Security detection method and device based on encryption and decryption agent, and storage medium

Abstract

The invention discloses a security detection method and device based on an encryption and decryption agent and a storage medium, and the method comprises the steps: carrying out the decryption of ciphertext communication data in response to the received ciphertext communication data sent by a to-be-detected application system, and obtaining plaintext communication data; adjusting the plaintext communication data according to a preset security detection rule to obtain adjusted plaintext communication data; performing encryption processing on the adjusted plaintext communication data to obtain adjusted ciphertext communication data; and transmitting the adjusted ciphertext communication data to a corresponding server for security detection processing to obtain a security detection result returned by the server. According to the scheme, the safety and reliability of the communication process can be improved.

Description

Technical Field

[0001] The present application relates to the field of software testing technology, and in particular to a security detection method, device and storage medium based on encryption and decryption agents. Background Art

[0002] In the field of software testing technology, vulnerability detection is usually implemented based on software version matching methods or vulnerability detection programs such as POC (Proof of Concept). Among them, the vulnerability detection mechanism based on POC is widely used because it can effectively verify whether the tested application system has security vulnerabilities.

[0003] However, currently many Web sites and APP software set up one or more security mechanisms to encrypt network interaction content for security reasons, resulting in the inability of vulnerability detection programs to obtain data during network interaction through POC methods to implement vulnerability detection, and also making the detection results unable to truly reflect whether the tested application system actually has security risks.

[0004] Existing penetration testing and vulnerability detection programs cannot effectively perform security testing on application systems with security mechanisms. Summary of the invention

[0005] The present application at least provides a security detection method, apparatus, device and computer-readable storage medium based on encryption and decryption agents.

[0006] The first aspect of the present application provides a security detection method based on an encryption and decryption agent, comprising: in response to receiving ciphertext communication data sent by an application system to be tested, decrypting the ciphertext communication data to obtain plaintext communication data; adjusting the plaintext communication data according to preset security detection rules to obtain adjusted plaintext communication data; encrypting the adjusted plaintext communication data to obtain adjusted ciphertext communication data; transmitting the adjusted ciphertext communication data to a corresponding server for security detection processing, and obtaining a security detection result returned by the server.

[0007] In one embodiment, the step of decrypting the ciphertext communication data to obtain plaintext communication data includes: obtaining security mechanism data corresponding to the application system to be tested; and decrypting the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data.

[0008] In one embodiment, before the step of decrypting the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data, the method also includes: matching the ciphertext communication data and the security detection rules to obtain a matching result; the step of decrypting the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data includes: in response to the matching result indicating a successful match, decrypting the ciphertext communication data using the security processing rules and / or security identifiers in the security mechanism data to obtain the plaintext communication data.

[0009] In one embodiment, after the step of matching the ciphertext communication data with the security detection rules to obtain a matching result, the method further includes: in response to the matching result indicating a matching failure, determining a server corresponding to the application system to be tested, a communication connection existing between the server and the application system to be tested, the server being used to receive the ciphertext communication data sent by the application system to be tested; and transparently transmitting the ciphertext communication data to the server.

[0010] In one embodiment, the step of adjusting the plaintext communication data according to preset security detection rules to obtain the adjusted plaintext communication data includes: determining the content to be adjusted of one or more fields in the plaintext communication data according to the security detection rules; performing data adjustment processing on the content to be adjusted to obtain the adjusted plaintext communication data, and the data adjustment processing includes at least one of data addition processing, data deletion processing or data modification processing.

[0011] In one embodiment, before the step of decrypting the ciphertext communication data to obtain plaintext communication data in response to receiving the ciphertext communication data sent by the application system under test, the method further includes: acquiring security mechanism data of the application system under test for local configuration processing; after the step of responding to receiving the ciphertext communication data sent by the application system under test, the method further includes: searching for security mechanism data corresponding to the application system under test.

[0012] In one embodiment, the security mechanism data includes security processing rules and / or security identification, and the step of encrypting the adjusted plaintext communication data according to the security mechanism data to obtain the adjusted ciphertext communication data includes: encrypting the adjusted plaintext communication data according to the security processing rules to obtain the adjusted ciphertext communication data; or encrypting the adjusted plaintext communication data according to the security identification to obtain the adjusted ciphertext communication data.

[0013] In one embodiment, the step of transmitting the adjusted ciphertext communication data to the corresponding server for security detection processing and obtaining the security detection result returned by the server includes: transmitting the adjusted ciphertext communication data to the server so that the server decrypts the received adjusted ciphertext communication data, and determines the security detection result based on the decryption result and sends it to the security detection system; after the step of transmitting the adjusted ciphertext communication data to the corresponding server and obtaining the security detection result returned by the server, the method also includes: determining whether the application system to be tested is safe based on the security detection result.

