Network and data security test system, method and equipment and readable storage medium

Abstract

The invention relates to the technical field of vehicle network transmission, and provides a network and data security test system, method and device and a readable storage medium, the system comprises an operation management subsystem used for maintaining operation test resources, the operation test resources comprising operation test standards, operation test tools, operation test cases and operation test schemes; the user management subsystem is used for downloading operation test resources and generating and maintaining user test resources based on the operation test resources, and the user test resources comprise user test standards, user test tools, user test cases and user test schemes; and the test terminal subsystem is used for calling the user test resources, performing a connection test with the test object, and automatically generating a test report according to a preset template. According to the technical scheme provided by one or more embodiments of the invention, the test efficiency of the intelligent network connection automobile information security test can be improved, and the security of vehicle network transmission is ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of vehicle network transmission technology, and in particular to a network and data security testing system, method, device and readable storage medium. Background Art

[0002] As a series of safety issues have emerged in the rapid development of automobiles, relevant organizations or units in the automobile industry have issued a series of safety standards and safety specifications to promote the healthy development of the automobile industry. Among them, Internet of Vehicles information security is a focus of attention in the field of vehicle safety. Through Internet of Vehicles information security testing, it is possible to verify whether the network security indicators and data security indicators of the car meet the specified safety standards.

[0003] However, information security testing of smart connected vehicles is a relatively new business segment for OEMs of smart connected vehicles. Due to the lack of professional talents and dedicated testing tools, most OEMs’ information security testing work currently needs to be delegated to information security testing companies.

[0004] The information security testing process of information security testing companies mainly uses distributed testing tools, which generally requires multiple professional engineers to collaborate to complete the testing of a vehicle project, which can easily lead to long testing cycles and low testing efficiency. Summary of the invention

[0005] In view of this, one or more embodiments of the present disclosure provide a network and data security testing system, method, device and readable storage medium, which can improve the testing efficiency of information security testing of intelligent connected vehicles and ensure the security of vehicle network transmission.

[0006] In a first aspect, the present disclosure provides a network and data security testing system, the system comprising: an operation management subsystem, a user management subsystem and a test terminal subsystem; wherein the operation management subsystem is used to maintain operation test resources, the operation test resources include operation test standards, operation test tools, operation test cases and operation test plans, the operation test cases include test purposes, test conditions, test steps, expected conditions and judgment conditions, and the operation test plans include test pieces, test types, plan standards and plan cases; the user management subsystem is used to download the operation test resources, and based on the operation test resources, generate and maintain user test resources, the user test resources include user test standards, user test tools, user test cases and user test plans; the test terminal subsystem is used to call the user test resources, perform connection tests with the test objects, and automatically generate test reports according to preset templates.

[0007] Optionally, the operation management subsystem includes an operation resource management module, an operation plan management module, an operation publishing module and an operation member management module; wherein the operation resource management module is used to manage the operation test standards, the operation test cases and the operation test tools; the operation plan management module is used to manage the operation test plan; the operation publishing module is used to publish the operation test plan; the operation member management module is used to manage the resource download permissions of the user management subsystem.

[0008] Optionally, the user management subsystem is further configured to receive a resource creation instruction, and generate and maintain the user test resource according to the resource creation instruction.

[0009] Optionally, the user management subsystem includes a user resource management module, a user scheme management module and a user role management module; wherein the user resource management module is used to manage the user testing standards, the user testing tools and the user testing cases; the user scheme management module is used to manage the user testing schemes; and the user role management module is used to set test roles and assign resource calling permissions to the test roles.

[0010] Optionally, the test terminal subsystem includes a test terminal platform and a test terminal device; the test terminal platform is used to identify the test role of the login person and provide the login person with test permissions matching the test role, so that the login person can call the user test resources according to the test permissions; the test terminal device is used to utilize the user test resources to perform a connection test with the test object, and automatically generate the test report according to the preset template.

[0011] Optionally, the test terminal device includes at least one of the following attributes: supporting multiple operating systems; supporting disassembly and use in the form of an independent module; supporting remote control; supporting a graphical display interface and at least one input device.

