A software system security test quality evaluation method

Abstract

The present invention belongs to software system security testing, and specifically relates to a software system security testing quality evaluation method, including the following steps: obtaining an interface feature data set of a software system to be tested, and setting the test level to basic application software or enhanced application software according to the interface feature data set; setting the security feature test items to be tested according to the level category; performing classified tests on the security feature test items respectively, including security function testing, penetration testing and port testing; defining the test items as high-risk test items, medium-risk test items and low-risk test items according to the degree of impact of security defects on the software system to be tested; and evaluating the test conclusions. The method provided by the present invention can give an overall conclusion of the application software system security test and confirm the degree to which the application software system meets the corresponding security requirements.

Description

Technical Field

[0001] The present invention relates to software system security testing, and in particular to a software system security testing quality evaluation method. Background Art

[0002] The data center is the core place that carries a company's core software and hardware platforms and main application systems, and is the main battlefield for the development of digital business. With the completion and operation of the data center and the deepening of digital transformation, the development needs of the data center "from site to position, from position to high ground" are urgent. It is urgent to strengthen the construction of related supporting facilities, enhance the software and hardware strength of the data center, drive the improvement of personnel skills, and better serve the company's business development.

[0003] In order to advance the intelligent inspection scenarios and drive the in-depth development of digitalization, combined with the actual needs of current development, five outstanding problems in production safety are solved: First, in accordance with the requirements of State Grid Corporation's information and innovation work, the problem of lack of testing and verification environment for the adaptation of information and innovation products is solved; second, in recent years, system maintenance and upgrades have become an increasing trend, and the problem of "running with illness" caused by various maintenance operations such as system version upgrades due to lack of internal testing and verification is solved; third, with the explosive growth of the company's resource demand in recent years, there is an urgent need to solve the hidden dangers of later operation caused by the lack of functional, performance, and configuration compliance testing of hardware and software equipment after the arrival of materials; fourth, the problem of insufficient skills of main business personnel, lack of equipment debugging experience and original factory repair capabilities is solved; fifth, with the accelerated progress of the company's old equipment, it is urgent to carry out the company's digital retired equipment appraisal work to improve resource utilization efficiency. Summary of the invention

[0004] The purpose of the present invention is to provide a software system security test quality evaluation method to address the problems existing in the prior art. This method can give an overall conclusion of the application software system security test and confirm the extent to which the application software system meets the corresponding security requirements.

[0005] The technical solution of the present invention is:

[0006] A software system security test quality evaluation method comprises the following steps:

[0007] S1 obtains the interface feature data set of the software system to be tested, and sets the test level to basic application software or enhanced application software according to the interface feature data set;

[0008] S2. Set the safety feature test items to be tested according to the level category;

[0009] S3. Carry out classified tests on security feature test items respectively, including security function test, penetration test and port test;

[0010] S4. According to the degree of impact of security defects on the software system to be tested, test items are defined as high-risk test items, medium-risk test items, and low-risk test items;

[0011] S5. Evaluate the test conclusions.

[0012] Specifically, the basic application software includes eleven security feature test items: identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, security vulnerabilities, external interfaces, and port management.

[0013] Specifically, the enhanced application software includes thirteen security feature test items: identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, security vulnerabilities, external interfaces, non-repudiation, resource control and port management.

[0014] Specifically, the identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, external interface, non-repudiation, and resource control are security function test items, the security vulnerability is a penetration test item, and the port management is a port test item.

[0015] The method for evaluating the test conclusion is as follows:

[0016] a) If all security function test items are "compliant", the penetration test result is "no obvious exploitable security vulnerabilities found", and the port test result is "no open high-risk ports and irrelevant ports found in the test environment", the overall conclusion of the security test is "compliant";

[0017] b) All high-risk and medium-risk test items of security functions are "compliant", and some low-risk test items are "partially compliant" or "non-compliant". The penetration test result is "no obvious exploitable security vulnerabilities found", and the port test result is "no open high-risk ports and irrelevant ports found in the test environment", then the overall conclusion of the security test is "basically compliant";

[0018] c) If there are "partial compliance" or "non-compliance" in the test items of high-risk or medium-risk security functions, or the penetration test result is "there are obvious exploitable security vulnerabilities", or the port test result is "high-risk ports and irrelevant ports are found to be open in the test environment", the overall conclusion of the security test is "non-compliance";

[0019] d) If a test item is not applicable in a specific application software system, the test item can be judged as "not applicable" and will not affect the overall test conclusion;

[0020] e) If the overall conclusion of the safety test is "compliant" or "basically compliant", the overall safety requirements are met.

[0021] The beneficial effects of the present invention are as follows: the method provided by the present invention can give an overall conclusion of the security test of the application software system, confirm the extent to which the application software system meets the corresponding security requirements, and can carry out information services such as testing, verification, simulation, simulation, and experiments related to information systems and hardware and software equipment throughout the province, solve the problem of "running with a disease" caused by the lack of internal testing and verification in various maintenance operations such as system version upgrades, solve the problem of hidden dangers in later operation caused by the lack of functional, performance, and configuration compliance testing of hardware and software equipment, and improve resource utilization efficiency. DETAILED DESCRIPTION

[0022] The technical solution of the present invention is described in detail below in conjunction with specific implementation methods.

[0023] A software system security test quality evaluation method comprises the following steps:

[0024] S1 obtains the interface feature data set of the software system to be tested, and sets the test level to basic application software or enhanced application software according to the interface feature data set;

[0025] S2. Set the safety feature test items to be tested according to the level category;

[0026] S3. Carry out classified tests on security feature test items respectively, including security function test, penetration test and port test;

[0027] S4. According to the degree of impact of security defects on the software system to be tested, test items are defined as high-risk test items, medium-risk test items, and low-risk test items;

[0028] S5. Evaluate the test conclusions.

[0029] The basic application software includes eleven security feature test items: identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, security vulnerability, external interface, and port management. Among them, the identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, external interface, and security function test items, the security vulnerability is a penetration test item, and the port management is a port test item.