[0014] The second aspect of the present application provides a security detection device based on an encryption and decryption agent, including: a data decryption module, which is used to decrypt the ciphertext communication data in response to receiving the ciphertext communication data sent by the application system to be tested, so as to obtain plaintext communication data; a data adjustment module, which is used to adjust the plaintext communication data according to preset security detection rules, so as to obtain adjusted plaintext communication data; a data encryption module, which is used to encrypt the adjusted plaintext communication data, so as to obtain adjusted ciphertext communication data; a data transmission module, which is used to transmit the adjusted ciphertext communication data to a corresponding server for security detection processing, so as to obtain a security detection result returned by the server.

[0015] A third aspect of the present application provides an electronic device, including a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the above-mentioned security detection method based on encryption and decryption agents.

[0016] A fourth aspect of the present application provides a computer-readable storage medium on which program instructions are stored. When the program instructions are executed by a processor, the above-mentioned security detection method based on encryption and decryption agents is implemented.

[0017] The above scheme, in response to receiving the ciphertext communication data sent by the application system to be tested, obtains the plaintext communication data by decrypting the ciphertext communication data; adjusts the plaintext communication data according to the preset security detection rules to obtain the adjusted plaintext communication data, so that the ciphertext communication data originally to be sent to the server is changed; then encrypts the adjusted plaintext communication data to obtain the adjusted ciphertext communication data; transmits the adjusted ciphertext communication data to the corresponding server for security detection, determines whether the server can still decrypt and apply the adjusted ciphertext communication data, etc., and obtains the security detection result returned by the server. In this way, the security detection process is optimized and the security reliability of the communication process is improved.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0020] Figure 1 It is a flowchart of an exemplary embodiment of the security detection method based on encryption and decryption agent of the present application;

[0021] Figure 2 It is a simplified schematic diagram of the security detection system in the security detection method based on encryption and decryption agent of the present application;

[0022] Figure 3 is a block diagram of a security detection device based on encryption and decryption agent shown in an exemplary embodiment of the present application;

[0023] Figure 4 It is a structural schematic diagram of an embodiment of the electronic device of the present application;

[0024] Figure 5 It is a structural diagram of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0025] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0026] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0027] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship. In addition, "many" in this article means two or more than two. In addition, the term "at least one" in this article means any combination of at least two of any one or more of a plurality of, for example, including at least one of A, B, and C, can mean including any one or more elements selected from the set consisting of A, B, and C.

[0028] For ease of understanding, one of the applicable scenarios of this application is now exemplified. Currently, the security vulnerability scanning tools on the market generally implement vulnerability detection based on version matching or based on POC vulnerability verification programs. Among them, the vulnerability detection mechanism based on POC can effectively verify whether the tested application system has security vulnerabilities and is widely used and accepted.

[0029] Currently, many websites and APP applications perform security processing such as key encryption and hashing algorithms on network communications and interactive content for security reasons, which results in the inability of existing vulnerability scanning tools to detect vulnerabilities through POC methods, and the detection results cannot truly reflect whether the tested application has security risks. At the same time, security testers cannot directly verify whether the tested application system has vulnerabilities such as unauthorized access by modifying data content or replaying data, so such vulnerabilities cannot be discovered in time. Therefore, the existing penetration testing and vulnerability scanning systems cannot effectively perform security detection on encrypted or signed application systems.

[0030] See also Figure 1 , Figure 1 1 is a flowchart of an exemplary embodiment of the security detection method based on encryption and decryption agent of the present application. The security detection method of the present application can be applied to a security detection system (security detection tool), and can refer to Figure 2 As shown, Figure 2 This is a simplified schematic diagram of the security detection system in the security detection method based on encryption and decryption proxy of the present application. It should be noted that the security detection system of the present application can be deployed in the client where the application system to be tested is located, or deployed in the server that communicates and interacts with the client, or deployed separately and communicates with the client and the server, which is not limited here. Specifically, it can include the following steps:

[0031] Step S110, in response to receiving the ciphertext communication data sent by the application system to be tested, decrypting the ciphertext communication data to obtain plaintext communication data.

[0032] Among them, ciphertext communication data refers to the communication data (or interactive data) that is encrypted during the communication process between the application system to be tested and the corresponding server. Plaintext communication data refers to the communication data that is not encrypted during the communication process between the application system to be tested and the corresponding server, or the data obtained after decrypting the ciphertext communication data. The application system to be tested in this application can be a common one such as an APP application system, a Web application system, etc., which is not limited here.

[0033] It is understandable that during the security test of the application system to be tested, if plaintext communication data sent by the application system to be tested is received, detection and processing can be performed based on conventional security detection schemes (for example, detection based on traditional POC tools, or modifying the plaintext communication data before transmitting it, or repeatedly transmitting the same plaintext communication data, etc.), or you can choose not to perform security detection processing on the plaintext communication data, and directly transparently transmit the plaintext communication data to the server, which will not be elaborated here.

