Equipment testing method and device and electronic equipment

Abstract

The invention discloses an equipment testing method and device and electronic equipment, and relates to the technical field of communication. The method comprises the steps that a control channel is tested in the mode that first equipment initiates data connection to second equipment and / or sends abnormal data to the second equipment, a test result of the control channel is obtained, and the test result of the control channel at least comprises equipment state information and / or performance fluctuation information of the second equipment in the test process; the data channel is tested in the mode that the first device sends a message to the second device, a test result of the data channel is obtained, and the test result of the data channel at least comprises test information of the message anti-replay function of the second device; and determining a test result of the second equipment according to the test result of the control channel and the test result of the data channel. According to the method and the device, the technical problem that the stability test of the IPsec tunnel is inaccurate due to the fact that the stability detection dimension of the IPsec tunnel is too single is solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a device testing method, apparatus and electronic equipment. Background Art

[0002] With the development of network communication technology, various security protocols have emerged. IPsec (Internet Protocol Security) is a set of protocols used to ensure the security of Internet communications. The IPsec protocol is designed to provide data packet security at the network layer, including data encryption, data source authentication, data integrity and anti-replay protection.

[0003] The IPsec protocol is widely used as an important means to ensure data transmission security. However, the stability of the IPsec tunnel may be affected by changes in the network environment, sudden load increases, etc. The existing technology has the problem of poor results in IPsec tunnel stability testing.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a device testing method, apparatus and electronic device to at least solve the technical problem of [keywords].

[0006] According to one aspect of an embodiment of the present application, a device testing method is provided, comprising: establishing a control channel and a data channel through a first device and a second device, wherein the first device is used to test the second device, the data channel is used to encrypt and decrypt data according to the IPsec protocol, and the control channel is used to determine security parameters according to the IPsec protocol; testing the control channel by initiating a data connection and / or sending abnormal data from the first device to the second device to obtain a test result of the control channel, wherein the test result of the control channel at least includes device status information and / or performance fluctuation information of the second device during the test; testing the data channel by sending a message from the first device to the second device to obtain a test result of the data channel, wherein the test result of the data channel at least includes test information of the message anti-replay function of the second device; determining the test result of the second device according to the test result of the control channel and the test result of the data channel.

[0007] Optionally, the control channel is tested by initiating a data connection from the first device to the second device to obtain a test result of the control channel, including: using the control channel to control the first device to initiate a semi-connection request to the second device for multiple times within a preset time, and monitoring the device status information and / or performance fluctuation information of the second device within the preset time, wherein the semi-connection request is used to simulate a semi-connection attack scenario in the network; and / or; using the control channel to control the first device to initiate a full-connection request to the second device for multiple times within a preset time using the same IP address, and monitoring the device status information and / or performance fluctuation information of the second device within the preset time, wherein the full-connection request is used to simulate a full-connection attack scenario in the network.

[0008] Optionally, the control channel is tested by sending abnormal data from the first device to the second device to obtain a test result of the control channel, including at least one of the following testing methods:

[0009] The first test mode is used to use the control channel to control the first device to continuously send message data that does not comply with the specification conditions of the IPsec protocol to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period;

[0010] The second test mode is used to use the control channel to control the first device to continuously send message data that meets the specification conditions of the IPsec protocol but has abnormal data content to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period;

[0011] The third testing method is used to use the control channel to control the first device to continuously send different types of abnormal data defined by the IPsec protocol to the second device based on multiple control channels within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

[0012] Optionally, the data channel is tested by sending a message from the first device to the second device to obtain a test result of the data channel, including: determining X sequence numbers through the first device, where X is an integer greater than 1; constructing X first messages according to the X sequence numbers, where each first message carries one of the X sequence numbers, and different first messages carry different sequence numbers; encapsulating each first message into a second message to obtain X second messages, where the sequence number in the header data and the sequence number in the payload data of each second message are both the sequence numbers carried by the first message corresponding to the second message; sending the X second messages to the second device through the first device, and receiving at least one third message generated after the second device processes the X second messages using the message anti-replay function; and determining test information of the message anti-replay function of the second device according to at least one of the third messages.

[0013] Optionally, determining test information of the message anti-replay function of the second device based on the at least one third message includes: detecting whether the serial number in the third message complies with the serial number usage rules followed by the first device; determining that the third message is an abnormal message when the serial number in the third message does not comply with the serial number usage rules followed by the first device; determining that the third message is a normal message when the serial number in the third message complies with the serial number usage rules followed by the first device; determining test information of the message anti-replay function of the second device based on the number of abnormal messages and the number of normal messages in the at least one third message.

[0014] Optionally, testing the data channel in a manner of sending a message from the first device to the second device to obtain a test result of the data channel includes at least one of the following test operations:

[0015] The first test operation is used to use the data channel to continuously send a first type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the first type of IPsec data message is a format error, and / or a random length, and / or an IPsec data message carrying random content;

[0016] A second test operation is used to use the data channel to continuously send a second type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the second type of IPsec data message belongs to a message generated after mutating a key field defined in accordance with the IPsec protocol;

[0017] The third test operation is used to utilize the data channel to continuously send the encapsulated abnormal IPsec data packets to the second device through the first device within a preset time period, and monitor whether the second device recognizes the abnormal information of the abnormal IPsec data packets, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

[0018] Optionally, the control channel is tested by initiating a data connection and / or sending abnormal data from the first device to the second device to obtain a test result of the control channel, including: controlling the first device to establish multiple target connections with the second device, and counting the time required for each successful target connection establishment, wherein the target connection is used to simulate a normal IPsec connection scenario in the network; determining the target connection establishment time fluctuation information based on the time required for each successful target connection establishment; and using the target connection establishment time fluctuation information as the performance fluctuation information of the second device.