[0030] The enhanced application software includes thirteen security feature test items: identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, security vulnerability, external interface, non-repudiation, resource control and port management, among which the identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, external interface, non-repudiation, resource control are security function test items, the security vulnerability is a penetration test item, and the port management is a port test item.

[0031] The method for evaluating the test conclusion is as follows:

[0032] a) If all security function test items are "compliant", the penetration test result is "no obvious exploitable security vulnerabilities found", and the port test result is "no open high-risk ports and irrelevant ports found in the test environment", the overall conclusion of the security test is "compliant";

[0033] b) All high-risk and medium-risk test items of security functions are "compliant", and some low-risk test items are "partially compliant" or "non-compliant". The penetration test result is "no obvious exploitable security vulnerabilities found", and the port test result is "no open high-risk ports and irrelevant ports found in the test environment", then the overall conclusion of the security test is "basically compliant";

[0034] c) If there are "partial compliance" or "non-compliance" in the test items of high-risk or medium-risk security functions, or the penetration test result is "there are obvious exploitable security vulnerabilities", or the port test result is "high-risk ports and irrelevant ports are found to be open in the test environment", the overall conclusion of the security test is "non-compliance";

[0035] d) If a test item is not applicable in a specific application software system, the test item can be judged as "not applicable" and will not affect the overall test conclusion;

[0036] e) If the overall conclusion of the safety test is "compliant" or "basically compliant", the overall safety requirements are met.

[0037] Example 1

[0038] This embodiment describes in detail the process of testing and evaluating basic application software.

[0039] Identity Authentication

[0040] The test methods for identification and authentication functions are as follows:

[0041] a Test requirements: Refer to the requirements of 6.1.1 in Q / GDW 10597-2022;

[0042] bTest type: safety function test;

[0043] cTest method:

[0044] a) Check whether the system identifies and authenticates the user. The test method is as follows:

[0045] 1) Check whether the system has an identity;

[0046] 2) Check whether the system's authentication process is completed on the server side.

[0047] b) Check the user list to confirm whether the user identity is unique and ensure that there are no users with duplicate identities;

[0048] c) Check whether the system has the function of checking the complexity of user authentication information. The test method is as follows:

[0049] 1) Try to set the password length to less than 8 characters to verify whether it can be set successfully;

[0050] 2) Try to set a password with less than three levels of complexity to verify whether the setting is successful;

[0051] 3) Try to set the password to be the same as the username or include the username, and test whether it can be set successfully.

[0052] d) Check whether the system has a time limit for the validity of the user password. The test method is as follows:

[0053] 1) Try to log in to the system with a user whose password has expired (has not been changed for 3 months) to verify whether the system forces the user to change the password;

[0054] 2) Try to set a new password that is the same as the previous password to verify whether it can be set successfully.

[0055] e) Check whether the system creates independent passwords for users that meet complexity requirements and whether it forces new users to change their initial passwords. The test method is as follows:

[0056] 1) Create a user account and verify whether the initial password generated by the system meets the complexity requirements;

[0057] 2) Create multiple different user accounts and verify whether the initial password generated by the system is randomly generated or set by the administrator:

[0058] 3) Use the new user to log in to the system for the first time and verify whether the system forces the new user to change the initial password.

[0059] f) Try to modify other users' passwords as a normal user to verify whether the modification is successful;

[0060] g) Check whether the one-time dynamic password used by the system meets the requirements. The test method is as follows:

[0061] 1) The user logs in to the system and checks the number of digits of the one-time dynamic password to verify whether it is 6 digits or more;

[0062] 2) After receiving the dynamic password, the user waits for 6 minutes and then enters the dynamic password to verify whether the dynamic password is still valid.

[0063] h) Check whether the graphic verification code used by the system meets the requirements. The test method is as follows:

[0064] 1) The user logs in to the system and refreshes the verification code multiple times to check whether the system verification code is randomly generated and interferes with or distorts it when displayed:

[0065] 2) Check the complexity of the verification code, whether it contains letters and numbers, and whether the length is at least 4 characters.

[0066] i) Attempt to perform sensitive operations (transactions, resetting user passwords, operations involving personal privacy information, etc.), and verify whether the system requires the user to enter the password again for a second identity authentication;

[0067] j) Check whether the system has a mechanism for handling consecutive login failures. The test method is as follows:

[0068] 1) Perform the operation of the user's continuous login failure. When the number of failures reaches the set value (should be within 1-10 times), verify whether the user is locked out:

[0069] 2) When the set lock time is reached (at least 20 minutes), verify whether the user can unlock automatically or be unlocked by an authorized administrator.

[0070] d) Result determination: If a)-j) in 5.1.1c) of this standard all meet the requirements of 6.1.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0071] Access Control

[0072] The test method for access control function is as follows:

[0073] a) Test items: Refer to the requirements of 6.2.1 in Q / GDW 10597-2022;

[0074] b) Test type: safety function test;

[0075] c) Test method:

[0076] a) Check whether the system creates users according to the real-name system principle. The test method is as follows:

[0077] 1) Check the user list and database user table to see if there are any anonymous accounts in the system;

[0078] 2) Use the administrator user to create an account and check whether the new account is forced to bind real-name information such as ID card.

[0079] b) Check whether the system has a default account. The test method is as follows:

[0080] 1) Check the user list to see if there are any default accounts (administrator, guest, admin, root, anonymous, etc.) in the system.

[0081] 2) Check the password of the system default account to see if it is the default password.

[0082] c) Check whether the system divides user accounts into long-term use accounts and temporary use accounts according to the user account usage cycle. The test method is as follows:

[0083] 1) Check the user list to see whether the system divides user accounts into long-term accounts and temporary accounts;

[0084] 2) Create a new user and verify whether the system forces the user to select an account type (long-term account or temporary account). 3) Check whether the system's temporary account has a validity period limit, use an expired temporary account to log in to the system, and verify whether the system can be successfully logged in.

[0085] d) Check whether the system can classify user accounts into activated accounts, dormant accounts and cancelled accounts according to the user account usage status. The test method is as follows: 1) Check the user list to check whether the system can classify user accounts into activated accounts, dormant accounts and cancelled accounts according to business needs;

[0086] 2) Use a dormant account or a cancelled account to log in to the system and verify whether you can log in successfully.