[0012] In a second aspect, the present disclosure provides a network and data security testing method, the method comprising: downloading operation test resources, and generating and maintaining user test resources based on the operation test resources; in response to a call request of a test terminal subsystem, sending the user test resources to the test terminal subsystem, so that the test terminal subsystem uses the user test resources to perform a connection test with a test object, and automatically generates a test report based on a preset template; wherein the operation test resources are maintained by an operation management subsystem, the operation test resources include operation test standards, operation test tools, operation test cases and operation test plans, the operation test cases include test purposes, test conditions, test steps, expected conditions and judgment conditions, the operation test plans include test pieces, test types, plan standards and plan cases, and the user test resources include user test standards, user test tools, user test cases and user test plans.

[0013] In a third aspect, the present disclosure provides a network and data security testing method, the method comprising: sending a call request to a user management subsystem, and receiving user testing resources fed back by the user management subsystem; using the user testing resources to perform a connection test with a test object, and automatically generating a test report based on a preset template; wherein the user testing resources are generated by the user management subsystem according to the operation testing resources issued by the operation management subsystem, the operation testing resources include operation testing standards, operation testing tools, operation testing cases and operation testing plans, the operation testing cases include test purposes, test conditions, test steps, expected conditions and judgment conditions, the operation testing plans include test pieces, test types, plan standards and plan cases, and the user testing resources include user testing standards, user testing tools, user testing cases and user testing plans.

[0014] In a fourth aspect, the present disclosure provides an electronic device, comprising a memory and a processor, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the network and data security testing method provided in the second aspect or the third aspect is implemented.

[0015] In a fifth aspect, the present disclosure provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed by a processor, it implements the network and data security testing method provided in the second aspect or the third aspect.

[0016] The technical solution provided by one or more embodiments of the present invention can create and maintain operation test plans, operation test standards, operation test tools, operation test cases, and other operation test resources that can serve different users through the operation management subsystem, thereby integrating a large number of test tools and test cases for information security testing, and flexibly expanding and updating these operation test resources.

[0017] The technical solution provided by one or more embodiments of the present disclosure can download required operation test plans, operation test standards, operation test tools, operation test cases and other operation test resources from the operation management subsystem through the user management subsystem. On this basis, the user management subsystem can generate and maintain user test plans, user test standards, user test tools, user test cases and other user test resources that serve a specific user, so as to efficiently manage local user test resources and set user-specific test projects and test tasks.

[0018] The technical solution provided by one or more embodiments of the present disclosure can call user testing resources such as user testing plans, user testing standards, user testing tools, user testing cases, etc. maintained by the user management subsystem through the test terminal subsystem, so that after connecting with the test object, the test task can be carried out conveniently and the test report can be automatically generated.

[0019] The technical solution provided by one or more embodiments of the present disclosure, through the joint use of the operation management subsystem, the user management subsystem and the test terminal subsystem, enables the information security testing process to be transformed from relying on the personal experience of the technicians to relying on the test platform, thereby improving the reliability and convenience of the information security testing work. On the one hand, the management process that can be established in different subsystems not only simplifies the user operation process, but also ensures the repeatability of the testing work. On the other hand, the test terminal subsystem can automatically carry out the test and generate the test report, which not only improves the test efficiency, but also improves the accuracy of the test report. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The features and advantages of the embodiments of the present disclosure may be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present disclosure in any way. In the accompanying drawings: Figure 1 A schematic diagram of the system structure of a network and data security testing system in one embodiment of the present disclosure is shown; Figure 2 A schematic diagram of the platform structure of a network and data security testing system in one embodiment of the present disclosure is shown; Figure 3 A schematic diagram showing the steps of a network and data security testing method in one embodiment of the present disclosure is shown; Figure 4 A schematic diagram showing the steps of another network and data security testing method in one embodiment of the present disclosure is shown; Figure 5 A schematic structural diagram of an electronic device in one embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0022] In related technologies, when testing companies conduct information security testing of intelligent connected vehicles, they rely heavily on professionals. After the loss of talent in a certain testing direction, it is difficult for other personnel to quickly and effectively replace them. Testing companies usually lack efficient project management processes, which makes each testing direction test on its own and lacks coordination. Therefore, it is difficult for the vulnerabilities detected by the testing company to be synchronized with the OEM for vulnerability repair in a timely manner. In addition, the test reports generated by the testing company generally need to be manually edited, and it is difficult to ensure accuracy and timeliness.

[0023] In the related technologies, smart car OEMs also have the need to build their own Internet of Vehicles information security testing capabilities. However, the self-building process usually has the following problems: lack of professional technical personnel, making it difficult to get started with complex testing tools and testing processes in a short period of time; lack of professional testing tools, facing a variety of smart connected car information security testing tools, it is difficult to choose testing tools suitable for the actual conditions of the OEM; lack of strict planning and control of information security testing projects, and high dependence on operators; low degree of automation in the testing process, test reports need to be manually written by testers, and cannot be automatically generated and exported.