[0019] Optionally, the device status information includes at least: detection information of whether the second device is restarted, and / or detection information of whether an abnormality occurs in the service on the second device; the performance fluctuation information also includes at least: fluctuation information of the memory utilization of the second device, and / or fluctuation information of the CPU utilization of the second device.

[0020] According to another aspect of the present application, a device testing apparatus is also provided, which includes: a first processing unit, used to establish a control channel and a data channel with a second device through a first device, wherein the first device is used to test the second device, the data channel is used to encrypt and decrypt data according to the IPsec protocol, and the control channel is used to determine security parameters according to the IPsec protocol; a first testing unit, used to test the control channel by initiating a data connection and / or sending abnormal data from the first device to the second device, and obtain a test result of the control channel, wherein the test result of the control channel at least includes device status information and / or performance fluctuation information of the second device during the test; a second testing unit, used to test the data channel by sending a message from the first device to the second device, and obtain a test result of the data channel, wherein the test result of the data channel at least includes test information of the message anti-replay function of the second device; a determination unit, used to determine the test result of the second device according to the test result of the control channel and the test result of the data channel.

[0021] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the above-mentioned device testing method.

[0022] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned device testing method.

[0023] As can be seen from the above content, the present application establishes a control channel and a data channel through a first device and a second device, wherein the first device is used to test the second device, the data channel is used to encrypt and decrypt data according to the IPsec protocol, and the control channel is used to determine security parameters according to the IPsec protocol. The control channel is tested by initiating a data connection and / or sending abnormal data from the first device to the second device, and a test result of the control channel is obtained, wherein the test result of the control channel at least includes the device status information and / or performance fluctuation information of the second device during the test. The data channel is tested by sending a message from the first device to the second device, and a test result of the data channel is obtained, wherein the test result of the data channel at least includes the test information of the message anti-replay function of the second device. Finally, the test result of the second device is determined according to the test result of the control channel and the test result of the data channel.

[0024] This application tests the control function and data processing function of the second device by establishing a control channel and a data channel, respectively. It not only takes into account the device status information and / or performance fluctuation information, but also conducts a special test on the message anti-replay function of the data channel, thereby evaluating the stability of the second device when using the IPsec tunnel for message transmission and processing in multiple dimensions, and improving the accuracy and comprehensiveness of the test. In practical applications, this method can effectively detect the processing capability and stability of the second device in the face of various abnormal situations, provide a more reliable test basis for the IPsec message processing function of the network device, ensure network security and data transmission stability, and thus solve the technical problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0026] Figure 1 is a flow chart of an optional device testing method according to an embodiment of the present application;

[0027] Figure 2 is an optional device test topology diagram according to an embodiment of the present application;

[0028] Figure 3 is an overall flow chart of an optional device testing process according to an embodiment of the present application;

[0029] Figure 4 is a schematic diagram of an optional control channel stability test according to an embodiment of the present application;

[0030] Figure 5 is a flow chart of an optional data channel stability test according to an embodiment of the present application;

[0031] Figure 6 It is a flowchart of an optional test process of the message anti-replay function according to an embodiment of the present application;

[0032] Figure 7 is a schematic diagram of an optional first message according to an embodiment of the present application;

[0033] Figure 8 is a schematic diagram of an optional second message according to an embodiment of the present application;

[0034] Fig. 9 It is a schematic diagram of an optional equipment testing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0038] According to an embodiment of the present application, an embodiment of a device testing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] Figure 1 is a flow chart of an optional device testing method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0040] Step S101: Establish a control channel and a data channel with a second device through a first device.

[0041] In step S101, the first device is used to test the second device, the data channel is used to encrypt and decrypt data according to the IPsec protocol, and the control channel is used to determine security parameters according to the IPsec protocol.

[0042] Optionally, Figure 2 is an optional device test topology diagram according to an embodiment of the present application, wherein: Figure 2 The device to be tested (also referred to as: the device under test) is the second device mentioned above. Figure 2 The test device in is the first device mentioned above. The test device can be a virtual machine or server that performs the test task, and the device under test is a terminal device, virtual machine or server with IPsec communication function. A data transmission channel based on the IPsec protocol is established between the device to be tested and the test device through the network.

[0043] Alternatively, if Figure 2As shown, the test equipment includes: a configuration module, a topology generation module, a test and collection module, and an analysis and display module. Among them, the configuration module is used to configure the environmental parameters and test parameters related to the test task of the IPsec message processing function of the device; the topology generation module is used to build the test network topology (including but not limited to the IP address and routing information of the relevant network card, etc.) according to the various parameters configured by the configuration module; the test and collection module is used to perform relevant tests on the tested device according to the various parameters configured by the configuration module, and collect relevant information during the test process; the analysis and display module is used to integrate the collected test information, and display the relevant test data through the UI interface, and determine the test score by analyzing the test data, and give optimization suggestions.