[0087] e) Check whether the system has an account scanning strategy. The test method is as follows:

[0088] 1) Check whether the system has an account scanning policy, log in to the system using an account that has not been used for 3 months or more, and verify whether the system can be successfully logged in;

[0089] 2) Check the system user management list to see if the accounts that have not been used for 3 months or more are dormant or locked.

[0090] f) Check whether the system has an access control policy. The test method is as follows:

[0091] 1) Check whether the system is configured with access control policies by authorized administrators;

[0092] 2) Use an authorized administrator account to configure access control policies and verify whether the subject's access rules to the object are effective.

[0093] g) Use unauthorized users to log into the system and check whether the unauthorized users have only the lowest level of permissions (such as the permission to modify their own information and limited query permissions);

[0094] h) Check the initial role settings of the system. The test method is as follows:

[0095] 1) Check the system's role list to see whether the system has set up independent system administrator roles, audit administrator roles, business configurator roles, and business operator roles;

[0096] 2) Try to modify the permissions of the system administrator role and audit administrator role to verify whether they can be changed.

[0097] i) Check the permission list corresponding to the system administrator role to check whether the role only has system management permissions such as user management, role management, permission management, system resource configuration, system loading and startup, system operation exception handling, data and equipment backup and recovery, etc.;

[0098] j) Check the permission list corresponding to the audit administrator role to check whether the role only has the permission to monitor the operation tracks of other users and manage, monitor and operate and maintain audit data;

[0099] k) Check the permission list corresponding to the business configurator role to check whether the role only has the permission to perform basic configurations such as business parameters, master data, and function items;

[0100] l) Check the permission list corresponding to the business operator role to check whether the role only has business operation permissions and does not have any management permissions;

[0101] m) Check whether the system sets business administrator roles and business auditor roles according to business characteristics, check whether the business administrator role only has the authority to manage business users, and whether the business auditor role only has the ability to monitor the operation tracks of business users and manage, monitor and operate and maintain business logs;

[0102] n) Try to assign the permissions of mutually exclusive services to the same service user to verify whether the assignment is successful;

[0103] o) Try to create a super administrator user (grant mutually exclusive roles to the same user, or grant mutually exclusive permissions to the same role) to verify whether the creation is successful;

[0104] p) Check whether the system can control user access to the system according to the access conditions. The test method is as follows:

[0105] 1) Check whether the system can perform access control on users logging into the system based on attributes such as access time and access client address;

[0106] 2) Try to set the time for the user to access the system. If the user does not access the system during the access time period, verify whether the user can successfully access the system;

[0107] 3) Try to set the client address for the user to access the system. The user accesses the system from a client address that is not allowed to access. Verify whether the user can successfully access the system.

[0108] d) Result determination: If a)-p) in 5.1.2c) of this standard all meet the requirements of 6.2.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0109] Security Audit The test method for the security audit function is as follows:

[0110] a) Test items: Refer to the requirements of 6.3.1 in Q / GDW 10597-2022;

[0111] b) Test type: safety function test;

[0112] c) Test method:

[0113] a) Check whether the system audits important user behaviors and security events. The test method is as follows:

[0114] 1) Check whether the system has security audit function and can cover the operations of each user;

[0115] 2) Perform system-level events such as adding, deleting, and modifying users and permissions, configuration customization, audit log maintenance, user login and logout, unauthorized access, password reset, data backup and recovery, and verify whether audit records clearly record such events;

[0116] 3) Perform business events such as addition, deletion, and modification of business data, interruption of transaction operations, and verify whether the audit records clearly record such events.

[0117] b) Check the security audit records of the system and check whether the system classifies audit event types, including but not limited to system-level events and business-level events;

[0118] c) Check the audit record content of the system. The test method is as follows:

[0119] 1) Check the content of the audit record and check whether the basic information in the audit record includes the date, time, event type, user identity, event description and event result of the event;

[0120] 2) Check whether the user identity includes the user name and IP address and has a unique identifier.

[0121] d) Check the audit records and whether the system has the function of querying and sorting the audit records;

[0122] e) Check whether the system has the function of abnormal event alarm. The test method is as follows:

[0123] 1) Check whether the system classifies abnormal events according to their severity;

[0124] 2) Try to manually trigger abnormal events (including but not limited to unauthorized access, login failure, IP abnormality, etc.) to verify whether the system issues an alarm for the abnormal event;

[0125] 3) Check whether the alarm method is an effective method such as pop-up window alarm, sound and light alarm, SMS notification, email notification, etc.

[0126] f) Check whether the system provides the function of regular backup of audit data;

[0127] g) Try to modify, delete, and overwrite audit records within 6 months to check whether the operations are successful.

[0128] d) Result determination: If a)-g) in 5.1.3c) of this standard all meet the requirements of 6.3.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0129] Data Integrity

[0130] The test method for data integrity function is as follows:

[0131] a) Test items: Refer to the requirements of 6.4.1 in Q / GDW 10597-2022;

[0132] b) Test type: safety function test;

[0133] c) Test method:

[0134] a) Use tools to intercept and tamper with data packets of important system data during transmission, and test and verify whether cryptographic technology is used to ensure the integrity of the data during transmission.

[0135] b) Check the integrity of the cryptographic technology used by the system during transmission and verify whether it is the cryptographic algorithm specified by the national cryptographic authority.

[0136] d) Result determination: If a)-b) in 5.1.4c) of this standard all meet the requirements of 6.4.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0137] Data confidentiality

[0138] The test method for data confidentiality function is as follows:

[0139] a) Test items: Refer to the requirements of 6.5.1 in Q / GDW 10597-2022;

[0140] b) Test type: safety function test;

[0141] c) Test method:

[0142] a) Use tools to check how important data is stored in the file system and database, and check whether cryptographic technology is used to ensure the confidentiality of its storage;

[0143] b) Use tools to view the data packets of important data in the system during transmission and check whether cryptographic technology is used to ensure confidentiality during transmission;

[0144] c) Check the confidentiality cryptographic technology used by the system during storage and transmission, and verify whether it is the cryptographic algorithm specified by the national cryptographic authority.

