A method and apparatus for verifying a cryptographic module

Abstract

The application provides a cryptographic module verification method and device, and relates to the technical field of testing, and can be applied to the financial field or other technical fields.The method comprises the following steps: determining a plurality of threads corresponding to each type of cryptographic algorithm in a cryptographic module respectively, and determining a network communication parameter configuration item corresponding to each thread according to to-be-verified network communication configuration information; sending a data acquisition request to a server through each thread respectively; if a first data acquisition response message returned by the server according to the data acquisition request is received through all the threads, it is determined that the functional verification of the cryptographic module is completed.The device executes the above method.The cryptographic module verification method and device provided in the application embodiment can improve the verification work efficiency of the cryptographic module.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of testing, in particular to a cryptographic module verification method and device. BACKGROUND

[0002] The cryptographic module is abstracted from a specific cryptographic product through a formal language. The security of the cryptographic product is determined by evaluating the basic items, functional items, security protection items and management items of the cryptographic module and outputting the evaluation results corresponding to each evaluation method.

[0003] Although the prior art ensures the security of the cryptographic module, it cannot ensure whether the cryptographic module can be finally used in production and whether it is compatible with the host application. In addition, in order to ensure that the cryptographic module is compatible with the host application, a large amount of testing and verification work is required. These testing and verification works are independent of each other, and it takes a lot of time and effort to test and verify one by one, which makes the verification work inefficient. SUMMARY

[0004] In view of the problems in the prior art, the embodiments of the present application provide a cryptographic module verification method and device, which can at least partially solve the problems in the prior art.

[0005] In one aspect, the present application provides a cryptographic module verification method, comprising:

[0006] determining a plurality of threads corresponding to each type of cryptographic algorithm in the cryptographic module, and determining a network communication parameter configuration item corresponding to each thread according to the to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information;

[0007] sending a data acquisition request to the server through each thread; the data acquisition request carries an identification of each type of cryptographic algorithm and a network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm;

[0008] if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the cryptographic module is completed; the first data acquisition response message carries a network communication parameter configuration item that determines the configuration to take effect.

[0009] The network communication parameter configuration item corresponding to each thread is determined according to the to-be-verified network communication configuration information, comprising:

[0010] determining a Header header configuration parameter, a Cookies configuration parameter and a cache configuration parameter corresponding to each thread according to the to-be-verified network communication configuration information.

[0011] The verification method of the password module further comprises:

[0012] If it is determined that at least one first target thread receives a second data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is not completed; the second data acquisition response message carries a network communication parameter configuration item which is determined to be invalid.

[0013] The verification method of the password module further comprises:

[0014] The second data acquisition response message is parsed to obtain the network communication parameter configuration item which is invalid, and the target network communication configuration information corresponding to the network communication parameter configuration item which is invalid is individually subjected to functional verification.

[0015] The verification method of the password module further comprises:

[0016] If it is determined that at least one second target thread cannot receive a data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is not completed.

[0017] The verification method of the password module further comprises:

[0018] The target data acquisition request corresponding to the unreceivable data acquisition response message is parsed to obtain a target password algorithm, and the target password algorithm is individually subjected to functional verification.

[0019] The verification method of the password module further comprises:

[0020] The timeout function of network communication is verified.

[0021] In one aspect, the application provides a verification device of a password module, comprising:

[0022] A determination unit is configured to determine a plurality of threads corresponding to each type of password algorithm in the password module, and determine a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified;

[0023] A sending unit is configured to send a data acquisition request to the server through each thread; the data acquisition request carries the identification of each type of password algorithm and the network communication parameter configuration item; the server is previously provided with a service access link corresponding to each type of password algorithm;

[0024] The verification unit is configured to determine that the functional verification of the password module is completed if all threads receive a first data acquisition response message returned by the server according to the data acquisition request, and the first data acquisition response message carries a network communication parameter configuration item that determines that the configuration is effective.

[0025] In yet another aspect, an electronic device is provided, comprising a processor, a memory and a bus, wherein,

[0026] The processor and the memory complete mutual communication through the bus;

[0027] The memory stores program instructions executable by the processor, and the processor invoking the program instructions can execute the following method:

[0028] Determine a plurality of threads corresponding to each type of cryptographic algorithm in the password module, and determine a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified;

[0029] Send a data acquisition request to the server through each thread; the data acquisition request carries a cryptographic algorithm identifier and a network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm;

[0030] If all threads receive a first data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is completed; the first data acquisition response message carries a network communication parameter configuration item that determines that the configuration is effective.