[0034] As for the ciphertext communication data sent by the application system to be tested, it is necessary to perform security detection processing based on it. Therefore, the ciphertext communication data sent by the application system to be tested can also be understood as the data to be tested in this application for security detection. Specifically, after receiving the ciphertext communication data sent by the application system to be tested, it is necessary to first decrypt the ciphertext communication data to obtain the plaintext communication data.

[0035] Exemplarily, there may be one or more methods for decrypting ciphertext communication data, which are not limited here. Among them, the decryption processing method may be preset, and / or obtained by the security testing system from the application system to be tested, the server end, and other device ends. For example, after receiving the ciphertext communication data sent by the application system to be tested, the security testing system of the present application may apply to the application system to be tested for the security mechanism data (such as security processing rules (such as hash, MD5 and other encryption and decryption algorithms, message authentication methods, etc.), security identification (such as keys, signatures, etc.)) when encrypting and decrypting the ciphertext communication data. As a result, the security testing system of the present application can perform encryption and decryption processing on the ciphertext communication data in the same way as the application system to be tested, and obtain plaintext communication data for subsequent processing.

[0036] Step S120, adjusting the plaintext communication data according to a preset security detection rule to obtain adjusted plaintext communication data.

[0037] The security detection rules refer to detection processes that are preset for different application systems to be tested and / or different types of communication data (data to be tested).

[0038] Exemplarily, the security detection rules may include one or more of adding field content in the communication data, deleting field content in the communication data, modifying field content in the communication data, etc., which are not limited here. For example, when the application system A to be tested is conducting a security test, the communication data sent by it can be processed by adding fields, or when the application system A to be tested is conducting a security test, the communication data sent by it can be processed by modifying fields, etc., and corresponding settings can be made in advance so that corresponding searches can be performed when the security test is officially conducted.

[0039] If the server can successfully decrypt and apply the adjusted communication data, it means that during the communication process between the application system under test and the server, the communication data between the two can be tampered with, which to a certain extent indicates that there is a security vulnerability in the communication process between the application system under test and the server.

[0040] Step S130, encrypting the adjusted plaintext communication data to obtain adjusted ciphertext communication data.

[0041] The encryption process of the present application may include but is not limited to encryption and / or signature processing according to the actual application scenario. The encryption process of the security detection system in this step can be considered as a re-encryption process and / or re-signature process relative to the encryption process of the application system to be tested.

[0042] In conjunction with the above steps, there may be one or more methods for encrypting the adjusted plaintext communication data in this embodiment, which are not limited here. Among them, the encryption processing method may be preset, and / or obtained by the security testing system from the application system to be tested, the server end, and other device ends. For example, after the plaintext communication data is adjusted, the security testing system of the present application may use the obtained encryption processing method to encrypt the adjusted plaintext communication data to obtain the adjusted ciphertext communication data. As a result, the security detection system of the present application can modify the ciphertext communication data sent by the application system to be tested, and send it to the corresponding server end so that the server end can perform subsequent security detection processing.

[0043] Step S140, transmitting the adjusted ciphertext communication data to the corresponding server for security detection processing, and obtaining the security detection result returned by the server.

[0044] In conjunction with the above steps, it can be understood that when the server receives the tampered data, it is usually unable to decrypt it successfully, or it will not choose to apply it after successful decryption (for example, it will not respond to the data, and / or will not substitute the data into the current data processing process, and / or will not store the data, etc. There are many ways to apply data, which are not elaborated here).

[0045] Therefore, in this application, after the security detection system transmits the adjusted ciphertext communication data to the corresponding server, the server will attempt to perform security detection processing on it (which may include but is not limited to decryption processing and / or application processing). If the security detection result returned by the server indicates that the server successfully decrypts the adjusted ciphertext communication data and / or applies the adjusted ciphertext communication data, it is determined that there is a security problem between the application system to be tested and the server.

[0046] On the contrary, if the security detection result returned by the server indicates that the server fails to decrypt the adjusted ciphertext communication data and / or does not apply the adjusted ciphertext communication data, it is determined that there is no security problem between the application system to be tested and the server.

[0047] It can be seen that when the present application receives the ciphertext communication data sent by the application system to be tested, the ciphertext communication data is decrypted to obtain the plaintext communication data; the plaintext communication data is adjusted according to the preset security detection rules to obtain the adjusted plaintext communication data, so that the ciphertext communication data originally to be sent to the server is changed; the adjusted plaintext communication data is then encrypted to obtain the adjusted ciphertext communication data; the adjusted ciphertext communication data is transmitted to the corresponding server for security detection, and it is determined whether the server can still decrypt and apply the adjusted ciphertext communication data, etc., to obtain the security detection result returned by the server. This optimizes the security detection process and improves the security reliability of the communication process.

