a network device) to execute the methods described in the various embodiments of the present invention.

[0116] Example 2

[0117] The present invention also provides a Python language password API misuse automatic detection system, which is mainly used to implement the method provided in the above embodiment, such as Figure 2 As shown, the system mainly includes:

[0118] Misuse rule acquisition module, which obtains the Python language cryptography API misuse rule set based on cryptography security usage specifications;

[0119] The program file conversion module is used to convert the analyzed program file into the abstract syntax tree IR form and reconstruct the abstract syntax tree according to the characteristics of the Python language;

[0120] A node initialization module, used to mark taint sources, purification functions, and sinks in the reconstructed abstract syntax tree according to the set of Python language cryptography API misuse rules;

[0121] a misuse detection module, configured to combine the marked taint sources, cleansing functions, and convergence points, and use a taint detector based on static taint analysis technology to determine whether the analyzed program file triggers any cryptographic API misuse rule in the cryptographic API misuse rule set, so as to obtain a cryptographic API misuse detection result for the analyzed program file under the corresponding cryptographic API misuse rule;

[0122] The misuse result generation module is used to integrate the cryptographic API misuse detection results of the analyzed program file under the Python language cryptographic API misuse rule set to obtain the final cryptographic API misuse detection results of the analyzed program file.

[0123] Considering that the main technical details and technical effects involved in the above system have been explained in the above embodiments, they will not be repeated here.

[0124] Those skilled in the art will clearly understand that for the convenience and brevity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules to complete all or part of the functions described above.

[0125] Example 3

[0126] The present invention also provides a processing device, such as Figure 3 As shown, it mainly includes: one or more processors; a memory for storing one or more programs; wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided by the aforementioned embodiment.

[0127] Furthermore, the processing device further includes at least one input device and at least one output device; in the processing device, the processor, memory, input device, and output device are connected via a bus.

[0128] In the embodiment of the present invention, the specific types of the memory, input device, and output device are not limited; for example:

[0129] The input device can be a touch screen, image acquisition device, physical button or mouse;

[0130] The output device may be a display terminal;

[0131] The memory may be a random access memory (RAM) or a non-volatile memory, such as a disk memory.

[0132] Example 4

[0133] The present invention also provides a readable storage medium storing a computer program, which implements the method provided in the above embodiment when the computer program is executed by a processor.

[0134] In the embodiments of the present invention, the computer-readable storage medium may be provided in the aforementioned processing device, for example, as a memory in the processing device. Alternatively, the computer-readable storage medium may be a USB flash drive, a removable hard drive, a read-only memory (ROM), a magnetic disk, or an optical disk, among other media capable of storing program code.