[0044] Step S102: The control channel is tested by initiating a data connection and / or sending abnormal data from the first device to the second device to obtain a test result of the control channel.

[0045] In step S102, the test result of the control channel includes at least device state information and / or performance fluctuation information of the second device during the test.

[0046] Optionally, the control channel refers to a channel for negotiating and managing security parameters under the IPsec protocol, and is used to establish and maintain an IPsec secure connection. The control channel ensures the security of the data channel by negotiating parameters such as keys and security policies, and is also used to monitor and manage the status of the IPsec connection. In the process of testing the control channel, the first device will regularly collect device status information and / or performance fluctuation information of the second device during the test, wherein the device status information includes at least: detection information on whether the second device has been restarted, and / or detection information on whether an abnormality has occurred in the service on the second device; the performance fluctuation information also includes at least: fluctuation information on the memory utilization of the second device, and / or fluctuation information on the CPU utilization of the second device.

[0047] Step S103: Testing the data channel by sending a message from the first device to the second device to obtain a test result of the data channel.

[0048] In step S103, the test result of the data channel includes at least test information of the message anti-replay function of the second device.

[0049] Optionally, a data channel refers to a channel for transmitting data under the IPsec protocol, which is used to encrypt and decrypt data to protect the confidentiality and integrity of communications. The data channel protects the security of data by using encryption algorithms and authentication algorithms to ensure that data is not stolen or tampered with during transmission.

[0050] Optionally, the message anti-replay function is a network security mechanism for preventing an attacker from performing malicious actions by copying and resending (replaying) a previously captured valid message (e.g., an authentication message). This attack is called a replay attack.

[0051] In some application scenarios, such as online identity authentication, electronic payment, and network communication, the data transmission process needs to be authenticated and authorized to ensure the security and integrity of the data. The message anti-replay function is designed to prevent attackers from using these authentication and authorization information to carry out attacks.

[0052] Step S104: Determine the test result of the second device according to the test result of the control channel and the test result of the data channel.

[0053] Optionally, the first device may combine the test results of the control channel and the test results of the data channel to determine the final test results of the second device in multiple dimensions. For example, corresponding weights may be assigned and allocated to each test result data of the control channel, and corresponding weights may be assigned and allocated to each test result data of the data channel. Finally, a comprehensive test score of the second device may be obtained through weighted calculation. The comprehensive test score is used to evaluate the IPsec message processing performance of the second device.

[0054] Figure 3 is an overall flow chart of an optional device testing process according to an embodiment of the present application, such as Figure 3 As shown, firstly, the test parameters are set through the first device, and then the test environment is constructed according to the test parameters. Then, the stability test is performed on the IPsec control channel between the first device and the second device; and the stability test is performed on the IPsec data channel between the first device and the second device. During the test process, the test data is collected, and finally, the test data is analyzed, and a test score is given to the test of the second device according to the analysis results of the test data, and optimization suggestions are generated at the same time.

[0055] As can be seen from the above content, this application tests the control function and data processing function of the tested device by establishing a control channel and a data channel, respectively. It not only takes into account the device status information and / or performance fluctuation information, but also conducts special tests on the message anti-replay function of the data channel, thereby evaluating the stability of the tested device when using the IPsec tunnel for message processing and transmission in multiple dimensions, and improving the accuracy and comprehensiveness of the test. In practical applications, this method can effectively detect the processing capability and stability of the tested device in the face of various abnormal situations, provide a more reliable test basis for the IPsec function of the network device, ensure network security and data transmission stability, and thus solve the technical problem of [keywords].

[0056] In an optional embodiment, the control channel is tested by initiating a data connection from the first device to the second device to obtain a test result of the control channel, including the following methods:

[0057] Using a control channel, control the first device to initiate a semi-connection request to the second device multiple times in a preset time, and monitor the device status information and / or performance fluctuation information of the second device within the preset time, wherein the semi-connection request is used to simulate a semi-connection attack scenario in the network; and / or; using a control channel, control the first device to initiate a full-connection request to the second device multiple times in a preset time using the same IP address, and monitor the device status information and / or performance fluctuation information of the second device within the preset time, wherein the full-connection request is used to simulate a full-connection attack scenario in the network.

[0058] Optionally, Figure 4 is a schematic diagram of an optional control channel stability test according to an embodiment of the present application, such as Figure 4 As shown, the control channel is tested by initiating a data connection from the first device to the second device, including but not limited to initiating a semi-connection attack test from the first device to the second device and initiating a full-connection attack test from the first device to the second device.

[0059] Optionally, semi-connection attack test: the first device continuously initiates semi-connection requests to the second device at a configured rate to simulate a scenario in which the second device is attacked by a semi-connection attack in the network, until the test duration of the test reaches a preset duration and the test is completed. During the test, the first device establishes a normal connection with the second device at intervals of a certain period of time, and records the total time required for the successful establishment of the connection. At the same time, the first device also regularly collects the CPU utilization and memory utilization of the second device during the test to determine the performance fluctuation information of the second device during the semi-connection attack test.