[0048] Based on the above embodiments, the embodiment of the present application exemplarily illustrates the steps of decrypting the ciphertext communication data to obtain the plaintext communication data. Specifically, the method of this embodiment includes the following steps:

[0049] Obtain security mechanism data corresponding to the application system to be tested; decrypt the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data.

[0050] In conjunction with the foregoing embodiments, the security detection system of the present application can be connected to one or more application systems to be tested. For different application systems to be tested, different application systems to be tested may have the same or different encryption and decryption algorithms, keys and / or signatures, etc., which all belong to security mechanism data. Therefore, the security detection system of the present application needs to obtain the security mechanism data of each application system to be tested before performing security detection on the application system to be tested, so as to decrypt the ciphertext communication data sent by the application system to be tested through the acquired security mechanism data to obtain the plaintext communication data.

[0051] It should be noted that, in the specific implementation process of the present application, the security mechanism data of one or more application systems to be tested may be pre-set in the security detection system, and then when the security detection system performs a security test on the target application system to be tested among the application systems to be tested, the security mechanism data corresponding to the target application system to be tested is searched for deployment and configuration. It is also possible that when the security detection system performs a security test on the target application system to be tested among the application systems to be tested, the security detection system initiates a data request to the target application system to be tested to obtain the security mechanism data sent by the target application system to be tested, etc., which will not be elaborated here.

[0052] Further, in the process that the safety test system obtains the security mechanism data identical with the application system to be tested, the verification process between the safety test system and the application system to be tested can also be arranged. It can include but is not limited to methods such as identity verification, data verification. For example, one or more of the password authentication technology (verifying based on private secret information, such as password or password, etc.) through the identity authentication technology, the digital certificate authentication technology (the electronic file issued by a trusted third party organization, which can include user identity information and public key, is used to prove user identity), the Kerberos identity authentication mechanism, etc. In this verification process, it can be that the safety test system verifies the application system to be tested, or the application system to be tested verifies the safety test system, or the safety test system and the application system to be tested verify each other; after verification, the safety test system of the present application can obtain the security mechanism data of the application system to be tested.

[0053] On the basis of the above embodiments, the embodiments of the present application describe the steps before decrypting the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data and the steps of decrypting the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data. Specifically, the method of this embodiment includes the following steps:

[0054] The ciphertext communication data and the security detection rules are matched to obtain a matching result; in response to the matching result indicating a successful match, the ciphertext communication data is decrypted using the security processing rules and / or security identifiers in the security mechanism data to obtain plaintext communication data.

[0055] In conjunction with the foregoing embodiments, various types of application systems to be tested and / or various types of data to be tested may have their own corresponding security detection rules, and their corresponding relationships may be preset or obtained by analyzing received test requirements (e.g., test requirement instructions, test requirement documents, etc.). The various rules mentioned in this application mainly refer to data processing processes that can be implemented by software code files when running in a processor.

[0056] During the specific implementation of the security detection method of the present application, the security detection system should detect the security detection rules that match the application system to be tested and / or the data to be tested before it can use the corresponding security detection rules for subsequent processing, which includes: using the successfully matched security mechanism data to decrypt the received ciphertext communication data to obtain plaintext communication data, and then modifying the plaintext communication data.

[0057] Exemplarily, the method of matching the application system to be tested and / or the data to be tested with the security detection rules may include, but is not limited to, matching the security detection rules according to the type, name, identification, and other information of the application system to be tested and / or the data to be tested. For example, when security tests are performed on the application system to be tested A and the application system to be tested B, different security detection rules are respectively corresponding; when security tests are performed on the data to be tested (such as domain name data and interface data) of the same application system to be tested, different security detection rules are respectively corresponding, etc., which will not be elaborated here.

[0058] Based on the above embodiment, the embodiment of the present application describes the steps after matching the encrypted communication data with the security detection rules to obtain the matching result. Specifically, the method of this embodiment includes the following steps:

[0059] In response to the matching result indicating a matching failure, a server corresponding to the application system under test is determined, a communication connection exists between the server and the application system under test, and the server is used to receive ciphertext communication data sent by the application system under test; and the ciphertext communication data is transparently transmitted to the server.

[0060] In conjunction with the above-mentioned embodiments, it is explained in the above-mentioned embodiments that if the security detection system detects a security detection rule that matches the application system to be tested and / or the data to be tested, the received ciphertext communication data can be decrypted according to the successfully matched security detection rule.

[0061] If the security detection system does not detect the security detection rules that match the application system to be tested and / or the data to be tested, it indicates that the security detection system cannot perform subsequent processing on the corresponding security detection rules, or it indicates that there is no need to process the current application system to be tested and / or the data to be tested. Therefore, it is determined that there is a corresponding communication connection with the application system to be tested. The ciphertext communication data received from the application system to be tested is transparently transmitted to the server, and the normal data communication interaction process is executed. Among them, transparent transmission is a well-known technology in the technical field, which mainly refers to the responsibility of transmitting the transmitted content from the source address to the destination address without changing the data content regardless of the business content of the transmission in the communication. The specific details are not repeated here.

