System security verification method and device and storage medium

Abstract

The invention discloses a system security verification method and device and a storage medium, and the system security verification method comprises the steps: obtaining a function realization code of a business function in a to-be-verified system, carrying out the security mechanism recognition of the function realization code, and taking the recognized security mechanism as a code security mechanism corresponding to the business function; and collecting service interaction data generated by realizing the service function, performing security mechanism identification on the service interaction data, and taking the identified security mechanism as a realization security mechanism corresponding to the service function, and detecting whether the code security mechanism and the implementation security mechanism meet a preset security mechanism rule or not to obtain a security verification result. The validity of the system security mechanism can be comprehensively evaluated and verified from two dimensions of a security mechanism for function realization code writing and a security mechanism supported in a business function realization process, and the problems of false report and missing report of security mechanism evaluation caused by incomplete preset rules or defect databases are avoided.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a system security verification method, device and storage medium. Background Art

[0002] At present, when developing software, hardware and other products or services, enterprises often formulate various security baselines to clarify the security requirements that the system should meet. The security baseline refers to a series of benchmarks formulated to meet the most basic protection requirements. It is the minimum security guarantee of the system, that is, the most basic security requirements that the system needs to meet. At present, there are at least the following problems in the formulation of security baselines:

[0003] Limited by the understanding of products and services by security baseline developers, as well as the security technical literacy and understanding of R&D personnel, there are differences in understanding of the security baseline among various parties, which affects the feasibility of implementing the security baseline, making it difficult to promote the security baseline and truly implement it in products and services. As a result, when products and services are delivered to users, there are already security defects or loopholes, which in turn affects the security of user data and systems. When R&D personnel implement security measures in accordance with the security baseline requirements, they are limited by their ability to understand the security baseline requirements, programming capabilities, and security awareness, and ultimately various different security implementation plans or measures emerge in the actual implementation process.

[0004] The essence of the above problems lies in the lack of an effective verification and evaluation mechanism to verify the security mechanisms of products and services, which leads to the parties' lack of recognition of the feasibility, effectiveness and rationality of the implementation of the security baseline, and the inability to effectively implement the closed-loop security baseline. Summary of the invention

[0005] In order to solve the above technical problems, the present application at least provides a system security verification method, device and storage medium.

[0006] The first aspect of the present application provides a system security verification method, which includes: obtaining the function implementation code of the business function in the system to be verified, identifying the security mechanism of the function implementation code, and using the identified security mechanism as the code security mechanism corresponding to the business function; and collecting business interaction data generated by implementing the business function, identifying the security mechanism of the business interaction data, and using the identified security mechanism as the implementation security mechanism corresponding to the business function; detecting whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and obtaining the security verification result of the system to be verified.

[0007] In one embodiment, a security mechanism is identified for a function implementation code, and the identified security mechanism is used as the code security mechanism corresponding to the business function, including: dividing the function implementation code into multiple code fragments; identifying the code function information corresponding to each code fragment; querying the security mechanism that matches the code function information, and using the matched security mechanism as the code security mechanism corresponding to the business function.

[0008] In one embodiment, the business interaction data includes request messages and response messages received or sent by the system to be verified; a security mechanism is identified on the business interaction data, and the identified security mechanism is used as the implementation security mechanism corresponding to the business function, including: extracting message parameters of the request message and / or message parameters of the response message; security mechanism is identified on the message parameters of the request message and / or the message parameters of the response message, and the identified security mechanism is used as the implementation security mechanism corresponding to the business function.

[0009] In one embodiment, extracting message parameters of a request message and / or message parameters of a response message includes: extracting one or more parameters from the data type of transmission data, data content of transmission data, adopted transmission protocol, encryption status of transmission data, message sender information, and message receiver information of the request message to obtain the message parameters of the request message; and / or extracting one or more parameters from the data type of transmission data, data content of transmission data, adopted transmission protocol, encryption status of transmission data, message sender information, and message receiver information of the response message to obtain the message parameters of the response message.

[0010] In one embodiment, detecting whether a code security mechanism and an implementation security mechanism satisfy preset security mechanism rules to obtain a security verification result of the system to be verified includes: obtaining all code security mechanisms to obtain a code security mechanism set, and obtaining all implementation security mechanisms to obtain an implementation security mechanism set; comparing the code security mechanism set and the implementation security mechanism set to obtain different code security mechanisms or implementation security mechanisms between the code security mechanism set and the implementation security mechanism set; based on different code security mechanisms or implementation security mechanisms, detecting whether the code security mechanism and the implementation security mechanism satisfy preset security mechanism rules to obtain a security verification result of the system to be verified.