[0024] In the related technologies, some integrated testing tools have the following problems: the types and number of integrated tools are small, and they cannot support the hardware testing, firmware testing, in-vehicle network testing, radio testing and cloud platform testing of intelligent connected vehicles at the same time; the test cases are limited and cannot cover the testing requirements of current domestic and international regulations and standards; the testing tools and test cases are relatively fixed and cannot be updated subsequently, or the update method is complicated.

[0025] In view of this, the network and data security testing system provided by the embodiments of the present disclosure can improve the testing efficiency of information security testing of intelligent connected vehicles and ensure the security of vehicle network transmission.

[0026] See also Figure 1 A network and data security testing system provided by an embodiment of the present disclosure may include: an operation management subsystem 100, a user management subsystem 200 and a test terminal subsystem 300.

[0027] In this embodiment, the operation management subsystem 100 is used to maintain operation test resources. Operation test resources may include operation test standards, operation test tools, operation test cases, and operation test plans. Operation test cases may include test objectives, test conditions, test steps, expected conditions, and judgment conditions. Operation test plans may include test pieces, test types, plan standards, and plan cases.

[0028] In this embodiment, the user management subsystem 200 is used to download operational test resources and generate and maintain user test resources based on the operational test resources. The user test resources may include user test standards, user test tools, user test cases and user test solutions.

[0029] In this embodiment, the test terminal subsystem 300 is used to call user test resources and perform connection test with the test object. According to the preset template, the test terminal subsystem 300 can automatically generate a test report.

[0030] Specifically, the operation management subsystem 100 and the user management subsystem 200 can be deployed on the same server or separately. The operation management subsystem 100 and the user management subsystem 200 can together form an information security management platform. The operation management subsystem 100 mainly manages the operation test resources serving different users. The user management subsystem 200 mainly manages the user test resources serving a specific user. The user management subsystem 200 can also manage user-specific test projects and test tasks.

[0031] The test terminal subsystem 300 is a terminal for performing test operations, and may include a test terminal platform and a test terminal device. The test terminal platform is managed and operated by the tester after logging in to the terminal, and the test terminal device may be equipped with hardware test tools to support the test.

[0032] After connecting with the test object, the test terminal subsystem 300 can conveniently carry out the test task and automatically generate the test report. The template for generating the test report is predefined and can be defined by the user according to actual needs. The generated test report can be in one or more file formats such as txt, word, pdf, html, etc.

[0033] It is worth noting that the operation management subsystem 100 can send operation test resources to the user management subsystem 200, and the user management subsystem 200 can interact with the test terminal subsystem 300. However, the operation management subsystem 100 cannot view the localized data of the user management subsystem 200 and the test terminal subsystem 300. The operation management subsystem 100 also cannot view the test report generated by the test terminal subsystem 300. In this way, the privacy of each user's test data can be guaranteed.

[0034] In some implementations, the operation management subsystem 100 may include an operation resource management module 101 , an operation plan management module 102 , an operation publishing module 103 , and an operation member management module 104 .

[0035] The operation resource management module 101 can be used to manage the operation test standards, operation test cases and operation test tools. The operation plan management module 102 can be used to manage the operation test plan. The operation publishing module 103 can be used to publish the operation test plan. The operation member management module 104 can be used to manage the resource download authority of the user management subsystem 200.

[0036] In some implementations, the operation resource management module 101 can be used to display, add or delete operation test standards. The operation resource management module 101 can be used to display, add or delete operation test cases. The operation resource management module 101 can manage not only the first target test tool installed in the operation management subsystem 100, but also the second target test tool linked to the operation management subsystem 100.

[0037] Specifically, the operation resource management module 101 can manage an operation test standard library, an operation test case library, and an operation test tool library.

[0038] The operation test standard library can display various test standards or test specifications related to the Internet of Vehicles information security test, including but not limited to the standard (specification) name, standard (specification) number, standard (specification) text, standard (specification) issuing unit, standard (specification) issuing time, etc. For the operation test standard library, the operation resource management module 101 can add or delete operation test standards. For example, upload newly issued industry test standards or enterprise test standards. Through the operation resource management module 101, users can view the operation test standards to determine the test basis, and can view the operation test cases and operation test tools to plan the corresponding test projects and test tasks.