[0062] Based on the above embodiments, the present embodiment of the present application describes the steps of adjusting and processing the plaintext communication data according to the preset security detection rules to obtain the adjusted plaintext communication data. Specifically, the method of this embodiment includes the following steps:

[0063] Determine the content to be adjusted of one or more fields in the plaintext communication data according to the security detection rules; perform data adjustment processing on the content to be adjusted to obtain adjusted plaintext communication data, and the data adjustment processing at least includes at least one of data addition processing, data deletion processing or data modification processing.

[0064] In conjunction with the above-mentioned embodiments, the method for adjusting data in the security detection rules of the present application may include at least one of data addition processing, data deletion processing or data modification processing. In addition, the security detection rules may also include data retention and replay processing, that is, not modifying the received data to be tested, but repeatedly transmitting the same data to be tested to the server (data replay), and then judging whether there is a security problem based on the response process of the server to the same data received multiple times.

[0065] Data replay, also known as replay attack or playback attack, is a common network attack method that needs to be prevented. It usually obtains the currently transmitted communication data and resends it to the client and / or server to interfere with the data receiver, making it mistakenly believe that it is a compliant data message. Under normal circumstances, the server should not respond to or apply processing to the same data received multiple times.

[0066] Exemplarily, in this embodiment, the content to be adjusted of one or more fields in the plaintext communication data can be determined according to the acquired security detection rules. The communication data field mainly refers to the data unit used to transmit information during the communication process. It is a data structure composed of one or more bytes, each of which can be used to store information or to represent a specific information type. As shown in Table 1 below, Table 1 simply shows the configuration format of the security detection rules of this application.

[0067]

[0068] Among them, if the current application system to be tested is system A, and the data object to be tested is the domain name *a.aaa.com, the security detection system can find the detection rule 1 that matches successfully, and use the data processing rule 1 included in the security detection rule 1 (for example, the aforementioned example includes but is not limited to data addition, data deletion, data modification and other adjustment processing methods) to adjust one or more field contents in the communication data packet related to the domain name *a.aaa.com to obtain the adjusted plaintext communication data.

[0069] On the basis of the above-mentioned embodiments, the embodiments of the present application describe the steps before decrypting the ciphertext communication data to obtain the plaintext communication data in response to receiving the ciphertext communication data sent by the application system to be tested, and the steps after receiving the ciphertext communication data sent by the application system to be tested. Specifically, the method of this embodiment includes the following steps:

[0070] Obtain the security mechanism data of the application system under test for local configuration processing; search for the security mechanism data corresponding to the application system under test.

[0071] In conjunction with the foregoing embodiments, in the present application, before the security detection system receives the ciphertext communication data sent by the application system to be tested, it can pre-acquire the security mechanism data of the application system to be tested for local configuration processing; or it can be that after the security detection system receives the ciphertext communication data sent by the application system to be tested, it acquires the security mechanism data of the application system to be tested for local configuration processing. This enables the security detection system of the present application to perform the same encryption and decryption processing as the application system to be tested on the received ciphertext communication data according to the locally configured security mechanism data. Therefore, after the security detection system receives the ciphertext communication data sent by the application system to be tested, it can search locally for the security mechanism data corresponding to the application system to be tested.

[0072] Based on the above embodiments, the embodiment of the present application describes the steps of encrypting the adjusted plaintext communication data according to the security mechanism data to obtain the adjusted ciphertext communication data. The security mechanism data includes security processing rules and / or security identification. Specifically, the method of this embodiment includes the following steps:

[0073] The adjusted plaintext communication data is encrypted according to the security processing rule to obtain the adjusted ciphertext communication data; or, the adjusted plaintext communication data is encrypted according to the security identifier to obtain the adjusted ciphertext communication data.

[0074] In conjunction with the above-mentioned embodiment, when the client application system to be tested encrypts the communication data, one or more security processing rules such as Secure Hash Algorithm (SHA) and Advanced Encryption Standard (AES) can be used for encryption processing. And / or one or more security identifiers such as signature strings, keys, random characters, etc. are used for encryption processing to obtain ciphertext communication data.

[0075] Therefore, when the security detection system of the present application encrypts the adjusted plaintext communication data, it can also refer to the above-mentioned example description and use the same and / or different security mechanism data as the application system to be tested for encryption processing to obtain the adjusted ciphertext communication data, and send the adjusted ciphertext communication data to the server.