[0011] In one embodiment, detecting whether a code security mechanism and an implementation security mechanism satisfy preset security mechanism rules to obtain a security verification result of the system to be verified includes: obtaining one or more basic security mechanisms corresponding to the preset security mechanism rules, obtaining all code security mechanisms to obtain a code security mechanism set, and obtaining all implementation security mechanisms to obtain an implementation security mechanism set; detecting the basic security mechanisms contained in the code security mechanism set and the implementation security mechanism set, and calculating the matching degree of the basic security mechanisms; based on the size of the matching degree of the basic security mechanisms, detecting whether the code security mechanism and the implementation security mechanism satisfy the preset security mechanism rules to obtain the security verification result of the system to be verified.

[0012] In one embodiment, the method also includes: updating the basic security mechanism corresponding to the existing preset security mechanism rules based on the code security mechanism and / or the implementation security mechanism; or, generating a new basic security mechanism based on the code security mechanism and / or the implementation security mechanism, and obtaining new preset security mechanism rules in combination with the new basic security mechanism.

[0013] In one embodiment, the basic security mechanism corresponding to the existing preset security mechanism rules is updated based on the code security mechanism and / or the implementation security mechanism, including: based on the functional parameters of the business function, business interaction data, code security mechanism, implementation security mechanism, implementation code security mechanism or the functional implementation code of the security mechanism, the basic security mechanism corresponding to the existing preset security mechanism rules is updated; based on the code security mechanism and / or the implementation security mechanism, a new basic security mechanism is generated, and new preset security mechanism rules are obtained in combination with the new basic security mechanism, including: based on the functional parameters of the business function, business interaction data, code security mechanism, implementation security mechanism, implementation code security mechanism or the functional implementation code of the security mechanism, a new basic security mechanism is generated; in combination with the new basic security mechanism, new preset security mechanism rules are obtained.

[0014] The second aspect of the present application provides a system security verification device, which includes: a function code identification module, which is used to obtain the function implementation code of the business function in the system to be verified, identify the security mechanism of the function implementation code, and use the identified security mechanism as the code security mechanism corresponding to the business function; and an interaction data identification module, which is used to collect business interaction data generated by implementing the business function, identify the security mechanism of the business interaction data, and use the identified security mechanism as the implementation security mechanism corresponding to the business function; a security verification module, which is used to detect whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and obtain the security verification result of the system to be verified.

[0015] A third aspect of the present application provides an electronic device, including a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the above-mentioned system security verification method.

[0016] A fourth aspect of the present application provides a computer-readable storage medium on which program instructions are stored, and when the program instructions are executed by a processor, the above-mentioned system security verification method is implemented.

[0017] The above scheme obtains the function implementation code of the business function in the system to be verified, identifies the security mechanism of the function implementation code, and uses the identified security mechanism as the code security mechanism corresponding to the business function; and collects the business interaction data generated by the implementation of the business function, identifies the security mechanism of the business interaction data, and uses the identified security mechanism as the implementation security mechanism corresponding to the business function; detects whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and obtains the security verification result of the system to be verified. It can comprehensively evaluate and verify the effectiveness of the system security mechanism from two dimensions: the security mechanism written in the function implementation code and the security mechanism supported in the process of implementing the business function, so as to avoid the problems of false positives and false negatives in the security mechanism evaluation caused by incomplete preset rules or defect database.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0020] Figure 1 It is a schematic diagram of an implementation environment of a solution provided by an embodiment of the present application;

[0021] Figure 2 is a flowchart of a system security verification method shown in an exemplary embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an identification code security mechanism shown in an exemplary embodiment of the present application;

[0023] Figure 4 is a schematic diagram of an identification implementation security mechanism shown in an exemplary embodiment of the present application;

[0024] Figure 5 is a block diagram of a system security verification device shown in an exemplary embodiment of the present application;

[0025] Figure 6 is a schematic structural diagram of an electronic device shown in an exemplary embodiment of the present application;

[0026] Figure 7It is a schematic diagram of the structure of a computer-readable storage medium shown in an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0027] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0028] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0029] The term "and / or" in this article is only an association information describing the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the previous and next associated objects are in an "or" relationship. In addition, "many" in this article means two or more than two. In addition, the term "at least one" in this article means any combination of at least two of any one or more of a plurality of, for example, including at least one of A, B, and C, can mean including any one or more elements selected from the set consisting of A, B, and C.