[0031] An embodiment of the present application provides a non-transitory computer readable storage medium, comprising:

[0032] The non-transitory computer readable storage medium stores computer instructions, and the computer instructions make the computer execute the following method:

[0033] Determine a plurality of threads corresponding to each type of cryptographic algorithm in the password module, and determine a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified;

[0034] The data acquisition request carries the identification of each type of password algorithm and the network communication parameter configuration item.

[0035] If the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the password module is completed, and the first data acquisition response message carries the network communication parameter configuration item that determines the configuration to take effect.

[0036] The verification method and device of the password module provided by the embodiment of the application determine a plurality of threads corresponding to each type of password algorithm in the password module, and determine a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified. Each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified. A data acquisition request is sent to the server through each thread, the data acquisition request carries the identification of each type of password algorithm and the network communication parameter configuration item, the server is pre-configured with a service access link corresponding to each type of password algorithm, and if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the password module is completed, and the first data acquisition response message carries the network communication parameter configuration item that determines the configuration to take effect, which can improve the verification efficiency of the password module. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor. In the drawings:

[0038] Figure 1 It is a flowchart of the verification method of the password module provided by an embodiment of the application.

[0039] Figure 2 It is a structural schematic diagram of the verification device of the password module provided by an embodiment of the application.

[0040] Figure 3 It is an electronic device entity structure schematic diagram provided by an embodiment of the application. DETAILED DESCRIPTION

[0041] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, further detailed descriptions of the embodiments of the present application will be given below with reference to the drawings. Here, the illustrative embodiments of the present application and their descriptions are used to explain the present application but not as limitations of the present application. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other in any manner without conflicts.

[0042] Figure 1 is a flowchart of a verification method of a password module provided by an embodiment of the present application, as shown in Figure 1 The verification method of the password module provided by the embodiment of the present application comprises the following steps.

[0043] Step S1: determining a plurality of threads corresponding to each type of password algorithm in the password module, and determining a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified.

[0044] Step S2: sending a data acquisition request through each thread to a server; the data acquisition request carries an identification of each type of password algorithm and a network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of password algorithm.

[0045] Step S3: if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the password module is completed; the first data acquisition response message carries a network communication parameter configuration item determined to take effect.

[0046] In the above step S1, the device determines a plurality of threads corresponding to each type of password algorithm in the password module, and determines a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified. The device can be a computer device or the like executing the method, and specifically can include a client. It should be noted that the information collected by the embodiments of the present application is information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards of relevant countries and regions, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to select authorization or refusal.

[0047] The user is provided with a corresponding operation portal for the user to select to agree or refuse the automatic decision result; if the user chooses to refuse, the expert decision process is entered.

[0048] Two types of cryptographic algorithms, such as Elliptic Curve Cryptography (ECC) algorithm and ECDHE encryption algorithm, belong to a variant of Elliptic Curve Diffie-Hellman (ECDH) key exchange, which utilizes the characteristics of Elliptic Curve Cryptography (ECC) to determine two threads, thread C1 corresponding to the ECC algorithm and thread C2 corresponding to the ECDHE algorithm.

[0049] The to-be-verified network communication configuration information includes Header header configuration information, Cookies configuration information, and cache configuration information.

[0050] The Header header configuration information refers to adding one or more parameter configurations in the Header header parameters during network communication function verification, such as setting User-Agent user agent UA, ContentType, etc. After the parameters are set, the data acquisition request is sent, and the tool is used to determine whether the Header header parameters of the current data acquisition request contain the corresponding configuration.

[0051] The Cookies configuration information refers to adding a Cookies during network communication function verification, and then sending a data acquisition request to determine whether the added cookies information is included in the current data acquisition request using a tool to capture packets.

[0052] The cache configuration information refers to setting different cache types during network communication function verification, such as setting not to use cache, and using a tool to capture packets to determine whether the data acquisition request is sent every time the data acquisition function is executed. If the cache is set to be used, a tool is used to capture packets to determine whether the data acquisition request is not sent again after the first request and subsequent several times of executing the data acquisition function.

[0053] Taking the Header header configuration information as an example, the random configuration parameters corresponding to this type of to-be-verified network communication configuration information are the random configuration parameters a1 corresponding to UA and the random configuration parameters a2 corresponding to ContentType.