[0076] Exemplarily, the data processing rules 1 and 2 in the above-mentioned example Table 1 are used for explanation. Please refer to the following Table 2:

[0077]

[0078] For example, the process of encryption processing according to the security identifier can be to obtain the original signature characters composed of the key-value pairs of three parameters: time information (time), random number (nonce) and application key (appSecret). It can be combined in the order of time, nonce, and appSecret, separated by English commas. Then the original signature characters are processed by MD5 and converted into a 32-bit lowercase string in hexadecimal to obtain the signature value sign (whose encoding format can be UTF-8). Through this type of encryption processing method for security identifiers, the communication data can be encrypted using the signature value when transmitting the communication data to obtain ciphertext communication data.

[0079] Similarly, after the security processing rules are configured to the security detection system of the present application, when the security detection system of the present application receives the ciphertext communication data of the application system A to be tested, it can use the same encryption and decryption algorithm and the same signature value to decrypt the ciphertext communication data, obtain the plaintext communication data, and adjust the plaintext communication data.

[0080] In addition, the process of encryption processing according to the security processing rules may be to encrypt the acquired communication data according to the preset AES256-CBC algorithm. For example, AES256-CBC (communication data, key[], iv[]), key = KDF (MasterKey, Salt). Among them, KDF (Key Derivation Function) is a cryptographic hash function that can be used to derive one or more keys from a secret value (such as a master key MasterKey, a password or a password phrase). The specific usage can refer to the prior art and will not be repeated here. Among them, MasterKey can be a fixed string of 256 bits or more generated by a secure random function, and it is used as the password of the KDF algorithm. It should be noted that Salt refers to a random data string in the field of encryption technology, which can be obtained by processing according to the SHA algorithm, such as SHA256 (md5 (password), salt), in which salt is also a random string, and can be required to be no less than 128 bits, iv = salt. Therefore, the password of the communication process can be encrypted through the SHA algorithm.

[0081] Similarly, after the security processing rules are configured to the security detection system of the present application, when the security detection system of the present application receives the ciphertext communication data of the application system A to be tested, the ciphertext communication data can be decrypted according to the same encryption and decryption algorithm to obtain plaintext communication data, and the plaintext communication data can be adjusted.

[0082] On the basis of the above-mentioned embodiment, the embodiment of the present application describes the steps of transmitting the adjusted ciphertext communication data to the corresponding server for security detection processing, obtaining the security detection result returned by the server, and the steps after transmitting the adjusted ciphertext communication data to the corresponding server and obtaining the security detection result returned by the server. Specifically, the method of this embodiment includes the following steps:

[0083] The adjusted ciphertext communication data is transmitted to the server, so that the server decrypts the received adjusted ciphertext communication data, and determines the security detection result based on the decryption result and sends it to the security detection system; determines whether the application system to be tested is safe according to the security detection result.

[0084] In conjunction with the above-mentioned embodiment, if you want to determine whether the communication process between the application system to be tested and the server is safe, you can first determine whether the server can successfully decrypt and / or respond to and apply the decrypted communication data after receiving the ciphertext communication data adjusted by the security detection system of this application, and obtain the security detection result. If the security detection result is characterized as yes, it means that during the communication process between the application system to be tested and the server, the server will respond and process the adjusted communication data as usual. Such a situation may bring great security risks to the application system to be tested and the server. Therefore, the security detection system will determine whether the application system to be tested is safe based on such security detection results.

[0085] On the contrary, if the server detects abnormal changes in the communication data after receiving the ciphertext communication data adjusted by the security detection system of the present application, fails to decrypt it successfully and / or fails to respond to and apply the decrypted communication data, then the security detection result indicates that during the communication process between the application system under test and the server, the server will not respond to or process the adjusted communication data, which means that to a certain extent, the communication process between the application system under test and the server is safe. Therefore, the security detection system will determine the safety of the application system under test based on such security detection results.

[0086] Based on the above embodiments, this embodiment Figure 2 The security detection system in the present application may include at least an interactive agent module, a data processing module, an algorithm adaptation module, a rule management module, etc.

[0087] Among them, the interactive proxy module is used to proxy and obtain communication data (such as network interactive data packets, etc.). The algorithm adaptation module is used to select the adapted security detection rules, such as encryption and decryption algorithms, message authentication, signatures, hash processing, etc., according to the system information of the application system to be tested and / or the data type of the data to be tested, and the data packet processing rules included in the security detection rules can also be obtained. The data processing module is used to adjust and process the decrypted data packets (plaintext communication data), etc. The rule management module is used to perform algorithm adaptation (some application systems to be tested correspond to adaptation detection rule 1, some application systems to be tested correspond to adaptation detection rule 2, and some application systems to be tested do not match detection rules, etc.), manage and define data packet processing rules. According to the test requirements, different vulnerability types to be detected are selected for different application systems to be tested (for Class A systems, unauthorized detection is used; for Class B systems, request content modification and replay test are used) to manage and define detection rules. And according to the test requirements, different application systems to be tested are managed and defined according to different rule objects, etc., which will not be repeated here.