[0030] The following is a description of the system security verification method provided in the embodiments of the present application.

[0031] Please refer to Figure 1 , which shows a schematic diagram of a solution implementation environment provided by an embodiment of the present application. The solution implementation environment may include a verification execution end 110 and a verification-to-be-verified end 120, and the verification execution end 110 and the verification-to-be-verified end 120 are in communication connection with each other.

[0032] The verification execution end 110 and the verification-to-be-verified end 120 may be a terminal or a server.

[0033] The terminals include smart phones, tablet computers, laptops, desktop computers, smart speakers, smart watches, etc., but are not limited to these.

[0034] The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), as well as big data and artificial intelligence platforms.

[0035] In one example, the end to be verified 120 is a terminal, and the system to be verified is executed on the terminal. The verification execution end 110 is a server. The server can perform system security verification on the system to be verified executed on the terminal to obtain a security verification result. Of course, the server can store the security verification result locally, send it back to the terminal, or transmit it to other terminals.

[0036] See also Figure 2 , Figure 2 is a flowchart of a system security verification method shown in an exemplary embodiment of the present application. The system security verification method can be applied to Figure 1 It should be understood that the method can also be applied to other exemplary implementation environments and be specifically executed by devices in other implementation environments, and this embodiment does not limit the implementation environment to which the method is applicable.

[0037] like Figure 2 As shown, the system security verification method at least includes steps S210 to S230, which are described in detail as follows:

[0038] Step S210: Acquire the function implementation code of the business function in the system to be verified, identify the security mechanism of the function implementation code, and use the identified security mechanism as the code security mechanism corresponding to the business function.

[0039] Among them, the system to be verified includes but is not limited to applications, operating systems, etc., and the business functions are the functions that the system to be verified can provide, such as account registration and login functions, video viewing functions, video upload functions, etc.

[0040] The corresponding business function is implemented by the function implementation code, and the function implementation code of the business function that currently needs to be security verified is obtained.

[0041] For example, obtain the system code package corresponding to the system to be verified, which includes all code data for implementing the system to be verified, analyze each code file in the system code package, determine the business functions matched by each code file, and thus find the code files that match the business functions that currently need to be security verified, extract the code content contained in the code files, and obtain the function implementation code corresponding to the business functions that currently need to be security verified.

[0042] After obtaining the function implementation code, the function implementation code is parsed to identify the security mechanism that can be implemented by the function implementation code, and the identified security mechanism is used as the code security mechanism corresponding to the business function.

[0043] Among them, the code security mechanism is a specified security mechanism written in the function implementation code.

[0044] Exemplarily, the specific code content and / or code comment content of the function implementation code are analyzed to determine the security mechanism that the function implementation code can implement. The specific code content refers to the code data that will be compiled by the computer; the code comment content is the explanation and description of the specific code content, which will not be compiled by the computer.

[0045] In some embodiments, the function implementation code may be parsed based on preset rules. For example, regular matching rules are pre-set, and different regular matching rules correspond to different security mechanisms. If the specific code content and / or code comment content of the function implementation code satisfies the regular matching rules corresponding to a security mechanism, then it is considered that the function implementation code can implement the security mechanism.

[0046] In some embodiments, the function implementation code can also be parsed based on a pre-trained neural network model. The pre-trained neural network model has the function of identifying the security mechanism of the code. The specific code content and / or code comment content of the function implementation code is input into the pre-trained neural network model to obtain the security mechanism that can be implemented by the function implementation code output by the neural network model.

[0047] Step S220: collecting business interaction data generated by implementing business functions, identifying security mechanisms for the business interaction data, and using the identified security mechanisms as implementation security mechanisms corresponding to the business functions.

[0048] Among them, corresponding business data will be generated when the business functions are realized, such as network interaction behavior, data content sent or received, operation instructions generated or received, etc. These business data are all regarded as business interaction data.

[0049] After obtaining the business interaction data, the business interaction data is parsed to identify the security mechanism supported by the business function during the implementation process, and the identified security mechanism is used as the implementation security mechanism corresponding to the business function.