[0054] Taking thread C1 as an example, each network communication parameter configuration item corresponding to it is the random configuration parameters b1 of a1, a2, and cookies, and the random configuration parameter c1 indicating not to use cache.

[0055] Similarly, taking thread C2 as an example, each network communication parameter configuration item corresponding to it can be different from the above a1, a2, b1, and c1. It should be noted that since the configuration parameters are randomly generated, there is also a possibility that they are the same as the above a1, a2, b1, and c1.

[0056] In step S2, the device sends a data acquisition request to the server through each thread respectively; the data acquisition request carries an identification of each type of cryptographic algorithm and a network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm. By sending a data acquisition request to the server through each thread respectively, parallel verification of a number of cryptographic modules equal to the number of types of cryptographic algorithms can be achieved. The identification of each type of cryptographic algorithm can be specifically the name of the cryptographic algorithm, for example, the above-mentioned ECC algorithm and ECDHE algorithm.

[0057] Since the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm, only a data acquisition request carrying the same type of cryptographic algorithm as the cryptographic algorithm is allowed to access the service access link, and then there will be a corresponding data acquisition response message.

[0058] In step S3, if the device receives the first data acquisition response message returned by the server according to the data acquisition request through all threads, it is determined that the functional verification of the cryptographic module is completed; the first data acquisition response message carries a network communication parameter configuration item that determines that the configuration is effective. The server receives the network communication parameter configuration item carried by the data acquisition request, and can configure the parameters according to the network communication parameter configuration item. If the configuration is successful, it is considered that the configuration is effective, and if the configuration is not successful, it is considered that the configuration is not effective. The reason for the configuration not being effective can to some extent reflect the poor compatibility of the functional verification of the cryptographic module.

[0059] If all threads receive the first data acquisition response message returned by the server according to the data acquisition request, it means that the algorithm functional verification and network communication parameter functional verification of the cryptographic module are passed.

[0060] The verification method of the cryptographic module further comprises:

[0061] If it is determined that at least one first target thread receives the second data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the cryptographic module is not completed; the second data acquisition response message carries a network communication parameter configuration item that determines that the configuration is not effective.

[0062] The verification method of the cryptographic module further comprises:

[0063] The second data acquisition response message is parsed to obtain a network communication parameter configuration item that is not effective, and the target network communication configuration information corresponding to the network communication parameter configuration item that is not effective is separately subjected to functional verification. Referring to the above description, if the network communication parameter configuration item that is not effective carried in the second data acquisition response message received by C1 is c1, it indicates that the setting of not using the cache is not effective, and c1 is parsed to separately perform functional verification on the setting of not using the cache. If the separate functional verification is passed, it is determined that it is a compatibility problem, and subsequent improvement can be started from the aspect of solving the compatibility problem.

[0064] If the separate functional verification is not passed, it is determined that it is a functional verification problem, and subsequent improvement can be started from the aspect of not using the cache configuration.

[0065] The verification method of the password module further includes:

[0066] If it is determined that there is at least one second target thread that cannot receive the data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is not completed.

[0067] The verification method of the password module further includes:

[0068] The target data acquisition request corresponding to the unreceivable data acquisition response message is parsed to obtain a target password algorithm, and the target password algorithm is separately subjected to functional verification. Referring to the above description, if C2 cannot receive the data acquisition response message, it means that the ECDHE algorithm is not effective, that is, the functional verification of the password algorithm of the password module is not passed.

[0069] The data acquisition request corresponding to C2 is parsed to obtain the ECDHE algorithm, and the target password algorithm is separately subjected to functional verification.

[0070] The specific description is as follows:

[0071] Taking the ECDHE algorithm as an example, first, set the server to support only the ECDHE algorithm for interaction with the server, and then use the "network request picture resource" function of the client to verify whether the picture resource issued by the server can be successfully acquired, and at the same time, use a tool to capture packets to determine whether the current request uses the ECDHE algorithm. Other algorithms are verified in the same way.

[0072] The verification method of the password module further includes:

[0073] The timeout function of network communication is verified. The description is as follows:

[0074] In the client application, set the timeout time of the current request function to 1s and 5s respectively, and set the request url of the picture resource to an error url, verify whether the function reports a timeout error after 1s and 5s respectively, if there is an error, it can be verified that the configuration takes effect.

[0075] After the functional verification is completed, software compatibility verification, hardware compatibility verification and performance verification can also be performed. The above three types of verification are not specifically limited in time sequence.