[0145] d) Result determination: If a)-b) in 5.1.5c) of this standard all meet the requirements of 6.5.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0146] Software fault tolerance

[0147] The test method of software fault tolerance function is as follows:

[0148] a) Test items: Refer to the requirements of 6.6.1 in Q / GDW 10597-2022;

[0149] b) Test type: safety function test;

[0150] c) Test method:

[0151] a) Check the data validity verification function of the system. The test method is as follows:

[0152] 1) Try to enter illegal data (such as a negative age) to verify whether the client verifies the validity of the data;

[0153] 2) Try to enter different types of data (numbers, letters, special characters, etc.) to verify whether the client verifies the validity of the data;

[0154] 3) Try to enter overlong data to verify whether the client verifies the validity of the data;

[0155] 4) When human-computer interaction data is submitted, tools are used to intercept and modify the data into illegal data, different types of data, and overlong data in turn to verify whether the server verifies the validity of the data;

[0156] 5) “Extra long data” should be customized according to the business characteristics of the system.

[0157] b) Perform system business operations and verify whether the data returned by the server contains information not related to the business.

[0158] d) Result determination: If a)-b) in 5.1.6c) of this standard all meet the requirements of 6.6.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0159] Personal Information Protection

[0160] Personal information protection:

[0161] a) Test items: Refer to the requirements of 6.7.1 in Q / GDW 10597-2022;

[0162] b) Test type: safety function test;

[0163] c) Test method:

[0164] a) Perform business operations of filling in personal information and check whether the user personal information collected by the system is necessary for the business;

[0165] b) When performing business operations of filling in personal information, whether the system informs the user of the purpose, method and scope of collecting and using personal information, and whether it is necessary to obtain the authorization and consent of the subject of personal information;

[0166] c) Try to access pages involving user personal information and check whether the system only allows authorized users to access user personal information;

[0167] d) Check the pages involving user personal information to check whether the system has de-identified the personal information. d) Result judgment: If a)-d) in 5.1.7c) of this standard all meet the requirements of 6.7.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0168] Session Management

[0169] The test method for session management function is as follows:

[0170] a) Test items: Refer to the requirements of 6.8.1 in Q / GDW 10597-2022;

[0171] b) Test type: safety function test;

[0172] c) Test method:

[0173] a) Check the system's session timeout mechanism. The test method is as follows:

[0174] 1) The user logs in to the system and stops activity for a set time, and checks whether the system can automatically end the session;

[0175] 2) Check whether the system's session timeout mechanism is limited to a valid range greater than 0 and less than or equal to 30 minutes.

[0176] b) Check the system's automatic session termination mechanism. The test method is as follows:

[0177] 1) After the user logs in, perform the logout / signout operation to verify whether the server can automatically end the session;

[0178] 2) After the user logs in, close the client directly to verify whether the server can automatically end the session.

[0179] c) Check that the system creates a new session after the user successfully logs in. The test method is as follows:

[0180] 1) Log in as a user and use tools to check whether the application software system saves session authentication information and session validity period on the server side;

[0181] 2) The user logs out of the system and verifies whether the server will clear the old session;

[0182] 3) Log in the user again and verify whether the system creates a new session and whether the session ID has certain randomness and length requirements.

[0183] d) Check whether the system has a maximum concurrent session limit. The test method is as follows:

[0184] 1) Check whether the system has a maximum concurrent connection session limit mechanism;

[0185] 2) Configure the maximum number of concurrent connection sessions in the system to verify whether the measure is effective;

[0186] 3) Check whether the system's maximum number of concurrent connection sessions is limited to a valid number greater than 0.

[0187] e) Use the same user to log in to multiple clients at the same time and check whether the login is successful.

[0188] d) Result determination: If a)-e) in 5.1.8c) of this standard all meet the requirements of 6.8.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0189] External Interface

[0190] The test method of external interface function is as follows:

[0191] a) Test items: Refer to the requirements of 6.9.1 in Q / GDW 10597-2022;

[0192] b) Test type: safety function test;

[0193] c) Test method:

[0194] a) Check the interface information table of the system under inspection through the database (or configuration file, etc.) to check whether the system uniquely identifies the system (or service) allowed to access (this identification can uniquely identify the accessed system or service);

[0195] b) Check whether the system authenticates the system (or service, etc.) requesting a connection;

[0196] c) Use tools to intercept and tamper with the authentication information and important business data of the system interacting with other systems, and verify whether cryptographic technology is used to achieve the integrity of data during transmission;

[0197] d) Use tools to view the authentication information and important business data of the system interacting with other systems, and verify whether cryptographic technology is used to achieve confidentiality of data during transmission.

[0198] d) Result determination: If a)-d) in 5.1.9c) of this standard all meet the requirements of 6.9.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0199] Port Management

[0200] The test method of external interface function is as follows:

[0201] a) Test items: Refer to the requirements of 6.10.1 in Q / GDW 10597-2022;

[0202] b) Test type: port test;

[0203] c) Test method:

[0204] a) Use tools to scan and view the port openness of the test environment where the system is located, and check whether the system has opened high-risk ports;

[0205] b) Check whether the system has opened service ports that are not related to the business;

[0206] c) Check whether the system service access ports are uniformly 80 / 443 (if these two ports are used, use 8080 and 8000 ports in sequence);

[0207] d) Check whether the management ports of the operating system, middleware, database, etc. used by the system are set based on the default port number plus 10000;

[0208] e) Check whether the data transmission port used by the system is set based on the default port number plus 20000.

[0209] d) Result determination: If a)-e) in 5.1.10c) of this standard all meet the requirements of 6.10.1 in Q / GDW 10597-2022, the conclusion of the application software system port test is "no open high-risk ports and irrelevant ports were found in the detection environment"; otherwise, the conclusion of the port test is "open high-risk ports and irrelevant ports were found in the detection environment".