[0050] Among them, the implementation security mechanism is the security mechanism specifically implemented during the process of realizing business functions.

[0051] Exemplarily, the specific data content and / or interaction objects of business interaction data such as network interaction behavior, data content sent or received, and operating instructions generated or received are analyzed to determine the security mechanism supported by the business function during implementation.

[0052] In some implementations, business interaction data may be parsed based on preset rules. For example, regular matching rules are pre-set, and different regular matching rules correspond to different security mechanisms. If the business interaction data satisfies the regular matching rules corresponding to a security mechanism, it is considered that the business function supports the security mechanism during implementation.

[0053] In some implementations, the business interaction data may be parsed based on a pre-trained neural network model, which has the function of identifying the security mechanism of the business interaction data. The business interaction data is input into the pre-trained neural network model to obtain the security mechanism supported by the business function output by the neural network model during implementation.

[0054] Step S230: Check whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and obtain the security verification result of the system to be verified.

[0055] Exemplarily, the preset security mechanism rules may be: comparing the same security mechanisms and different security mechanisms between the code security mechanism and the implementation security mechanism, detecting whether the mechanism categories, mechanism security levels, mechanism quantities, etc. of the same security mechanisms and the different security mechanisms meet the preset conditions, so as to generate a security verification result for the system to be verified.

[0056] Exemplarily, the preset security mechanism rule may also be: detecting whether the code security mechanism and the mechanism category, mechanism security level, mechanism quantity, etc. of the implementation security mechanism meet preset conditions to generate a security verification result of the system to be verified.

[0057] The preset security mechanism rules can be flexibly set according to actual conditions, and this application does not limit this.

[0058] Optionally, after obtaining the security verification result of the system to be verified, it is displayed on the verification execution end to show the implementation status of the security mechanism of the system to be verified.

[0059] Next, some embodiments of the present application are described in detail.

[0060] In some embodiments, in step S210, a security mechanism is identified for the function implementation code, and the identified security mechanism is used as the code security mechanism corresponding to the business function, including: dividing the function implementation code into multiple code fragments; identifying the code function information corresponding to each code fragment; querying the security mechanism that matches the code function information, and using the matched security mechanism as the code security mechanism corresponding to the business function.

[0061] Exemplarily, based on the specific code content and / or code comment content of the code snippet, the code function information corresponding to the code snippet is identified, and then the security mechanism matching the code function information is queried, and the matched security mechanism is used as the code security mechanism corresponding to the business function.

[0062] For example, if the code function information corresponding to the code snippet is identified to indicate that the code snippet is used to verify an account and a password, then the matching security mechanism is found to be a login authentication mechanism.

[0063] For an example, see Figure 3 , Figure 3 A schematic diagram of an identification code security mechanism is shown as an exemplary embodiment of the present application. Figure 3 As shown, taking the account registration and login function as an example, based on the execution logic of the function implementation code corresponding to the account registration and login function, the function implementation code is divided into multiple code fragments. It should be noted that: Figure 3 In the code shown, the text after “ / / ” is the code comment content; the text content not starting with “ / / ” is the specific code content. Figure 3 The specific code content is expressed in the form of functional description. In actual applications, it corresponds to a specific code snippet. After obtaining multiple code snippets, the specific code content and / or code comment content of each code snippet is analyzed to identify the code function information corresponding to each code snippet, and then the security mechanism matching the code function information is queried, and the matched security mechanism is used as the code security mechanism corresponding to the business function.

[0064] A business function can correspond to one or more code security mechanisms.

[0065] In addition, the business interaction data generated by the implementation of business functions is collected, the security mechanism of the business interaction data is identified, and the identified security mechanism is used as the implementation security mechanism corresponding to the business function.

[0066] In some embodiments, the business interaction data includes request messages and response messages received or sent by the system to be verified; in step S220, a security mechanism is identified for the business interaction data, and the identified security mechanism is used as the implementation security mechanism corresponding to the business function, including: extracting message parameters of the request message and / or message parameters of the response message; performing security mechanism identification on the message parameters of the request message and / or the message parameters of the response message, and using the identified security mechanism as the implementation security mechanism corresponding to the business function.

[0067] Exemplarily, one or more parameters including the data type of the transmission data, the data content of the transmission data, the adopted transmission protocol, the encryption status of the transmission data, the message sender information, and the message receiver information of the request message are extracted to obtain the message parameters of the request message; and / or one or more parameters including the data type of the transmission data, the data content of the transmission data, the adopted transmission protocol, the encryption status of the transmission data, the message sender information, and the message receiver information of the response message are extracted to obtain the message parameters of the response message.