[0060] In addition, during the semi-connected attack test, the first device will also monitor the device status information of the second device, for example, to monitor whether the second device has a device restart or service abnormality due to the semi-connected attack. If a device restart or service abnormality occurs, it means that the second device has failed to effectively defend against the semi-connected attack.

[0061] Optionally, a full connection attack test: the first device performs multiple full connection negotiations with the second device at a configured rate and using the same IP address until the test duration reaches a preset duration, completing the test. The full connection attack test is used to simulate a full connection attack scenario in the network.

[0062] Similarly, during the full connection attack test, the first device establishes a normal connection with the second device at intervals and records the total time required for the successful establishment of the connection. At the same time, the first device also regularly collects the CPU utilization and memory utilization of the second device during the test to determine the performance fluctuation information of the second device during the full connection attack test. In addition, during the full connection attack test, the first device also monitors the device status information of the second device.

[0063] It should be noted that the above method can effectively evaluate the response capability and stability of the tested equipment when facing different types of network attacks, provide a quantitative basis for the protection capability of network equipment, and is particularly suitable for IPsec function testing of enterprise-level firewalls and routers.

[0064] In an optional embodiment, the control channel is tested by sending abnormal data from the first device to the second device to obtain a test result of the control channel, including at least one of the following testing methods:

[0065] The first test method is used to use the control channel to control the first device to continuously send message data that does not comply with the specification conditions of the IPsec protocol to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period;

[0066] The second test mode is used to use the control channel to control the first device to continuously send message data that meets the specification conditions of the IPsec protocol but has abnormal data content to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period;

[0067] The third test method is used to use a control channel to control the first device to continuously send different types of abnormal data defined by the IPsec protocol to the second device based on multiple control channels within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

[0068] Alternatively, if Figure 4 As shown, the control channel is tested by sending abnormal data from the first device to the second device, including but not limited to initiating an abnormal message attack test from the first device to the second device, initiating an abnormal data attack test in the protocol from the first device to the second device, and initiating other types of message attack tests from the first device to the second device.

[0069] Among them, the abnormal message attack test (corresponding to the first test method mentioned above): the first device continuously sends control protocol messages that do not meet the standard conditions of the IPsec protocol (such as deformed messages and messages with random content during the IKE negotiation process) to the second device at the configured rate until the test reaches the preset time and the test is completed. In particular, if the second device encounters an abnormality during the test, the test is terminated.

[0070] Optionally, during the abnormal message attack test, the first device regularly establishes a normal connection with the second device and records the state of the connection establishment (normal if the negotiation succeeds within a certain period of time, and failure if the negotiation fails within a certain period of time). In addition, during the test, the first device will also regularly collect the CPU utilization and memory utilization of the second device and collect the device status information of the second device.

[0071] Optionally, abnormal data attack test in the protocol (corresponding to the second test method mentioned above): the first device sends protocol abnormal data packets (that is, packets that meet the specification conditions of the IPsec protocol but have abnormal data content) to the second device at a configured rate until the test duration reaches the preset duration to complete the test.

[0072] The protocol abnormal data message may be a specially constructed message that meets the protocol standard, but the relevant content includes undefined values ​​of the protocol, the length exceeds the expectation, the field order is disrupted and reorganized, and the format is replaced (the string is replaced with a non-string format). If the second device has an abnormality during the test, the test is terminated.

[0073] Optionally, during the abnormal data attack test in the protocol, the first device regularly establishes a normal connection with the second device and records the state of the connection establishment (normal if the negotiation succeeds within a certain period of time, and failure if the negotiation fails within a certain period of time). In addition, during the test, the first device will also regularly collect the CPU utilization and memory utilization of the second device and collect the device status information of the second device.

[0074] Optionally, attack test of other types of messages (corresponding to the third test method mentioned above): the first device establishes multiple different IPsec channels with the second device, and the first device continuously sends different types of notification messages and / or detection messages defined by the protocol standard at a configured rate, and the message content can be randomly set until the test duration reaches the preset duration, and the test is completed. During the test, the first device will also regularly collect the CPU utilization and memory utilization of the second device and collect the device status information of the second device.

[0075] It should be noted that the above-mentioned multiple test methods can cover various abnormal situations that the tested device may encounter when processing IPsec messages, including protocol errors, data anomalies and multi-channel concurrent anomalies, which helps to comprehensively evaluate the robustness and anti-interference ability of the tested device when processing IPsec messages, and is suitable for production testing and maintenance inspection of network equipment.

[0076] In an optional embodiment, a data channel is tested by sending a message from a first device to a second device to obtain a test result of the data channel, including: determining X sequence numbers by the first device, where X is an integer greater than 1. Then, constructing X first messages according to the X sequence numbers, wherein each first message carries one of the X sequence numbers, and different first messages carry different sequence numbers. Subsequently, encapsulating each first message into a second message to obtain X second messages, wherein the sequence number in the header data and the sequence number in the payload data of each second message are both the sequence numbers carried by the first message corresponding to the second message; sending the X second messages to the second device by the first device, and receiving at least one third message generated by the second device processing the X second messages using the message anti-replay function. Finally, determining the test information of the message anti-replay function of the second device according to the at least one third message.

[0077] Optionally, Figure 5 is a flow chart of an optional data channel stability test according to an embodiment of the present application, such as Figure 5 As shown, the stability test of the data channel at least includes the test of the message anti-replay function of the second device.