[0210] Security Vulnerabilities

[0211] (1) The B / S architecture system testing method for security vulnerability functions is as follows:

[0212] a) Test items: Reference the requirements of 6.11.1.1 in Q / GDW 10597-2022;

[0213] b) Test type: penetration test;

[0214] c) Test method:

[0215] a) Log in as a user and use tools to try to allow him to access unauthorized functions or data, and test and verify whether the access is successful;

[0216] b) Use tools to capture data packets about user authentication information, check the relevant parameters submitted in the data packets, and test whether the authentication information is encrypted by the verification system;

[0217] c) Check whether the system has SQL injection vulnerabilities. The test method is as follows:

[0218] 1) Use SQL injection test statements to conduct preliminary tests on input parameters to verify whether the system has SQL injection vulnerabilities;

[0219] 2) Further construct SQL injection statements manually or using tools to further test and verify whether the system has SQL injection vulnerabilities.

[0220] d) Check whether the system has XSS cross-site scripting vulnerabilities. The test method is as follows:

[0221] 1) Find locations where XSS vulnerabilities may occur, such as website search boxes, information storage, etc.

[0222] 2) Perform injection tests on locations where XSS vulnerabilities may occur to test and verify whether the system has XSS vulnerabilities.

[0223] e) Check whether the system has any file upload vulnerability. The test method is as follows:

[0224] 1) Find the place in the system where you can upload files, upload the legal files required by the system, and make sure the upload point is available;

[0225] 2) Try to upload the vulnerability test script file and access this file to test whether it can be accessed successfully.

[0226] f) Check whether the system has background address leakage vulnerabilities. The test method is as follows:

[0227] 1) Try to add a commonly used backend address after the system access address, such as: admin, manager, user, login, console, etc., to test and verify whether the backend address can be spliced;

[0228] 2) Try to use the website backend address dictionary to perform large-scale brute force cracking of the website to test and verify whether the backend address can be cracked.

[0229] g) Check whether the system has sensitive information leakage vulnerabilities. The test method is as follows:

[0230] 1) Use tools to tamper with URL parameters in the system;

[0231] 2) Check whether the JS code returned by the system front end contains sensitive information, including but not limited to: website absolute path, SQL statements, middleware version, program exceptions, etc.

[0232] h) Check whether the system has command execution vulnerabilities. The test method is as follows:

[0233] 1) Modify the command value in the URL parameter and check whether the command can be executed;

[0234] 2) Use dedicated vulnerability detection tools to test and verify whether the system has middleware framework vulnerabilities.

[0235] i) Check whether the system has a directory traversal vulnerability. The test method is as follows:

[0236] 1) Use tools to crawl or brute force the system directory structure;

[0237] 2) Try to enter the website directory in the browser address bar to see if the files in the directory folder can be displayed.

[0238] j) Check whether the system has key session replay attacks. The test method is as follows:

[0239] 1) Use tools to capture system login request data packets;

[0240] 2) Use a user or password dictionary to start brute force cracking to verify whether it can be successfully cracked.

[0241] k) Check whether the system has CSRF (cross-site request forgery). The test method is as follows:

[0242] 1) Construct a CSRF PoC and save it in an HTML file;

[0243] 2) Access the HTML file link address on another test machine to test and verify whether the expected functions of the constructed HTML can be realized.

[0244] l) Check whether the system has any file inclusion / any file download vulnerability. The test method is as follows:

[0245] 1) Given the URL of a page in the system, change the value of its parameter to another file path;

[0246] 2) Test and verify whether the content of the modified file path can be obtained.

[0247] m) Check whether the system has design defects / logical errors and vulnerabilities. The test method is as follows:

[0248] 1) After the testers understand the business system, they refine various business scenarios and workflows;

[0249] 2) Try to design business logic tests to test and verify whether the system has design flaws / logical errors.

[0250] n) Check whether the system has XML entity injection vulnerabilities. The test method is as follows:

[0251] 1) Find the request with XML format in the system request;

[0252] 2) Insert the XML injection test code after <?xml version="1.0" encoding="ISO-8859-1"?>;

[0253] 3) Submit the constructed HTTP request to test and verify whether the system has XML entity injection vulnerability.

[0254] o) Check whether the system has irrelevant services and ports that are at risk. The test method is as follows:

[0255] 1) Use a port scanning tool to scan and view the system's open ports and services, and verify whether the system has opened irrelevant ports and services;

[0256] 2) Further detect the port openness and vulnerabilities in the system to verify whether the system has opened the published high-risk ports.

[0257] p) Check whether the system has login function and verification code vulnerabilities. The test method is as follows:

[0258] 1) Use tools to capture system login request data packets and obtain username and password parameters;

[0259] 2) Use the username or password dictionary to replace the corresponding username or password parameters in the login request session;

[0260] 3) Start to try to crack the username or password by brute force to verify whether the cracking is successful;

[0261] 4) Try to bypass the username or password and verify whether it can be cracked successfully.

[0262] q) Check whether there is any unsafe information in the system authentication information. The test method is as follows:

[0263] 1) Use the tool to intercept the Cookies information in the request data to check whether there is any unsafe Cookies information;

[0264] 2) For systems that use token authentication, use the token information of the request data intercepted by the tool to check whether there is any unsafe information.

[0265] r) Execute the SSL vulnerability detection script to detect whether the system has the vulnerability;

[0266] s) Check whether the system has SSRF vulnerabilities. The test method is as follows:

[0267] 1) Change the IP address information in the URL parameter part;

[0268] 2) Use a tool to check whether the server response status sh is the same before and after changing the IP address.

[0269] t) Check whether the system has default password / weak password vulnerabilities. The test method is as follows:

[0270] 1) Check whether the system password is a default password or a weak password;

[0271] 2) Check whether the system's middleware program uses the default password or a weak password.

[0272] u) Use the tool to try to change the HTTP request method to an unsafe request method, and test whether the submission can be successful.

[0273] d) Result determination: If the test items a)-u) of 5.1.11.(1) c) of this standard all meet the requirements of 6.11.1, the conclusion of the application software system penetration test is "no obvious exploitable security vulnerability was found". Otherwise, the conclusion of the penetration test is "obvious exploitable security vulnerability was found".