[0076] The following is described respectively:

[0077] Software compatibility verification: use different client Apps (such as different Apps, different versions of the same App) to integrate and use the password module, and perform different functions (such as "network request picture resource", "login", "upload file", "submit form" and the like), and verify whether all functions can be successfully executed. The test of this part can write a test script, all processes operated on the App are written into the test script according to the instruction set, and after the computer PC and the client are connected through the data line or hub, the instructions of the test script can be sent from the computer to the client for performance test. This way supports multi-process automated testing.

[0078] Hardware compatibility verification: use different models and operating system versions of mobile phones, install the client App integrated with the password module, and perform network request function, and verify whether all mobile phones can use the transaction function of the App. The test of this part is similar to the parallel test of software compatibility verification.

[0079] Performance verification: the performance part mainly considers whether the application integrated with the password module is the same as the same application without integrating the password module in terms of performance:

[0080] (1) CPU usage: when performing the same transaction function, use Xcode, Android studio and the like to view the change of CPU usage before and after integration by using the performance tools provided by Xcode, Android studio and the like.

[0081] (2) Memory usage: when performing the same transaction function, use Xcode, Android studio and the like to view the change of memory usage before and after integration by using the performance tools provided by Xcode, Android studio and the like.

[0082] The verification method of the password module provided by the embodiment of the application determines a plurality of threads corresponding to each type of password algorithm in the password module, and determines network communication parameter configuration items corresponding to each thread according to to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information; each thread sends a data acquisition request to a server; the data acquisition request carries an identifier of each type of password algorithm and a network communication parameter configuration item; the server is preconfigured with a service access link corresponding to each type of password algorithm; if a first data acquisition response message returned by the server according to the data acquisition request is received by all threads, it is determined that the functional verification of the password module is completed; the first data acquisition response message carries a network communication parameter configuration item that is determined to take effect, and the verification efficiency of the password module can be improved.

[0083] Further, the determination of the network communication parameter configuration items corresponding to each thread according to the to-be-verified network communication configuration information comprises:

[0084] The Header header configuration parameter, the Cookies configuration parameter and the cache configuration parameter corresponding to each thread are determined according to the to-be-verified network communication configuration information. Refer to the above embodiment for details.

[0085] The verification method of the password module provided by the embodiment of the application can comprehensively determine the network communication parameter configuration items.

[0086] Further, the verification method of the password module further comprises:

[0087] If it is determined that at least one first target thread receives a second data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is not completed; the second data acquisition response message carries a network communication parameter configuration item that is determined not to take effect. Refer to the above embodiment for details.

[0088] The verification method of the password module provided by the embodiment of the application can further accurately perform the functional verification of the password module.

[0089] Further, the verification method of the password module further comprises:

[0090] The second data acquisition response message is parsed to obtain the network communication parameter configuration item that is determined not to take effect, and the target network communication configuration information corresponding to the network communication parameter configuration item that is determined not to take effect is separately subjected to functional verification. Refer to the above embodiment for details.

[0091] The verification method of the password module provided in the embodiment of the present application can further accurately perform functional verification of the password module.

[0092] Further, the verification method of the password module further comprises:

[0093] If it is determined that there is at least one second target thread that cannot receive the data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is not completed.

[0094] The verification method of the password module provided in the embodiment of the present application can further accurately perform functional verification of the password module.

[0095] Further, the verification method of the password module further comprises:

[0096] The target data acquisition request corresponding to the un-received data acquisition response message is parsed to obtain a target password algorithm, and the target password algorithm is individually subjected to functional verification.

[0097] The verification method of the password module provided in the embodiment of the present application can further accurately perform functional verification of the password module.

[0098] Further, the verification method of the password module further comprises:

[0099] The timeout function of network communication is verified.

[0100] The verification method of the password module provided in the embodiment of the present application can further accurately perform functional verification of the password module.

[0101] It should be noted that the verification method of the password module provided in the embodiment of the present application can be used in the financial field, and can also be used in any technical field other than the financial field.

[0102] Figure 2 is a structural schematic diagram of the verification device of the password module provided in an embodiment of the present application, as shown in Figure 2 The verification device of the password module provided in the embodiment of the present application comprises a determination unit 201, a sending unit 202 and a verification unit 203, wherein:

[0103] The determining unit 201 is configured to determine a plurality of threads corresponding to each type of cryptographic algorithm in the cryptographic module, and determine a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified; the sending unit 202 is configured to send a data acquisition request to the server through each thread; the data acquisition request carries the identification of each type of cryptographic algorithm and the network communication parameter configuration item; the server is pre-provided with a service access link corresponding to each type of cryptographic algorithm; the verifying unit 203 is configured to determine that the functional verification of the cryptographic module is completed if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads; the first data acquisition response message carries the network communication parameter configuration item determined to take effect.