[0078] Among them, the message anti-replay function can be used to protect the security and integrity of network communications and maintain network stability. Ensuring the normal function of the message anti-replay function is important for ensuring the stability of network devices when processing IPsec messages.

[0079] The test process of message anti-replay function is as follows: Figure 6 As shown:

[0080] 1. First, the first device establishes an IPsec connection with the second device.

[0081] 2. The first device then generates X serial numbers through an algorithm (a random generation algorithm, a sequence increment algorithm, etc. may be selected, and this application does not make any special specification).

[0082] 3. The first device selects a sequence number from the X sequence numbers in order to construct a first message, wherein the constructed first message carries the sequence number information. The message example is as follows: Figure 7 As shown, Figure 7The message in is composed of an ETH header, an IP header (marked as IP_1 for distinction), a sequence number, and random content of random length.

[0083] 4. The first device encapsulates the first message into a second message and sends it to the second device, wherein the sequence number in the header data of the encapsulated second message is consistent with the sequence number carried by the first message, such as Figure 8 As shown, the encapsulated second message consists of an ETH (Ethernet) header, an IP header, an ESP (Encapsulating Security Payload) header, and an ESP payload, wherein the ESP payload is Figure 7 The data starting with IP in the constructed message, the sequence number in the ESP header and Figure 7 The sequence number in the first message in the packet remains consistent.

[0084] 5. The second device processes the received second message through the message anti-replay function.

[0085] 6. If the second device generates a new message (ie, a third message) based on the second message when processing the second message through the message anti-replay function, the second device will send the third message to the first device, and the first device will extract the serial number from the received third message.

[0086] 7. The first device checks the serial number extracted from the third message according to the serial number usage rules it follows. If it complies with the serial number usage rules, execute step 8; if it does not comply with the serial number usage rules, execute step 9.

[0087] 8. Record the number of normally processed messages and increase it by 1. Continue to execute from step 3 until all X serial numbers are tested.

[0088] 9. The number of recorded exception handling messages increases by 1, and the process continues from step 3 until all X serial numbers have been tested.

[0089] It should be noted that by constructing messages with specific serial numbers, the message anti-replay function of the second device can be accurately tested to ensure the security and integrity of data transmission. The message anti-replay function of the second device can also be quantitatively evaluated to help network administrators or equipment manufacturers identify and improve potential security vulnerabilities and ensure the security of network communications.

[0090] In an optional embodiment, determining the test information of the message anti-replay function of the second device based on at least one third message includes: detecting whether the serial number in the third message complies with the serial number usage rules followed by the first device. In the case where the serial number in the third message does not comply with the serial number usage rules followed by the first device, determining that the third message is an abnormal message; in the case where the serial number in the third message complies with the serial number usage rules followed by the first device, determining that the third message is a normal message. Determine the test information of the message anti-replay function of the second device based on the number of abnormal messages and the number of normal messages in at least one third message.

[0091] Optionally, during the test, the number of abnormal messages and the number of normal messages in all third messages returned by the second device to the first device can be counted, and then the proportion of the number of abnormal messages in all third messages can be calculated. If the data proportion is higher, it means that the probability of an abnormality in the message anti-replay function of the second device is higher.

[0092] In an optional embodiment, the data channel is tested by sending a message from the first device to the second device to obtain a test result of the data channel, including at least one of the following test operations:

[0093] The first test operation is used to use the data channel to continuously send a first type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the first type of IPsec data message is an IPsec data message with a format error and / or a random length and / or carrying random content;

[0094] The second test operation is used to use the data channel to continuously send a second type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the second type of IPsec data message is a message generated after mutating a key field defined in accordance with the IPsec protocol;

[0095] The third test operation is used to utilize the data channel to continuously send the encapsulated abnormal IPsec data message to the second device through the first device within a preset time period, and monitor whether the second device recognizes the abnormal information of the abnormal IPsec data message, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

[0096] Alternatively, if Figure 5As shown, in addition to testing the message anti-replay function of the second device, the data channel of the second device can also be tested using an abnormal message, using an ESP message including an abnormal field, and using an abnormal ESP encapsulated message to test the data channel of the second device.

[0097] Optionally, in order to test the second device's ability to handle malicious attack messages, an abnormal message may be used to test the data channel of the second device (corresponding to the first test operation described above). The first device may construct an IPsec data message with a format error, and / or a random length, and / or carrying random content as a first type of IPsec data message, and send the first type of IPsec data message to the second device until the test duration reaches a preset duration to complete the test. During the test, the first device also regularly collects the CPU utilization and memory utilization of the second device to determine the performance fluctuation information of the second device during the test. In addition, the first device also monitors the device status information of the second device.

[0098] Optionally, when using an ESP message including an abnormal field to test the data channel of the second device (corresponding to the second test operation described above), the first device mutates the key fields defined in the message format defined by the IPsec ESP protocol, thereby constructing a second type of IPsec data message and sending it to the device to be tested, for testing the second device's ability to handle such abnormal messages. During the test, the first device regularly collects the CPU utilization and memory utilization of the second device to determine the performance fluctuation information of the second device during the test. In addition, the first device also monitors the device status information of the second device.