[0039] The operation test case library can display various test cases related to the Internet of Vehicles information security test, and the test cases can guide the execution of actual testing work. The test case can include basic information such as the test purpose, test conditions, test steps, expected conditions and judgment conditions, and can also include supplementary information such as the expected working hours, difficulty level, importance, required input and detection requirements. Some test cases can contain test scripts, which can automatically execute the test with one click. The test steps can list the test tools involved in all test operations. The "test tool" listed in the test steps can jump directly to the detailed introduction of the test tool (i.e., the tool library module) in the form of a link. Different test cases in the test case library can be distinguished by the "case name". The "case name" can support the addition of aliases to facilitate personalized understanding by different testers in different companies. For the operation test case library, the operation resource management module 101 can customize the addition or deletion of operation test cases.

[0040] The operation test tool library can contain various test tools required for Internet of Vehicles information security testing. Smaller test tools can be installed directly in the operation management subsystem 100, and larger test tools can be installed outside the operation management subsystem 100 and introduced into the test tool library of the operation management subsystem 100 in the form of a link, so as to achieve unified management of all types of test tools. Test tools can be classified and managed according to the test objects they are facing. Test tools can include hardware test tool sets, firmware test tool sets, in-vehicle network test tool sets, mobile application tool sets, radio test tool sets, cloud platform test tool sets, and code test tool sets. The types of test tools support custom editing. The test tools are introduced in detail, including tool name, version number, tool description, installation method, interaction type, initialization script, startup script, operation manual, etc. The operation manual can list the main operating instructions and command lines of the corresponding test tools in detail, so that testers can get started quickly.

[0041] It should be noted that the test toolset can have built-in large language models and visual models, can support AI security testing, and can continuously optimize and improve test performance through the operation management subsystem 100.

[0042] In some implementations, the operation solution management module 102 may be used to adjust at least one of a test piece, a test type, a solution standard, and a solution use case.

[0043] Specifically, the test plan can be managed in two dimensions. First, it is necessary to follow the specified test standard (i.e., the plan standard) and formulate a set of test plans for the test standard, so that the tester can determine whether the information security of the test object meets the test standard; second, it is necessary to select the component to be tested as the specific test object and formulate the test plan required for the component to be tested, so that the tester can perform single-piece testing.

[0044] The test plan may include information such as test pieces, test types, plan standards, and plan use cases. The test plan can support addition and modification. The "test pieces" in the test plan can be selected by jumping to the test piece library of the operation plan management module 102 in the form of a drop-down enumeration. The "test type" in the test plan can be selected by jumping to the test type library of the operation plan management module 102 in the form of a drop-down enumeration. The "plan standard" in the test plan can be selected by jumping to the operation test standard library of the operation resource management module 101 in the form of a link. The "plan use case" in the test plan can be selected by jumping to the operation test case library of the operation resource management module 101 in the form of a link.

[0045] It should be noted that the management mode of the test piece library and the test type library can be dictionary management. The test piece and the test type can be set with a common test piece name and test type name, or the tester can set a personalized name according to the company name.

[0046] In some implementations, the operation release module 103 can implement the release management of the operation test plan, that is, to perform release processing for the available operation test plans in the operation plan management module 102. The operation test plan can be seen in the user management subsystem 200 after release. The operation release module 103 can also cancel the release of the operation test plan that has been put on the shelves. The same operation test plan can be released in multiple versions, that is, the same operation test plan can be released again after updating. When releasing again, the new version of the operation test plan can be released in full, and the old version of the operation test plan released previously still exists.

[0047] In some implementations, the operation member management module 104 may include modules such as member display, member registration review, and member resource distribution. The operation member management module 104 is mainly used to manage the membership of the user management subsystem 200. In response to an application from a user management subsystem 200 with a membership, the operation member management module 104 may distribute operation test resources such as operation test standards, operation test tools, operation test cases, and operation test plans to the user management subsystem 200.

[0048] The member display module can display all member accounts recorded in the operation management subsystem 100, which can be company member accounts or individual member accounts. Through the all member display module, the resource download authority of a specific member can be directly adjusted.

[0049] The member registration review module can display all member application information, including those that have been approved and those that are pending approval. The member registration review module can approve or reject member applications.