[0068] The security mechanism is identified for the collected message parameters, and the identified security mechanism is used as the implementation security mechanism corresponding to the business function.

[0069] For an example, see Figure 4 , Figure 4 This is a schematic diagram of an exemplary embodiment of the present application showing an identification implementation security mechanism, such as Figure 4 As shown, taking the account registration and login function as an example, the request messages and response messages received or sent during the implementation of the account registration and login function are collected, and the data type of the transmission data of the request message, the data content of the transmission data, the adopted transmission protocol, the encryption of the transmission data, the message sender information, and the message receiver information, as well as the data type of the transmission data of the response message, the data content of the transmission data, the adopted transmission protocol, the encryption of the transmission data, the message sender information, and the message receiver information are analyzed. According to the analysis results, the security mechanism supported by the account registration and login function in the implementation process is obtained and used as the implementation security mechanism. For example, the corresponding implementation security mechanisms in the implementation process of the account registration and login function include: anti-machine registration and login, anti-login blasting, anti-replay of the authentication process, and encryption of the authentication process.

[0070] Of course, business interaction data may also include other data, such as database operation data (such as data addition, deletion, modification and query), process logs in the process of implementing business functions, and other data, which is not limited in this application.

[0071] Then, the code security mechanism and the implementation security mechanism are detected to see whether they meet the preset security mechanism rules, and the security verification result of the system to be verified is obtained.

[0072] In some embodiments, in step S230, detecting whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules to obtain the security verification result of the system to be verified includes: obtaining all code security mechanisms to obtain a code security mechanism set, and obtaining all implementation security mechanisms to obtain an implementation security mechanism set; comparing the code security mechanism set and the implementation security mechanism set to obtain different code security mechanisms or implementation security mechanisms between the code security mechanism set and the implementation security mechanism set; based on different code security mechanisms or implementation security mechanisms, detecting whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules to obtain the security verification result of the system to be verified.

[0073] According to the different code security mechanisms or implementation security mechanisms between the code security mechanism set and the implementation security mechanism set, it is determined whether the security mechanisms supported by the business functions of the system to be verified during actual implementation are consistent with the code development intention, so as to obtain the corresponding security verification results.

[0074] For example, the code security mechanisms included in the code security mechanism set include: anti-machine registration and login, anti-login blasting. The implementation security mechanisms included in the implementation security mechanism set include: anti-machine registration and login, anti-login blasting, authentication process anti-replay, and authentication process encryption. Comparing the code security mechanism set and the implementation security mechanism set, the consistent security mechanisms include: anti-machine registration and login, and anti-login blasting; the implementation security mechanism set exceeds the code security mechanism set in: authentication process anti-replay and authentication process encryption.

[0075] According to the comparison between the above code security mechanism set and the implementation security mechanism set, determine whether the security mechanism supported by the business function in actual implementation is consistent with the code development intention, so as to generate the corresponding security verification result. For example, if the security mechanisms contained in the code security mechanism set and the implementation security mechanism set are the same, then the security test result is the security mechanism supported by the business function in actual implementation is consistent with the code development intention. Figure 1 If any code security mechanism is different from the implementation security mechanism in the implementation security mechanism set, the security test result is that there is a security mechanism implementation failure or detection failure; if any implementation security mechanism is different from the code security mechanism in the code security mechanism set, the security test result is that a security mechanism other than the code development intention is implemented.

[0076] In some embodiments, in step S230, detecting whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules to obtain the security verification result of the system to be verified includes: obtaining one or more basic security mechanisms corresponding to the preset security mechanism rules, obtaining all code security mechanisms to obtain a code security mechanism set, and obtaining all implementation security mechanisms to obtain an implementation security mechanism set; detecting the basic security mechanisms contained in the code security mechanism set and the implementation security mechanism set, and calculating the matching degree of the basic security mechanism; based on the size of the matching degree of the basic security mechanism, detecting whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules to obtain the security verification result of the system to be verified.

[0077] For example, based on the number of basic security mechanisms contained in the code security mechanism set and the implementation security mechanism set, the importance level of the mechanism, etc., the basic security mechanism matching degree is calculated.