[0088] In summary, compared with the existing single-scenario solution that is based on security mechanism data such as encryption algorithms and encryption keys obtained from the server, encrypts the communication data, and generates ciphertext communication data for security testing, the security detection method of the present application can not only select different security mechanism data to encrypt the communication data, but also choose to encrypt the entire text or partially encrypt the communication data. At the same time, it can also realize decryption of the ciphertext communication data messages, thereby improving the flexibility of the security detection process.

[0089] In addition, it can also support encryption logic processing between different systems, support compatibility and adaptation with third-party systems, and is not limited to the front end of a certain application system and the corresponding server. It can also make good use of the company's existing security scanning tools, integrate the security scanning tools into the business logic process based on this application solution, and realize automated security scanning based on encryption and decryption agents, solving the problem that the current manual penetration test cannot verify the security test of encryption and decryption and signature scenarios, and the current security scanning tools cannot perform effective security scanning on encryption and decryption and signature scenarios, making full use of existing security resources, improving the ability of security detection, and improving the efficiency of security detection.

[0090] The present application is a technical solution for security testing based on encryption and decryption agents. After decryption based on encryption and decryption, hashing and other algorithms, the communication data content is modified and re-encrypted according to the original or on-demand encryption and / or signature logic, and then encapsulated and sent to the corresponding server. It can achieve deep processing of data packets that are imperceptible and transparent to both the request and response sides, thereby realizing imperceptible and transparent security testing.

[0091] It should be further explained that the execution subject of the security detection method based on the encryption and decryption agent can be a security detection device based on the encryption and decryption agent. For example, the security detection method based on the encryption and decryption agent can be executed by a terminal device or a server or other processing device, wherein the terminal device can be a user equipment (User Equipment, UE), a computer, a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (Personal Digital Assistant, PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the security detection method based on the encryption and decryption agent can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0092] Figure 3 FIG. 1 is a block diagram of a security detection device based on an encryption and decryption agent, which is shown in an exemplary embodiment of the present application. Figure 3 As shown, the exemplary security detection device 300 based on encryption and decryption agent includes: a data decryption module 310, a data adjustment module 320, a data encryption module 330 and a data transmission module 340. Specifically:

[0093] The data decryption module 310 is used to, in response to receiving the ciphertext communication data sent by the application system to be tested, decrypt the ciphertext communication data to obtain the plaintext communication data.

[0094] The data adjustment module 320 is used to adjust the plaintext communication data according to the preset security detection rules to obtain the adjusted plaintext communication data.

[0095] The data encryption module 330 is used to encrypt the adjusted plaintext communication data to obtain adjusted ciphertext communication data.

[0096] The data transmission module 340 is used to transmit the adjusted ciphertext communication data to the corresponding server for security detection processing, and obtain the security detection result returned by the server.

[0097] In this exemplary security detection device based on encryption and decryption agent, in response to receiving the ciphertext communication data sent by the application system to be tested, the ciphertext communication data is decrypted to obtain the plaintext communication data; the plaintext communication data is adjusted according to the preset security detection rules to obtain the adjusted plaintext communication data, so that the ciphertext communication data originally to be sent to the server is changed; the adjusted plaintext communication data is encrypted to obtain the adjusted ciphertext communication data; the adjusted ciphertext communication data is transmitted to the corresponding server for security detection, and it is determined whether the server can still decrypt and apply the adjusted ciphertext communication data, etc., to obtain the security detection result returned by the server. In this way, the security detection process is optimized and the security reliability of the communication process is improved.

[0098] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment, and will not be repeated here. In practical applications, the device provided in the above embodiment can distribute the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0099] The functions of each module can be found in the embodiment of the security detection method based on encryption and decryption agent, which will not be described in detail here.

[0100] See also Figure 4 , Figure 4 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present application. The electronic device 100 includes a memory 101 and a processor 102, and the processor 102 is used to execute program instructions stored in the memory 101 to implement the steps in any of the above-mentioned security detection method embodiments based on encryption and decryption agents. In a specific implementation scenario, the electronic device 100 may include but is not limited to: a microcomputer, a server, and in addition, the electronic device 100 may also include a mobile device such as a laptop computer and a tablet computer, which is not limited here.

[0101] Specifically, the processor 102 is used to control itself and the memory 101 to implement the steps in any of the above-mentioned security detection method embodiments based on encryption and decryption agents. The processor 102 can also be called a CPU (Central Processing Unit). The processor 102 may be an integrated circuit chip with signal processing capabilities. The processor 102 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 102 can be implemented by an integrated circuit chip.