[0104] Specifically, the determining unit 201 in the device is configured to determine a plurality of threads corresponding to each type of cryptographic algorithm in the cryptographic module, and determine a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified; the sending unit 202 is configured to send a data acquisition request to the server through each thread; the data acquisition request carries the identification of each type of cryptographic algorithm and the network communication parameter configuration item; the server is pre-provided with a service access link corresponding to each type of cryptographic algorithm; the verifying unit 203 is configured to determine that the functional verification of the cryptographic module is completed if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads; the first data acquisition response message carries the network communication parameter configuration item determined to take effect.

[0105] The verifying device of the cryptographic module provided by the embodiment of the application determines a plurality of threads corresponding to each type of cryptographic algorithm in the cryptographic module, and determines a network communication parameter configuration item corresponding to each thread according to the network communication configuration information to be verified; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of network communication configuration information to be verified; a data acquisition request is sent to the server through each thread; the data acquisition request carries the identification of each type of cryptographic algorithm and the network communication parameter configuration item; the server is pre-provided with a service access link corresponding to each type of cryptographic algorithm; if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the cryptographic module is completed; the first data acquisition response message carries the network communication parameter configuration item determined to take effect, which can improve the verification efficiency of the cryptographic module.

[0106] Further, the determining unit 201 is specifically used for:

[0107] According to the network communication configuration information to be verified, the Header header configuration parameter, the Cookies configuration parameter and the cache configuration parameter corresponding to each thread are determined respectively.

[0108] The verification device of the password module provided by the embodiment of the application can comprehensively determine the network communication parameter configuration item.

[0109] Further, the verification device of the password module is further used for:

[0110] If it is determined that at least one first target thread receives the second data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is not completed; the second data acquisition response message carries the network communication parameter configuration item which is determined to be not effective.

[0111] The verification device of the password module provided by the embodiment of the application can further accurately perform the functional verification of the password module.

[0112] Further, the verification device of the password module is further used for:

[0113] The second data acquisition response message is parsed to obtain the network communication parameter configuration item which is determined to be not effective, and the target network communication configuration information corresponding to the network communication parameter configuration item which is determined to be not effective is separately subjected to the functional verification.

[0114] The verification device of the password module provided by the embodiment of the application can further accurately perform the functional verification of the password module.

[0115] Further, the verification device of the password module is further used for:

[0116] If it is determined that at least one second target thread cannot receive the data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the password module is not completed.

[0117] The verification device of the password module provided by the embodiment of the application can further accurately perform the functional verification of the password module.

[0118] Further, the verification device of the password module is further used for:

[0119] The target data acquisition request corresponding to the unreceivable data acquisition response message is parsed to obtain the target password algorithm, and the target password algorithm is separately subjected to the functional verification.

[0120] The verification device of the cryptographic module provided by the embodiment of the present application can further accurately perform functional verification of the cryptographic module.

[0121] Further, the verification device of the cryptographic module is further used for:

[0122] verifying a timeout function of network communication.

[0123] The verification device of the cryptographic module provided by the embodiment of the present application can further accurately perform functional verification of the cryptographic module.

[0124] The embodiment of the verification device of the cryptographic module provided by the embodiment of the present application can be used to execute the processing procedure of each method embodiment, and the function thereof will not be repeated here, and the detailed description can be referred to the above method embodiment.

[0125] Figure 3 The electronic device entity structure schematic diagram provided by the embodiment of the present application is shown as follows, Figure 3 The electronic device includes a processor 301, a memory 302 and a bus 303.

[0126] The processor 301, the memory 302 and the bus 303 complete mutual communication.

[0127] The processor 301 is used to call the program instruction in the memory 302 to execute the method provided by each method embodiment, for example, including:

[0128] determining a plurality of threads corresponding to each type of cryptographic algorithm in the cryptographic module, and determining a network communication parameter configuration item corresponding to each thread according to the to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information;

[0129] sending a data acquisition request to the server through each thread; the data acquisition request carries each type of cryptographic algorithm identifier and the network communication parameter configuration item; the server is pre-set with a service access link corresponding to each type of cryptographic algorithm;

[0130] If the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the cryptographic module is completed; the first data acquisition response message carries the network communication parameter configuration item determined to be effective.