[0099] Optionally, when using an abnormal ESP encapsulated message to test the data channel of the second device (corresponding to the third test operation mentioned above), in order to test the ability of the second device to filter abnormal messages when processing decrypted messages, the first device can construct an abnormal IPsec data message with random content and / or random length, and send it to the second device after normal encapsulation, so as to test the ability of the second device to identify abnormal messages after decapsulating the encapsulated message.

[0100] It should be noted that the above-mentioned test operations can evaluate the data processing capability and robustness of the second device when processing IPsec messages from multiple angles, and are suitable for performance testing and security function verification of network equipment, ensuring that the equipment can effectively respond to various data anomalies and attacks in actual deployment.

[0101] In an optional embodiment, the control channel is tested by initiating a data connection and / or sending abnormal data from the first device to the second device to obtain a test result of the control channel, including: controlling the first device to establish multiple target connections with the second device, and counting the time required for each successful target connection establishment, wherein the target connection is used to simulate a normal IPsec connection scenario in the network; determining the target connection establishment time fluctuation information based on the time required for each successful target connection establishment; and using the target connection establishment time fluctuation information as the performance fluctuation information of the second device.

[0102] Optionally, when testing the control channel, the first device can initiate a request to establish a target connection to the second device at a certain interval, which is used for normal IPsec connection scenarios in the model network. At the same time, the time taken to establish each target connection can be counted to determine the time fluctuation information for establishing the target connection between the first device and the second device.

[0103] In an optional embodiment, the test result of the second device is determined according to the test result of the control channel and the test result of the data channel, including: determining a test score of the second device according to the test result of the control channel, the test result of the data channel, the weight corresponding to the test result of the control channel, and the weight corresponding to the test result of the data channel, wherein the test score quantifies the test result of the second device in the form of a score.

[0104] It should be noted that by comprehensively considering the test results of the control channel and the data channel, the overall performance and stability of the second device can be comprehensively evaluated, which is suitable for comprehensive testing and evaluation of network equipment and provides data support for performance optimization and security reinforcement of network equipment.

[0105] Optionally, the present application proposes a method for calculating a device test score, which specifically includes the following rules:

[0106] Rule 1: If the second device has an abnormal status, the second device will be directly assigned 0 points;

[0107] Rule 2: If the fluctuation of the memory utilization of the second device during a certain test (such as variance, standard deviation) exceeds a preset threshold, a specific score will be deducted; if the fluctuation of the memory utilization does not exceed the preset threshold, no score will be deducted;

[0108] Rule 3: If the fluctuation of CPU utilization (e.g., variance, standard deviation) of the second device during a certain test exceeds a preset threshold, a specific score will be deducted; if the fluctuation of CPU utilization does not exceed the preset threshold, no score will be deducted;

[0109] Rule 4: During the test of the control channel, determine the fluctuation information of the establishment time of the target connection between the first device and the second device (which can be represented by calculating the variance or standard deviation). If the fluctuation of the establishment time of the target connection exceeds a preset threshold, a specific score is deducted; if the fluctuation of the establishment time of the target connection does not exceed the preset threshold, no score is deducted;

[0110] Rule 5: When testing the message anti-replay function of the second device, the proportion of the number of abnormal messages in all third messages is calculated, and the test score C of the message anti-replay function of the second device is determined according to the following formula (1):

[0111]

[0112] The final test evaluation calculation formula is as shown in formula (2). The higher the score S is, the higher the stability of the second device in processing IPsec messages is.

[0113]

[0114] Where: S i The score of the i-th test, P i is the weight corresponding to the i-th test, wherein any test in the test is 0 points, which means that the second device has serious problems affecting stability when processing IPsec messages, and is directly assigned 0 points.

[0115] Finally, the UI can display the score of each test item and the overall score, as well as the deduction of each test item.

[0116] In an optional embodiment, Table 1 shows relevant suggestions for certain specific problem items. When it is detected that the second device has any of the following problem items, the relevant suggestions can be displayed in the UI interface.

[0117] Table 1

[0118]

[0119] Optionally, when a certain round of testing of a certain item fails, the relevant data of the failure can be automatically formed into a test set for testing reproduction, test verification, and test regression of the problem, thereby continuously maintaining and improving the stability of the second device when processing IPsec messages.

[0120] As can be seen from the above content, this application simulates common attack scenarios of control channels and data channels for testing, and collects relevant data during the test process for scoring, so as to evaluate the stability of the second device when processing IPsec messages. At the same time, optimization suggestions are given for test problems, and test sets are automatically generated to improve the efficiency of problem reproduction and verification, and continuously improve the stability of the second device in processing IPsec messages.

[0121] Based on the device testing method provided in the above embodiment, the embodiment of the present application further provides a device testing apparatus, wherein: Fig. 9 is a schematic diagram of an optional device testing apparatus according to an embodiment of the present application, such as Fig. 9 As shown, it includes: a first processing unit 901, a first testing unit 902, a second testing unit 903, and a determining unit 904.