[0274] (2) The C / S architecture system testing method for security vulnerability functions is as follows:

[0275] a) Test items: Refer to the requirements of 6.11.2.1 in Q / GDW 10597-2022;

[0276] b) Test type: penetration test;

[0277] c) Test method:

[0278] a) Use tools to capture data packets about user authentication information, check the relevant parameters submitted in the data packets, and check whether the authentication information is encrypted;

[0279] b) Check whether the system has default passwords or weak passwords. The test method is as follows:

[0280] 1) Check whether the system password is a default password or a weak password;

[0281] 2) Check whether the services enabled by the system have default passwords or weak passwords.

[0282] c) Check whether the system has irrelevant services and ports that are at risk. The test method is as follows:

[0283] 1) Use a port scanning tool to scan and view the system's open ports and services, and verify whether the system has opened irrelevant ports and services;

[0284] 2) Further detect the port openness and vulnerabilities in the system to verify whether the system has opened the published high-risk ports.

[0285] d) Check whether the system has any abnormal client functions. The test method is as follows:

[0286] 1) Use the debugging tool to load the program and construct abnormal client input;

[0287] 2) Observe and verify whether the debugger can capture client exception events.

[0288] e) Check whether the system has any server-side functional abnormalities. The test method is as follows:

[0289] 1) Try to construct abnormal input on the server side;

[0290] 2) Check the server program running status and verify whether there are any server function anomalies in the verification system.

[0291] f) Check whether the system can use reverse analysis tools to open the target file, and test and verify whether the system performs legality verification on dynamically called executable files;

[0292] g) Check whether the system has sensitive information leakage vulnerabilities. The test method is as follows:

[0293] 1) Use reverse analysis tools to check whether there is any hard-coded account password in the data segment and code segment;

[0294] 2) Check configuration files and log files to see if there are any account passwords stored in plain text in the files; 3) Check log files to see if they leak key information such as development paths.

[0295] h) Try to access system functions or data without logging in to test and verify whether the system has unauthorized access vulnerabilities.

[0296] i) Check whether the system has key session replay attacks. The test method is as follows:

[0297] 1) Use tools to capture system login request data packets;

[0298] 2) Use the user or password dictionary to replace the corresponding user or password parameters in the login request session;

[0299] 3) Start to try brute force cracking and check whether the cracking is successful.

[0300] j) Check whether the system has a login authentication bypass vulnerability. The test method is as follows:

[0301] 1) Check whether the client can download the server's password file or save the password locally;

[0302] 2) Use reverse engineering tools to check whether the login process sends the account password to the server for verification;

[0303] 3) Try to bypass the login by using characters such as 'or'1'='1 and % to check whether the verification can successfully bypass the login.

[0304] k) Check whether the system has known vulnerabilities. The test method is as follows:

[0305] 1) Use vulnerability scanning tools to scan vulnerabilities on the target host;

[0306] 2) Check the scan results and manually determine whether there are any vulnerabilities in the system.

[0307] l) Find the location where the system downloads files, try to download the passwd file, and check whether the download is successful.

[0308] m) Check whether there are program anomalies in the system. The test method is as follows:

[0309] 1) Use reverse engineering tools to open the executable file and find where the system reads files, receives data packets, obtains environment variables, etc.;

[0310] 2) Analyze the program's processing of input data, paying special attention to important functions such as memcpy, strcpy, and strcat to see whether there are any restrictions on the data length or related fields;

[0311] 3) If the data contains pointers and other information, test whether the verification system determines its legitimacy;

[0312] 4) When the requested object contains a pointer, test and verify whether the system has released and exploited it.

[0313] n) Tamper with the SQL statements in the program and execute them to test and verify whether the system has SQL injection vulnerabilities;

[0314] o) Change the command parameter in the program to reboot and try to execute it to test whether it can be executed successfully.

[0315] d) Result determination: If the test items a)-0) of 5.1.11.(2)c) of this standard all meet the requirements in 6.11.2, the conclusion of the application software system penetration test is “no obvious exploitable security vulnerability was found”; otherwise, the conclusion of the penetration test is “an obvious exploitable security vulnerability was found”.

[0316] Example 2

[0317] This embodiment describes in detail the process of testing and evaluating enhanced application software.

[0318] Identification and identification

[0319] The test methods for identification and authentication functions are as follows:

[0320] a) Test items: Refer to the requirements of 7.1.1 in Q / GDW 10597-2022;

[0321] b) Test type: safety function test;

[0322] c) Test method: This test method includes all the contents of 5.1.1 of this standard, and adds the following test methods:

[0323] a) Use tools to intercept the login process data packets and replay them to verify whether the replay can be successful;

[0324] b) Check the authentication method of the application software system and check whether the system uses two or more combination of technologies such as passwords, cryptographic technology, biometric technology, etc. to achieve user identity authentication;

[0325] c) Perform sensitive operations such as transactions, use tools to view data packets when the server and client communicate, and check whether the system uses digital certificates and other methods to perform two-way authentication between the server and the client.

[0326] d) Result determination: If a)-c) in 5.2.1c) of this standard all meet the requirements of 7.1.1 in Q / GDW 10597-2022 and the requirements of 5.1.1 at the same time, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0327] Access Control

[0328] The test method for access control function is as follows:

[0329] a) Test items: Refer to the requirements of 7.2.1 in Q / GDW 10597-2022;

[0330] b) Test type: safety function test;

[0331] c) Test method: This test method includes all the contents of 5.1.2 of this standard, and adds the following requirements:

[0332] a) The application software system should set up an independent review administrator role, which can review and approve key operations of the system. Operations that have not been approved will not take effect (medium);

[0333] b) The application software system should have the function of setting sensitive labels for important information resources and strictly control the user's operations on information resources with sensitive labels according to security policies (low).