[0078] Specifically, the more basic security mechanisms are contained in the code security mechanism set and the implementation security mechanism set, and the higher the importance level of the mechanism, the higher the matching degree of the basic security mechanism.

[0079] For example, the code security mechanisms included in the code security mechanism set include: anti-machine registration and login, anti-login blasting. The implementation security mechanisms included in the implementation security mechanism set include: anti-machine registration and login, anti-login blasting, authentication process anti-replay, and authentication process encryption. The basic security mechanisms corresponding to the preset security mechanism rules include: authentication anti-replay, login anti-blasting, and authentication process encryption.

[0080] The union of the code security mechanism set and the implementation security mechanism set can be taken as: anti-machine registration and login, anti-login blasting, authentication process replay prevention, authentication process encryption, and the number of basic security mechanisms contained in the detection and set. The larger the number of basic security mechanisms contained, the higher the basic security mechanism matching degree. If all basic security mechanisms are contained, it is judged that the basic security mechanism matching degree is 1.

[0081] The intersection of the code security mechanism set and the implementation security mechanism set can also be taken as: anti-machine registration and login, anti-login blasting, and the number of basic security mechanisms contained in the intersection is detected. The larger the number of basic security mechanisms contained, the higher the matching degree of the basic security mechanisms.

[0082] It should be noted that the union or intersection can be flexibly selected to calculate the basic security mechanism matching degree according to actual conditions, and this application does not limit this.

[0083] Then, according to the matching degree of the basic security mechanism, the code security mechanism and the implementation security mechanism are checked to see whether they meet the preset security mechanism rules, and the security verification result of the system to be verified is obtained. For example, the preset security mechanism rule is that the matching degree of the basic security mechanism is 1, that is, if the matching degree of the basic security mechanism is detected to be 1, then it is judged that the system to be verified meets the security baseline; if the matching degree of the basic security mechanism is detected to be less than 1, then it is judged that the system to be verified does not meet the security baseline.

[0084] The basic security mechanism corresponding to the preset security mechanism rules in this application is used to specify the most basic security requirements that the system to be verified needs to meet, that is, the basic security mechanism corresponding to the preset security mechanism rules serves as the security baseline of the system to be verified.

[0085] In some implementations, a security capability implementation map corresponding to the business function can also be generated based on the code security mechanism, the implementation security mechanism, the difference between the code security mechanism and the implementation security mechanism, business interaction data, etc., so as to compare the basic security mechanism corresponding to the security capability implementation map and the preset security mechanism rules, and display the comparison results to facilitate checking whether the security mechanism implemented by the system to be verified meets the security baseline requirements.

[0086] Combining the code security mechanism and the implementation security mechanism to detect whether the system to be verified meets the security baseline, the implementation of the security baseline has a reference to the code-level implementation plan and the specific implementation of the security mechanism, which is conducive to the execution and implementation of the security baseline and the establishment of standardized processes and capabilities for the execution of the security baseline.

[0087] Optionally, in response to an import or write instruction of a preset security mechanism rule, an imported or written preset security mechanism rule is obtained, and the preset security mechanism rule corresponds to a security mechanism that the system to be verified basically needs to meet, and is used as a basic security mechanism.

[0088] Optionally, the basic security mechanism corresponding to the existing preset security mechanism rules is updated based on the code security mechanism and / or the implementation security mechanism; or, a new basic security mechanism is generated based on the code security mechanism and / or the implementation security mechanism, and new preset security mechanism rules are obtained in combination with the new basic security mechanism.

[0089] Exemplarily, based on the functional parameters of the business function, business interaction data, code security mechanism, implementation security mechanism, implementation code security mechanism or the functional implementation code of the security mechanism, the basic security mechanism corresponding to the existing preset security mechanism rules is updated; and based on the functional parameters of the business function, business interaction data, code security mechanism, implementation security mechanism, implementation code security mechanism or the functional implementation code of the security mechanism, a new basic security mechanism is generated; and new preset security mechanism rules are obtained in combination with the new basic security mechanism.