[0122] Optionally, the first processing unit 901 is used to establish a control channel and a data channel with the second device through the first device, wherein the first device is used to test the second device, the data channel is used to encrypt and decrypt data according to the IPsec protocol, and the control channel is used to determine security parameters according to the IPsec protocol; the first testing unit 902 is used to test the control channel by initiating a data connection and / or sending abnormal data from the first device to the second device, and obtain a test result of the control channel, wherein the test result of the control channel at least includes device status information and / or performance fluctuation information of the second device during the test; the second testing unit 903 is used to test the data channel by sending a message from the first device to the second device, and obtain a test result of the data channel, wherein the test result of the data channel at least includes test information of the message anti-replay function of the second device; the determination unit 904 is used to determine the test result of the second device based on the test result of the control channel and the test result of the data channel.

[0123] Optionally, the first test unit 902 is also used to use the control channel to control the first device to initiate a semi-connection request to the second device multiple times within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period, wherein the semi-connection request is used to simulate a semi-connection attack scenario in the network; and / or; use the control channel to control the first device to use the same IP address to initiate a full-connection request to the second device multiple times within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period, wherein the full-connection request is used to simulate a full-connection attack scenario in the network.

[0124] Optionally, the first testing unit 902 is further configured to perform at least one of the following testing methods:

[0125] The first test method is used to use the control channel to control the first device to continuously send message data that does not comply with the specification conditions of the IPsec protocol to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period;

[0126] The second test mode is used to use the control channel to control the first device to continuously send message data that meets the specification conditions of the IPsec protocol but has abnormal data content to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period;

[0127] The third test method is used to use a control channel to control the first device to continuously send different types of abnormal data defined by the IPsec protocol to the second device based on multiple control channels within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

[0128] Optionally, the second test unit 903 includes: a first determination subunit, a message construction subunit, a message encapsulation subunit, a message sending subunit, and a second determination subunit. The first determination subunit is used to determine X sequence numbers through the first device, where X is an integer greater than 1; the message construction subunit is used to construct X first messages according to the X sequence numbers, where each first message carries one of the X sequence numbers, and different first messages carry different sequence numbers; the message encapsulation subunit is used to encapsulate each first message into a second message to obtain X second messages, where the sequence number in the header data and the sequence number in the payload data of each second message are both the sequence numbers carried by the first message corresponding to the second message; the message sending subunit is used to send the X second messages to the second device through the first device, and receive at least one third message generated after the second device processes the X second messages using the message anti-replay function; the second determination subunit is used to determine the test information of the message anti-replay function of the second device according to the at least one third message.

[0129] Optionally, the second determination subunit includes: a detection module, a first determination module, a second determination module, and a third determination module. The detection module is used to detect whether the serial number in the third message complies with the serial number usage rules followed by the first device; the first determination module is used to determine that the third message is an abnormal message when the serial number in the third message does not comply with the serial number usage rules followed by the first device; the second determination module is used to determine that the third message is a normal message when the serial number in the third message complies with the serial number usage rules followed by the first device; the third determination module is used to determine the test information of the message anti-replay function of the second device based on the number of abnormal messages and the number of normal messages in at least one third message.

[0130] Optionally, the second testing unit 903 is further configured to perform at least one of the following testing operations:

[0131] The first test operation is used to use the data channel to continuously send a first type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the first type of IPsec data message is an IPsec data message with a format error and / or a random length and / or carrying random content;

[0132] The second test operation is used to use the data channel to continuously send a second type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the second type of IPsec data message is a message generated after mutating a key field defined in accordance with the IPsec protocol;

[0133] The third test operation is used to utilize the data channel to continuously send the encapsulated abnormal IPsec data message to the second device through the first device within a preset time period, and monitor whether the second device recognizes the abnormal information of the abnormal IPsec data message, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

[0134] Optionally, the first test unit 902 includes: a first control subunit, a third determination subunit, and a fourth determination subunit. The first control subunit is used to control the first device to establish multiple target connections with the second device, and to count the time required for each target connection to be successfully established, wherein the target connection is used to simulate a normal IPsec connection scenario in the network; the third determination subunit is used to determine the target connection establishment time fluctuation information according to the time required for each target connection to be successfully established; and the fourth determination subunit is used to use the target connection establishment time fluctuation information as the performance fluctuation information of the second device.

[0135] Optionally, the determination unit 904 includes: a score determination subunit, used to determine the test score of the second device based on the test results of the control channel, the test results of the data channel, the weight corresponding to the test results of the control channel, and the weight corresponding to the test results of the data channel, wherein the test score quantifies the test results of the second device in the form of a score.

[0136] Optionally, the device status information includes at least: detection information of whether the second device is restarted, and / or detection information of whether the service on the second device is abnormal; the performance fluctuation information also includes at least: fluctuation information of the memory utilization of the second device, and / or fluctuation information of the CPU utilization of the second device.

[0137] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program runs, the device where the computer-readable storage medium is located executes the above-mentioned device testing method.

[0138] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors execute the above-mentioned device testing method.

[0139] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0140] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0141] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0142] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0143] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0144] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0145] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0146] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A device testing method, characterized in that: include: Establishing a control channel and a data channel with a second device through a first device, wherein the first device is used to test the second device, the data channel is used to encrypt and decrypt data according to an IPsec protocol, and the control channel is used to determine security parameters according to the IPsec protocol; The control channel is tested by initiating a data connection and / or sending abnormal data from the first device to the second device to obtain a test result of the control channel, wherein the test result of the control channel at least includes device state information and / or performance fluctuation information of the second device during the test; The data channel is tested by sending a message from the first device to the second device to obtain a test result of the data channel, wherein the test result of the data channel at least includes test information of a message anti-replay function of the second device; A test result of the second device is determined according to the test result of the control channel and the test result of the data channel.