[0334] d) Result determination: If a)-b) in 5.2.2c) of this standard all meet the requirements of 7.2.1 in Q / GDW 10597-2022 and the requirements of 5.1.2 at the same time, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0335] Security Audit

[0336] The test method for the security audit function is as follows:

[0337] a) Test items: Refer to the requirements of 7.3.1 in Q / GDW 10597-2022;

[0338] b) Test type: safety function test;

[0339] c) Test method: This test method includes all the contents of 5.1.3 of this standard, and adds the following requirements:

[0340] a) Log in to the system as a user with audit privileges to check whether the system analyzes, compiles statistics and generates reports based on audit records, such as statistical analysis based on time period, account number, operation type and other dimensions;

[0341] b) Try to perform operations that interrupt the audit log to verify whether the application software system can interrupt the audit process alone.

[0342] d) Result determination: If a)-b) in 5.2.3c) of this standard all meet the requirements of 7.2.1 in Q / GDW 10597-2022 and the requirements of 5.1.3 at the same time, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0343] Data Integrity

[0344] The test method for data integrity function is as follows:

[0345] a) Test items: Refer to the requirements of 7.4.1 in Q / GDW 10597-2022;

[0346] b) Test type: safety function test;

[0347] c) Test method: This test method includes all the contents of 5.1.4 and adds the following test methods:

[0348] a) Use tools to check the storage method of important data in the file system and database to test and verify whether cryptographic technology is used to ensure the integrity of its storage;

[0349] b) Check the integrity of the cryptographic technology used by the system during transmission and verify whether it is the cryptographic algorithm specified by the national cryptographic authority; c) Use tools to destroy the integrity of the system's important data storage and verify whether the system can take necessary measures to ensure the integrity of the processed data when it detects this integrity error;

[0350] d) Use tools to destroy the integrity of important data transmission in the system, and verify whether the system protects the integrity of data transmission by retransmitting the correct data or alerting the user through pop-up windows when detecting this integrity error.

[0351] d) Result determination: If a)-d) in 5.2.4c) of this standard all meet the requirements of 7.4.1 in Q / GDW 10597-2022 and the requirements in 5.1.4, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0352] Data confidentiality

[0353] The test method for data confidentiality function is as follows:

[0354] a) Test items: refer to the requirements of 5.2.5 in Q / GDW 10597-2022;

[0355] b) Test type: safety function test;

[0356] c) Test method: This test method includes all the contents of 5.1.5 and adds the following test methods:

[0357] a) Check the cryptographic technology used by the system for confidentiality during storage and transmission, and verify whether it is the cryptographic algorithm specified by the national cryptographic authority.

[0358] b) Use tools to view the data packets of the application software system before the communicating parties establish a connection, and check whether the system uses secure communication protocols such as SSL / TLS (V1.2 and above) and IPSec to perform session initialization verification.

[0359] c) Use tools to intercept the data packets of both communicating parties and check whether the messages or conversations during the communication process are encrypted using secure communication protocols such as SSL / TLS (V1.2 and above) and IPSec.

[0360] d) Result determination: If a)-c) in 5.2.5c) of this standard all meet the requirements of 7.5.1 in Q / GDW 10597-2022 and the requirements in 5.1.5, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0361] Software fault tolerance

[0362] The test method of software fault tolerance function is as follows:

[0363] a) Test items: Refer to the requirements of 7.6.1 in Q / GDW 10597-2022;

[0364] b) Test type: safety function test;

[0365] c) Test method: This test method includes all the contents in 5.1.6c) of this standard;

[0366] d) Result determination: If 5.2.6c) of this standard meets the requirements of 7.6.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0367] Personal Information Protection

[0368] The testing method for personal information protection is as follows:

[0369] a) Test items: Refer to the requirements of 7.7.1 in Q / GDW 10597-2022;

[0370] b) Test type: safety function test;

[0371] c) Test method: This test method includes all the contents in 5.1.7c) of this standard;

[0372] d) Result determination: If 5.2.7c) of this standard meets the requirements of 7.7.1 of Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0373] Session Management

[0374] The test method for session management function is as follows:

[0375] a) Test items: Refer to the requirements of 7.8.1 in Q / GDW 10597-2022;

[0376] b) Test type: safety function test;

[0377] c) Test method: This test method includes all the contents in 5.1.8c) of this standard;

[0378] d) Result determination: If 5.2.8c) of this standard meets the requirements of 7.8.1 of Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0379] External Interface

[0380] The test method of external interface function is as follows:

[0381] a) Test items: Refer to the requirements of 7.9.1 in Q / GDW 10597-2022;

[0382] b) Test type: safety function test;

[0383] c) Test method: This test method includes all the contents in 5.1.9c) of this standard, and adds the following test methods;

[0384] a) Use tools to replay the interface data of the system interacting with other systems (or services, etc.) to verify whether it can be replayed successfully;

[0385] b) Check the data packets when the tool system communicates with other systems (or services, etc.) to see whether the messages in the communication process are encrypted using secure communication protocols such as SSL / TLS (V1.2 and above) and IPSec.

[0386] d) Result determination: If a)-b) in 5.2.9 all meet the requirements in 7.9.1 and the requirements in 5.1.9 at the same time, the application software system meets the test requirements of this unit; otherwise, it does not meet or partially meets the test requirements of this unit.

[0387] Non-Repudiation

[0388] The test method for the non-repudiation function is as follows:

[0389] a) Test items: Refer to the requirements of 7.10.1 in Q / GDW 10597-2022;

[0390] b) Test type: safety function test;

[0391] c) Test method: Execute key system operations (such as electronic transactions, etc.) to verify whether the system uses digital signature technology to provide data origin proof for the originator or receiver of the data, ensuring that the originator of the information cannot deny the information that has been sent.

[0392] d) Result determination: If 5.2.10c) of this standard meets the requirements of 7.10.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0393] Resource Control

[0394] The resource control function is tested as follows:

[0395] a) Test items: Refer to the requirements of 7.11.1 in Q / GDW 10597-2022;

[0396] b) Test type: safety function test;

[0397] c) Test method:

[0398] a) Check whether the system has the function of real-time detection of system service level (CPU, memory, etc.), try to reduce the system service level to the pre-defined threshold, and test and verify whether an alarm is triggered;

[0399] b) Check whether the system has the function of setting service or user priority, try to reduce the service level of the system, and test and verify whether the system can allocate system resources to users or processes according to the set priority. ;

[0400] d) Result determination: If 5.2.11c) of this standard meets the requirements of 7.11.1 in Q / GDW 10597-2022, the application software system meets the test requirements of this unit; otherwise, the application software system does not meet or partially meets the test requirements of this unit.