[0090] For example, please refer to the following Table 1, which shows an example of a preset security mechanism rule generated according to the function parameters of the business function, business interaction data, code security mechanism, implementation security mechanism, implementation code security mechanism or function implementation code of the implementation security mechanism, etc.:

[0091]

[0092] Table 1

[0093] In Table 1, "section" refers to the category of security mechanism, such as anti-machine registration and login, anti-login blasting, anti-replay of authentication process, encryption of authentication process, etc., all of which belong to the account authentication security section; "security mechanism" refers to the basic security mechanism to be generated or updated, such as anti-machine registration and login, anti-login blasting, anti-replay of authentication process, encryption of authentication process, etc.; "security mechanism requirement standard" is used to describe the requirements that the security mechanism needs to meet; importance level is used to describe the importance of the security mechanism; "involved business functions" refers to the business functions corresponding to the security mechanism, such as anti-machine registration and login corresponds to account registration and login functions; "involved business interaction behaviors" include implementation The “sample code” includes the code content associated with the security mechanism; the “security mechanism implemented by the sample code” includes all security mechanisms implemented by the code content; the “request message example” and “response message example” correspond to the request message and response message generated by the security mechanism respectively; the “security mechanism implementation style” can be a screenshot or video corresponding to the implementation of the security mechanism; the “security mechanism implementation result example” can be a text description of the steps for implementing the security mechanism, such as the text description corresponding to the anti-replay of the authentication process: signing the request header and request content based on time, account, password, and salt value (Nonce) parameters.

[0094] By updating the basic security mechanism corresponding to the existing preset security mechanism rules or generating new preset security mechanism rules according to the code security mechanism and / or implementation security mechanism, the security mechanisms and security solutions implemented by the system with good security practices can be summarized and output to obtain a security baseline (i.e., preset security mechanism rules). Since the security baseline requirements are derived from implementation practice, the security baseline is more feasible and has reference significance.

[0095] The system security verification method provided by the present application obtains the function implementation code of the business function in the system to be verified, identifies the security mechanism of the function implementation code, and uses the identified security mechanism as the code security mechanism corresponding to the business function; and collects the business interaction data generated by the implementation of the business function, identifies the security mechanism of the business interaction data, and uses the identified security mechanism as the implementation security mechanism corresponding to the business function; detects whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and obtains the security verification result of the system to be verified. It can comprehensively evaluate and verify the effectiveness of the system security mechanism from two dimensions: the security mechanism written in the function implementation code and the security mechanism supported in the process of implementing the business function, so as to avoid the problems of false positives and false negatives in the security mechanism evaluation caused by incomplete preset rules or defect databases.

[0096] Figure 5 FIG. 1 is a block diagram of a system security verification device shown in an exemplary embodiment of the present application. Figure 5As shown, the exemplary system security verification device 500 includes: a function code identification module 510, an interaction data identification module 520 and a security verification module 530. Specifically:

[0097] The function code identification module 510 is used to obtain the function implementation code of the business function in the system to be verified, identify the security mechanism of the function implementation code, and use the identified security mechanism as the code security mechanism corresponding to the business function;

[0098] The interaction data identification module 520 is used to collect the business interaction data generated by implementing the business function, identify the security mechanism of the business interaction data, and use the identified security mechanism as the implementation security mechanism corresponding to the business function;

[0099] The security verification module 530 is used to detect whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and obtain the security verification result of the system to be verified.

[0100] It should be noted that the system security verification device provided in the above embodiment and the system security verification method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment and will not be repeated here. In practical applications, the system security verification device provided in the above embodiment can distribute the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0101] See also Figure 6 , Figure 6 6 is a schematic diagram of the structure of an embodiment of an electronic device of the present application. The electronic device 600 includes a memory 601 and a processor 602, and the processor 602 is used to execute program instructions stored in the memory 601 to implement the steps in any of the above-mentioned system security verification method embodiments. In a specific implementation scenario, the electronic device 600 may include but is not limited to: a microcomputer, a server, and in addition, the electronic device 600 may also include a mobile device such as a laptop computer and a tablet computer, which is not limited here.

[0102] Specifically, the processor 602 is used to control itself and the memory 601 to implement the steps in any of the above-mentioned system security verification method embodiments. The processor 602 can also be called a central processing unit (CPU). The processor 602 may be an integrated circuit chip with signal processing capabilities. The processor 602 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 602 can be implemented by an integrated circuit chip.

[0103] See also Figure 7 , Figure 7 The computer-readable storage medium 700 stores program instructions 710 that can be executed by a processor, and the program instructions 710 are used to implement the steps in any of the above system security verification method embodiments.

[0104] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0105] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0106] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0107] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program code.