[0102] In this exemplary electronic device, in response to receiving the ciphertext communication data sent by the application system to be tested, the ciphertext communication data is decrypted to obtain the plaintext communication data; the plaintext communication data is adjusted according to the preset security detection rules to obtain the adjusted plaintext communication data, so that the ciphertext communication data originally to be sent to the server is changed; the adjusted plaintext communication data is encrypted to obtain the adjusted ciphertext communication data; the adjusted ciphertext communication data is transmitted to the corresponding server for security detection, and it is determined whether the server can still decrypt and apply the adjusted ciphertext communication data, etc., to obtain the security detection result returned by the server. In this way, the security detection process is optimized and the security reliability of the communication process is improved.

[0103] See also Figure 5 , Figure 5 The computer-readable storage medium 110 stores program instructions 111 that can be executed by a processor, and the program instructions 111 are used to implement the steps in any of the above-mentioned security detection method embodiments based on encryption and decryption agents.

[0104] In this exemplary storage medium, by running the program instructions in the storage medium, in response to receiving the ciphertext communication data sent by the application system to be tested, the ciphertext communication data is decrypted to obtain the plaintext communication data; the plaintext communication data is adjusted according to the preset security detection rules to obtain the adjusted plaintext communication data, so that the ciphertext communication data originally to be sent to the server is changed; the adjusted plaintext communication data is encrypted to obtain the adjusted ciphertext communication data; the adjusted ciphertext communication data is transmitted to the corresponding server for security detection, and it is determined whether the server can still decrypt and apply the adjusted ciphertext communication data, etc., to obtain the security detection result returned by the server. In this way, the security detection process is optimized and the security reliability of the communication process is improved.

[0105] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0106] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0107] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0108] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

Claims

1. A security detection method based on encryption and decryption agent, characterized in that: The method is applied to a safety detection system, and the method comprises: In response to receiving the ciphertext communication data sent by the application system to be tested, decrypting the ciphertext communication data to obtain plaintext communication data; Adjusting the plaintext communication data according to a preset security detection rule to obtain adjusted plaintext communication data; Encrypting the adjusted plaintext communication data to obtain adjusted ciphertext communication data; The adjusted ciphertext communication data is transmitted to the corresponding server for security detection processing, and a security detection result returned by the server is obtained.

2. The method according to claim 1, characterized in that The step of decrypting the ciphertext communication data to obtain plaintext communication data comprises: Obtaining security mechanism data corresponding to the application system to be tested; The ciphertext communication data is decrypted according to the security mechanism data to obtain the plaintext communication data.

3. The method according to claim 2, characterized in that Before the step of decrypting the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data, the method further includes: Matching the encrypted communication data with the security detection rule to obtain a matching result; The step of decrypting the ciphertext communication data according to the security mechanism data to obtain the plaintext communication data comprises: In response to the matching result indicating a successful match, the ciphertext communication data is decrypted using the security processing rules and / or security identifiers in the security mechanism data to obtain the plaintext communication data.

4. The method according to claim 3, characterized in that After the step of matching the ciphertext communication data with the security detection rule to obtain a matching result, the method further includes: In response to the matching result indicating a matching failure, determining a server corresponding to the application system to be tested, a communication connection being present between the server and the application system to be tested, and the server being used to receive the ciphertext communication data sent by the application system to be tested; The encrypted communication data is transparently transmitted to the server.

5. The method according to claim 1, characterized in that The step of adjusting the plaintext communication data according to the preset security detection rules to obtain the adjusted plaintext communication data includes: Determining, according to the security detection rule, content to be adjusted of one or more fields in the plaintext communication data; Performing data adjustment processing on the content to be adjusted to obtain the adjusted plaintext communication data, wherein the data adjustment processing includes at least one of data addition processing, data deletion processing or data modification processing.

6. The method according to claim 1, characterized in that Before the step of decrypting the ciphertext communication data to obtain the plaintext communication data in response to receiving the ciphertext communication data sent by the application system to be tested, the method further includes: Acquire the security mechanism data of the application system to be tested and perform local configuration processing; After the step of responding to receiving the encrypted communication data sent by the application system to be tested, the method further includes: Find the security mechanism data corresponding to the application system to be tested.

7. The method according to claim 1, characterized in that The security mechanism data includes security processing rules and / or security identifiers, and the step of encrypting the adjusted plaintext communication data according to the security mechanism data to obtain the adjusted ciphertext communication data includes: Encrypting the adjusted plaintext communication data according to the security processing rule to obtain the adjusted ciphertext communication data; Or, the adjusted plaintext communication data is encrypted according to the security identifier to obtain the adjusted ciphertext communication data.

8. The method according to claim 1, characterized in that The step of transmitting the adjusted ciphertext communication data to the corresponding server for security detection processing and obtaining the security detection result returned by the server includes: Transmitting the adjusted ciphertext communication data to the server, so that the server decrypts the received adjusted ciphertext communication data, and determines the security detection result based on the decryption result and sends it to the security detection system; After the step of transmitting the adjusted ciphertext communication data to the corresponding server and obtaining the security detection result returned by the server, the method further includes: Determine whether the application system to be tested is safe according to the safety detection result.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images