2. The device testing method according to claim 1, characterized in that: The control channel is tested by initiating a data connection from the first device to the second device, and a test result of the control channel is obtained, including: Using the control channel, controlling the first device to continuously initiate a semi-connected request to the second device for multiple times within a preset time, and monitoring the device state information and / or performance fluctuation information of the second device within the preset time, wherein the semi-connected request is used to simulate a semi-connected attack scenario in the network; and / or; Utilizing the control channel, control the first device to use the same IP address to initiate a full-connection request to the second device multiple times in a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period, wherein the full-connection request is used to simulate a full-connection attack scenario in the network.

3. The device testing method according to claim 1, characterized in that: The control channel is tested by sending abnormal data from the first device to the second device to obtain a test result of the control channel, including at least one of the following testing methods: The first test mode is used to use the control channel to control the first device to continuously send message data that does not comply with the specification conditions of the IPsec protocol to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period; The second test mode is used to use the control channel to control the first device to continuously send message data that meets the specification conditions of the IPsec protocol but has abnormal data content to the second device within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period; The third testing method is used to use the control channel to control the first device to continuously send different types of abnormal data defined by the IPsec protocol to the second device based on multiple control channels within a preset time period, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

4. The device testing method according to claim 1, characterized in that: The data channel is tested by sending a message from the first device to the second device to obtain a test result of the data channel, including: Determine X serial numbers by the first device, where X is an integer greater than 1; Constructing X first messages according to the X sequence numbers, wherein each first message carries one of the X sequence numbers, and different first messages carry different sequence numbers: Encapsulate each first message into a second message to obtain X second messages, wherein the sequence number in the header data and the sequence number in the payload data of each second message are both the sequence number carried by the first message corresponding to the second message; Sending the X second messages to the second device through the first device, and receiving at least one third message generated after the second device processes the X second messages using the message anti-replay function; Determine test information of the message anti-replay function of the second device according to at least one of the third messages.

5. The device testing method according to claim 4, characterized in that: Determining test information of a message anti-replay function of the second device according to the at least one third message includes: Detecting whether the serial number in the third message complies with the serial number usage rule followed by the first device; If the sequence number in the third message does not comply with the sequence number usage rule followed by the first device, determining that the third message is an abnormal message; If the sequence number in the third message complies with the sequence number usage rule followed by the first device, determining that the third message is a normal message; Determine test information of the message anti-replay function of the second device according to the number of the abnormal messages and the number of the normal messages in the at least one third message.

6. The device testing method according to claim 1, characterized in that: The data channel is tested by sending a message from the first device to the second device to obtain a test result of the data channel, including at least one of the following test operations: The first test operation is used to use the data channel to continuously send a first type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the first type of IPsec data message is a format error, and / or a random length, and / or an IPsec data message carrying random content; A second test operation is used to use the data channel to continuously send a second type of IPsec data message to the second device through the first device within a preset time period, and monitor the device state information and / or performance fluctuation information of the second device within the preset time period, wherein the second type of IPsec data message belongs to a message generated after mutating a key field defined in accordance with the IPsec protocol; The third test operation is used to utilize the data channel to continuously send the encapsulated abnormal IPsec data packets to the second device through the first device within a preset time period, and monitor whether the second device recognizes the abnormal information of the abnormal IPsec data packets, and monitor the device status information and / or performance fluctuation information of the second device within the preset time period.

7. The device testing method according to claim 1, characterized in that: The control channel is tested by initiating a data connection and / or sending abnormal data from the first device to the second device to obtain a test result of the control channel, including: Controlling the first device to establish multiple target connections with the second device, and counting the time required for each target connection to be successfully established, wherein the target connection is used to simulate a normal IPsec connection scenario in the network; Determine the target connection establishment time fluctuation information according to the time required for each target connection to be successfully established; The establishment time fluctuation information of the target connection is used as the performance fluctuation information of the second device.

8. The device testing method according to any one of claims 1 to 7, characterized in that: The device status information includes at least: detection information of whether the second device is restarted, and / or detection information of whether an abnormality occurs in the service on the second device; the performance fluctuation information also includes at least: fluctuation information of the memory utilization of the second device, and / or fluctuation information of the CPU utilization of the second device.

9. A device testing apparatus, characterized in that: include: a first processing unit, configured to establish a control channel and a data channel with a second device through a first device, wherein the first device is used to test the second device, the data channel is used to encrypt and decrypt data according to an IPsec protocol, and the control channel is used to determine security parameters according to the IPsec protocol; a first testing unit, configured to test the control channel by initiating a data connection and / or sending abnormal data from the first device to the second device, so as to obtain a test result of the control channel, wherein the test result of the control channel at least includes device status information and / or performance fluctuation information of the second device during the test; A second testing unit, configured to test the data channel by sending a message from the first device to the second device, and obtain a test result of the data channel, wherein the test result of the data channel at least includes test information of a message anti-replay function of the second device; A determining unit is used to determine a test result of the second device according to a test result of the control channel and a test result of the data channel.

10. An electronic device, characterized in that: It comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the device testing method described in any one of claims 1 to 8.

Images