Claims

1. A system security verification method, characterized in that: include: Obtaining the function implementation code of the business function in the system to be verified, identifying the security mechanism of the function implementation code, and using the identified security mechanism as the code security mechanism corresponding to the business function; as well as, Collecting business interaction data generated by implementing the business function, identifying a security mechanism for the business interaction data, and using the identified security mechanism as the implementation security mechanism corresponding to the business function; Detect whether the code security mechanism and the implementation security mechanism meet preset security mechanism rules, and obtain the security verification result of the system to be verified.

2. The method according to claim 1, characterized in that: The step of identifying the security mechanism of the function implementation code and using the identified security mechanism as the code security mechanism corresponding to the business function includes: Divide the function implementation code into multiple code fragments; Identify the code function information corresponding to each code snippet; A security mechanism matching the code function information is queried, and the matched security mechanism is used as the code security mechanism corresponding to the business function.

3. The method according to claim 1, characterized in that The business interaction data includes request messages and response messages received or sent by the system to be verified; the security mechanism identification of the business interaction data and using the identified security mechanism as the implementation security mechanism corresponding to the business function include: Extracting message parameters of the request message and / or message parameters of the response message; A security mechanism is identified for the message parameters of the request message and / or the message parameters of the response message, and the identified security mechanism is used as the implementation security mechanism corresponding to the business function.

4. The method according to claim 3, characterized in that The extracting the message parameters of the request message and / or the message parameters of the response message includes: Extract one or more parameters of the data type of the transmission data of the request message, the data content of the transmission data, the adopted transmission protocol, the encryption status of the transmission data, the message sending end information, and the message receiving end information to obtain the message parameters of the request message; And / or extract one or more parameters of the data type of the transmission data, the data content of the transmission data, the adopted transmission protocol, the encryption status of the transmission data, the message sending end information, and the message receiving end information of the response message to obtain the message parameters of the response message.

5. The method according to claim 1, characterized in that The detecting whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules to obtain the security verification result of the system to be verified includes: Obtain all code security mechanisms to obtain a code security mechanism set, and obtain all implementation security mechanisms to obtain an implementation security mechanism set; Comparing the code security mechanism set with the implementation security mechanism set to obtain different code security mechanisms or implementation security mechanisms between the code security mechanism set and the implementation security mechanism set; Based on the different code security mechanisms or implementation security mechanisms, it is detected whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and the security verification result of the system to be verified is obtained.

6. The method according to claim 1, characterized in that The detecting whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules to obtain the security verification result of the system to be verified includes: Acquire one or more basic security mechanisms corresponding to the preset security mechanism rules, acquire all code security mechanisms to obtain a code security mechanism set, and acquire all implementation security mechanisms to obtain an implementation security mechanism set; Detecting the basic security mechanisms contained in the code security mechanism set and the implementation security mechanism set, and calculating the matching degree of the basic security mechanisms; Based on the matching degree of the basic security mechanism, it is detected whether the code security mechanism and the implementation security mechanism meet the preset security mechanism rules, and the security verification result of the system to be verified is obtained.

7. The method according to claim 6, characterized in that The method further comprises: Updating the basic security mechanism corresponding to the existing preset security mechanism rules based on the code security mechanism and / or the implementation security mechanism; or, A new basic security mechanism is generated based on the code security mechanism and / or the implementation security mechanism, and a new preset security mechanism rule is obtained in combination with the new basic security mechanism.

8. The method according to claim 7, characterized in that The updating of the basic security mechanism corresponding to the existing preset security mechanism rules based on the code security mechanism and / or the implementation security mechanism includes: Based on the function parameters of the business function, the business interaction data, the code security mechanism, the implementation security mechanism, the implementation code of the code security mechanism or the implementation security mechanism, the basic security mechanism corresponding to the existing preset security mechanism rule is updated; The generating a new basic security mechanism based on the code security mechanism and / or the implementation security mechanism, and obtaining a new preset security mechanism rule in combination with the new basic security mechanism, includes: Generate a new basic security mechanism based on the function parameters of the business function, the business interaction data, the code security mechanism, the implementation security mechanism, the function implementation code that implements the code security mechanism or the implementation security mechanism; New preset security mechanism rules are obtained in combination with the new basic security mechanism.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the processor is configured to execute program instructions stored in the memory to implement the steps in the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program instructions, and the program instructions can be executed by a processor to implement the steps in the method according to any one of claims 1 to 8.

Images