[0401] Port Management

[0402] The test method of the port management function is as follows:

[0403] a) Test items: Refer to the requirements of 7.12.1 in Q / GDW 10597-2022;

[0404] b) Test type: port test;

[0405] c) Test method: This test method includes all the contents in 5.1.10.

[0406] d) Result determination: If 1)-2) in 5.2.12c) of this standard all meet the requirements of 7.12.1 in Q / GDW 10597-2022, the conclusion of the application software system port test is "no open high-risk ports and irrelevant ports were found in the detection environment"; otherwise, the conclusion of the port test is "open high-risk ports and irrelevant ports were found in the detection environment".

[0407] Security Vulnerabilities

[0408] (1) The B / S architecture testing method for security vulnerability functions is as follows:

[0409] a) Test items: Refer to the requirements of 7.13.1.1 in Q / GDW 10597-2022;

[0410] b) Test type: penetration test;

[0411] c) Test method: This test method includes all the contents in 5.1.11.(1).

[0412] d) Result determination: If 5.2.13.(1)c) of this standard meets the requirements of 7.13.1.1 of Q / GDW 10597-2022, the conclusion of the application software system penetration test is "no obvious exploitable security vulnerabilities were found". Otherwise, the conclusion of the penetration test is "obvious exploitable security vulnerabilities were found".

[0413] (2) The C / S architecture testing method for security vulnerability functions is as follows:

[0414] a) Test items: Refer to the requirements of 7.13.2.1 in Q / GDW 10597-2022;

[0415] b) Test type: penetration test;

[0416] c) Test method: This test method includes all the contents in 5.1.11.(2).

[0417] d) Result determination: If 5.2.13.(2)c) of this standard meets the requirements of 7.13.2.1 of Q / GDW 10597-2022, the conclusion of the application software system penetration test is "no obvious exploitable security vulnerability was found". Otherwise, the conclusion of the penetration test is "obvious exploitable security vulnerability was found".

[0418] The evaluation method describes the method by which the tester performs tests on test items of different test types according to the test method, generates various test evidences, and then determines whether the application software system meets the security requirements based on these test evidences. After the evaluation is completed, the overall conclusion of the application software system security test should be given in the security test report to confirm the extent to which the application software system meets the corresponding security requirements.

[0419] Safety precautions: Before starting work, all participants should be briefed on safety technology. All personnel should strictly abide by the "Safety Regulations" and relevant regulations of the State Grid Corporation of China, and pay attention to personal safety and equipment safety when working. If the system under test does not need the network, the network should be disconnected. Before conducting system testing, the client is required to check and kill computer viruses and Trojans in the software deployment environment to ensure that the software system under test runs in a safe and non-toxic environment. If the test requires an external mobile device, computer viruses and Trojans should also be checked and killed to ensure that the mobile device is safe and non-toxic. Test environment: Simulate the user's real environment. Do not install other software unrelated to the system under test in the test environment. The test environment is independent of other network environments. The test environment is separated from the formal operating environment of the system under test. During the test, personnel abide by the relevant management regulations of the computer room, laboratory, etc., pay attention to the protection of the working environment and occupational health and safety, do not randomly discard office garbage, do not smoke, do not violate regulations, and save water, electricity and other office supplies.

[0420] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present invention, which should be included in the scope of the technical solution for protection of the present invention.

Claims

1. A software system security test quality evaluation method, characterized in that: The steps include: S1 obtains the interface feature data set of the software system to be tested, and sets the test level to basic application software or enhanced application software according to the interface feature data set; S2. Set the safety feature test items to be tested according to the level category; S3. Carry out classified tests on security feature test items respectively, including security function test, penetration test and port test; S4. According to the degree of impact of security defects on the software system to be tested, test items are defined as high-risk test items, medium-risk test items, and low-risk test items; S5. Evaluate the test conclusions.

2. The software system security test quality evaluation method according to claim 1 is characterized in that: The basic application software includes eleven security feature test items: identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, security vulnerabilities, external interfaces, and port management.

3. The software system security test quality evaluation method according to claim 1 is characterized in that: The enhanced application software includes thirteen security feature test items: identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, security vulnerabilities, external interfaces, non-repudiation, resource control and port management.

4. The software system security test quality evaluation method according to claim 2 or 3 is characterized in that: The identity authentication, access control, security audit, data integrity, data confidentiality, software fault tolerance, personal information protection, session management, external interface, non-repudiation, and resource control are security function test items, the security vulnerability is a penetration test item, and the port management is a port test item.

5. The software system security test quality evaluation method according to claim 1 is characterized in that: The method for evaluating the test conclusion is as follows: a) If all security function test items are "compliant", the penetration test result is "no obvious exploitable security vulnerabilities found", and the port test result is "no open high-risk ports and irrelevant ports found in the test environment", the overall conclusion of the security test is "compliant"; b) All high-risk and medium-risk test items of security functions are "compliant", and some low-risk test items are "partially compliant" or "non-compliant". The penetration test result is "no obvious exploitable security vulnerabilities found", and the port test result is "no open high-risk ports and irrelevant ports found in the test environment", then the overall conclusion of the security test is "basically compliant"; c) If there are "partial compliance" or "non-compliance" in the test items of high-risk or medium-risk security functions, or the penetration test result is "obvious exploitable security vulnerabilities exist", or the port test result is "high-risk ports and irrelevant ports are found to be open in the test environment", the overall conclusion of the security test is "non-compliance"; d) If a test item is not applicable in a specific application software system, the test item can be judged as "not applicable", which does not affect the overall test conclusion; e) If the overall conclusion of the safety test is "compliant" or "basically compliant", the overall safety requirements are met.