[0135] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A Python language cryptographic API misuse automatic detection method, characterized by: include: Obtain a set of misuse rules for the Python language cryptography API based on cryptography security usage specifications; Convert the analyzed program file into an abstract syntax tree intermediate representation and reconstruct the abstract syntax tree according to the Python language characteristics; According to the set of Python language cryptography API misuse rules, mark the taint sources, purification functions and convergence points in the reconstructed abstract syntax tree; Combining the marked taint sources, cleansing functions, and convergence points, based on static taint analysis technology, using a taint detector to determine whether the analyzed program file triggers any cryptographic API misuse rule in the cryptographic API misuse rule set, so as to obtain a cryptographic API misuse detection result for the analyzed program file under the corresponding cryptographic API misuse rule; The cryptographic API misuse detection result of the analyzed program file is obtained by integrating the cryptographic API misuse rule set of the Python language to obtain the final cryptographic API misuse detection result of the analyzed program file; The step of reconstructing the abstract syntax tree according to Python language characteristics includes: Reconstruct the abstract syntax tree according to dynamic features, which include: getattr method and importlib method; among them: when reconstructing the getattr method, the built-in dynamic attribute acquisition method getattr loads the attributes of the object at runtime, and the getattr node in the abstract syntax tree is reconstructed into a call node, and the API fully qualified name is combined to match the password API call process; when reconstructing the importlib method, the built-in dynamic library import method importlib imports the specified library at runtime, and the importlib node in the abstract syntax tree is reconstructed into an import node, and the API fully qualified name is obtained in combination with the library import relationship to match the password API call process; An abstract syntax tree is reconstructed based on the object reference transfer feature, and a variable definition-use mapping table is constructed. After the variable has been assigned multiple times, the original value is found through the mapping table. The variables include regular variables and function variables. When reconstructing regular variables, the left value of the assignment statement in the regular variable assignment operation is used as the key in the mapping table, and the right value of the assignment statement is used as the value in the mapping table to construct a regular variable definition-use mapping table. When reconstructing function variables, the left value of the assignment statement in the function variable assignment operation is used as the key in the mapping table, and the right value of the assignment statement is used as the value in the mapping table to construct a variable definition-use mapping table. Reconstruct the abstract syntax tree based on the characteristics of the formatted string. The formatted strings include: C-style formatted strings, formatted-style formatted strings, and interpolated-format string-style formatted strings. For the C-style formatted strings, the C-style percent placeholders are matched with the following variables in order to form an integrated string. For the formatted-style formatted strings, the square bracket placeholders are matched with the variables in the format method in order to form an integrated string. For the interpolated-format string-style formatted strings, the interpolated-format string-style strings are converted into formatted-style formatted strings by matching square brackets, and then converted into an integrated string. Reconstruct the abstract syntax tree according to the characteristics of the With statement, reconstruct the as clause in the With statement into a special assignment statement, and use the variable node to record in the context established by the With statement.

2. The Python language cryptographic API misuse automatic detection method according to claim 1 is characterized in that: The set of Python language cryptography API misuse rules based on cryptography security usage specifications is obtained based on the following steps: Sorting out the APIs provided by Python's cryptographic libraries, including: classifying cryptographic library types and functions; Summarize the misuse of passwords in Python projects; Combining the classification results with the password misuse in Python projects and according to the cryptography security usage specifications, a set of Python language password API misuse rules is obtained.

3. The Python language cryptographic API misuse automatic detection method according to claim 1 is characterized in that: The stain detector comprises: an unsafe function call detector for identifying unsafe cryptographic API calls in the program file; a parameter value detector for identifying specific cryptographic API calls in the program file and determining unsafe parameter value calls; A parameter option detector for identifying specific cryptographic API calls in the program file and determining unsafe parameter option calls; A randomness detector for identifying specific cryptographic API calls in the program file and determining hard-coded parameter calls and insecure random number generator API calls; A specific structure detector is used to identify specific cryptographic API calls in the program file and determine unsafe specific structure calls.

4. A Python language cryptographic API misuse automatic detection system, characterized by: The method for implementing any one of claims 1 to 3 comprises: Misuse rule acquisition module, which obtains the Python language cryptography API misuse rule set based on cryptography security usage specifications; Program file conversion module, used to convert the analyzed program file into an abstract syntax tree intermediate representation and reconstruct the abstract syntax tree according to Python language characteristics; A node initialization module, used to mark taint sources, purification functions, and sinks in the reconstructed abstract syntax tree according to the set of Python language cryptography API misuse rules; a misuse detection module, configured to combine the marked taint sources, cleansing functions, and convergence points, and use a taint detector based on static taint analysis technology to determine whether the analyzed program file triggers any cryptographic API misuse rule in the cryptographic API misuse rule set, so as to obtain a cryptographic API misuse detection result for the analyzed program file under the corresponding cryptographic API misuse rule; The misuse result generation module is used to integrate the cryptographic API misuse detection results of the analyzed program file under the Python language cryptographic API misuse rule set to obtain the final cryptographic API misuse detection results of the analyzed program file.

5. A processing device, characterized in that: include: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 3.

6. A readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images