[0131] The embodiment discloses a computer program product, the computer program product comprises a computer program stored on a non-transitory computer readable storage medium, the computer program comprises program instructions, when the program instructions are executed by a computer, the computer can execute the method provided by each method embodiment, for example, comprising:

[0132] determining a plurality of threads corresponding to each type of cryptographic algorithm in the cryptographic module, and determining a network communication parameter configuration item corresponding to each thread according to the to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information;

[0133] sending a data acquisition request to the server through each thread; the data acquisition request carries the identification of each type of cryptographic algorithm and the network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm;

[0134] if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the cryptographic module is completed; the first data acquisition response message carries the network communication parameter configuration item that determines the configuration to take effect.

[0135] The embodiment provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program causes the computer to execute the method provided by each method embodiment, for example, comprising:

[0136] determining a plurality of threads corresponding to each type of cryptographic algorithm in the cryptographic module, and determining a network communication parameter configuration item corresponding to each thread according to the to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information;

[0137] sending a data acquisition request to the server through each thread; the data acquisition request carries the identification of each type of cryptographic algorithm and the network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm;

[0138] if the first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the cryptographic module is completed; the first data acquisition response message carries the network communication parameter configuration item that determines the configuration to take effect.

[0139] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0140] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0141] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0142] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0143] ​​​​​​In the description of the specification, the description of the terms "one embodiment", "one specific embodiment", "some embodiments", "for example", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in one or more embodiments or examples.

[0144] The specific embodiments described above further illustrate the purposes, technical solutions and beneficial effects of the present application. It should be understood that the above description is only for specific embodiments of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method of verifying a cryptographic module, the method comprising: The method comprises the steps of: determining a plurality of threads corresponding to each type of cryptographic algorithm in a cryptographic module, and determining network communication parameter configuration items corresponding to each thread according to to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information; sending a data acquisition request to a server through each thread; the data acquisition request carries an identification of each type of cryptographic algorithm and a network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm; if a first data acquisition response message returned by the server according to the data acquisition request is received through all threads, it is determined that the functional verification of the cryptographic module is completed; the first data acquisition response message carries a network communication parameter configuration item that is determined to be effective.

2. The password module verification method of claim 1, wherein, The method further comprises the steps of: determining a plurality of threads corresponding to each type of cryptographic algorithm in a cryptographic module, and determining network communication parameter configuration items corresponding to each thread according to to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information; 3. The password module verification method of claim 1, wherein, The method further comprises the steps of: if it is determined that at least one first target thread receives a second data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the cryptographic module is not completed; the second data acquisition response message carries a network communication parameter configuration item that is determined to be ineffective.

4. The password module verification method according to claim 3, wherein The method further comprises the steps of: parsing the second data acquisition response message to obtain a network communication parameter configuration item that is ineffective, and separately performing functional verification on target network communication configuration information corresponding to the network communication parameter configuration item that is ineffective.

5. The password module verification method of claim 3, wherein, The method further comprises the steps of: if it is determined that at least one second target thread cannot receive a data acquisition response message returned by the server according to the data acquisition request, it is determined that the functional verification of the cryptographic module is not completed.

6. The password module verification method of claim 5, wherein, The method further comprises the steps of: parsing a target data acquisition request corresponding to the unreceivable data acquisition response message to obtain a target cryptographic algorithm, and separately performing functional verification on the target cryptographic algorithm.

7. The method of claim 1 to 6, wherein The method further comprises the steps of: verifying the timeout function of network communication.

8. An authentication apparatus of a cryptographic module, characterized by comprising: The method comprises the steps of: determining a plurality of threads corresponding to each type of cryptographic algorithm in a cryptographic module, and determining network communication parameter configuration items corresponding to each thread according to to-be-verified network communication configuration information; each network communication parameter configuration item corresponding to each thread is a random configuration parameter generated according to each type of to-be-verified network communication configuration information; sending a data acquisition request to a server through each thread; the data acquisition request carries an identification of each type of cryptographic algorithm and a network communication parameter configuration item; the server is pre-configured with a service access link corresponding to each type of cryptographic algorithm; A verification unit is configured to determine that the functional verification of the password module is completed if the first data acquisition response message returned by the server according to the data acquisition request is received by all threads.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images