[0050] The member resource delivery module can display the application status of all members for operation test resources, and can display application information such as member name, application resource name, application resource version number, application time, and review operation. The member resource delivery module can approve or reject the application of a user management subsystem 200 corresponding to a member for an operation test plan, and approve or reject the application of the user management subsystem 200 for resources such as operation test standards, operation test tools, and operation test cases involved in the operation test plan.

[0051] In some implementations, the user management subsystem 200 is further configured to receive resource creation instructions, and generate and maintain user test resources according to the resource creation instructions.

[0052] Specifically, the user management subsystem 200 can create some user test resources locally by the user. The user test resources created locally by the user can be more in line with the user's characteristics, ensuring the flexibility and adaptability of the user test resources. In addition, the user test resources created locally by the user will not be known by the operation management subsystem 100, ensuring user privacy and data security.

[0053] It is worth noting that the resource creation instruction can be either an edit for the user's locally uploaded data or a personalized edit for the downloaded operational test resources.

[0054] In some implementations, the user management subsystem 200 may include a user resource management module 201 , a user scheme management module 202 , and a user role management module 203 .

[0055] The user resource management module 201 can be used to manage user test standards, user test tools and user test cases. The user scheme management module 202 can be used to manage user test schemes. The user role management module 203 can be used to set test roles and assign resource call permissions to test roles.

[0056] Specifically, the user management subsystem 200 is a management platform for a specific test unit (such as a test company, a host factory), which can realize the test resource management, test project management and test personnel management of the unit. The user management subsystem 200 can download the operation test resources from the operation management subsystem 100 to form local user test resources. The user management subsystem 200 can also add local user test resources according to its actual needs.

[0057] The user resource management module 201 can manage a user test standard library, a user test case library, and a user test tool library, which is similar to the function of the operation resource management module 101 in the operation management subsystem 100 .

[0058] The user resource management module 201 can display all user test standards in the user test standard library of the unit. The user resource management module 201 can apply for operation test standards from the operation management subsystem 100 (for example, after checking the operation test standards to be applied, apply to the operation management subsystem 100 in a unified manner), and save them locally to the user test standard library. The user resource management module 201 can also receive test standards uploaded by users and save them to the user test standard library.

[0059] The user resource management module 201 can display all user test cases in the user test case library of the unit. The user resource management module 201 can apply for operation test cases from the operation management subsystem 100 (for example, after checking the operation test cases you want to apply for, apply to the operation management subsystem 100 in a unified manner), and save them locally to the user test case library. The user resource management module 201 can also receive test cases uploaded by users and save them to the user test case library.

[0060] The user resource management module 201 can display all user testing tools in the user testing tool library of the unit. The user resource management module 201 can apply for operation testing tools from the operation management subsystem 100 (for example, after checking the operation testing tools you want to apply for, apply to the operation management subsystem 100 in a unified manner), and save them locally to the user testing tool library. The user resource management module 201 can also receive test tools uploaded by users and save them to the user testing tool library.

[0061] The user program management module 202 can manage all local user test programs, including those obtained from the operation management subsystem 100 and those uploaded by users. The DUT information and test type information involved in the user test program can also be obtained from the operation management subsystem 100 or uploaded by users.

[0062] It should be noted that the DUT information and test type information are two key dictionaries for managing user test plans. When customizing user test plans, it is especially necessary to define these two dictionaries first.

[0063] The user role management module 203 can realize the role and authority setting of all test-related personnel in the unit. User roles can include backend administrators, project leaders, test managers, and testers. Adding and deleting test roles and changing the authority of test roles can all be realized through the user role management module 203.

[0064] In some implementations, the test terminal subsystem 300 may include a test terminal platform 301 and a test terminal device 302 .

[0065] The test terminal platform 301 can be used to identify the test role of the login personnel and provide the login personnel with test permissions that match the test role, so that the login personnel can call user test resources such as user test standards, user test tools, user test cases, and user test plans according to the test permissions. The test terminal device 302 can use the user test resources to perform connection tests with the test object and automatically generate test reports based on preset templates.

[0066] Specifically, the test terminal platform 301 can be operated by the user after logging in on the test terminal device 302. The test terminal device 302 can be equipped with hardware testing tools that support test projects. The test terminal platform 301 can be adapted to different types of computer operating systems, including but not limited to Linux, Kali, and Windows. The test roles that can log in to the test terminal platform 301 include project leaders, test managers, and testers. Each test role can have different operating permissions. The test terminal platform 301 can merge or split the test permissions of different test roles.

[0067] In an actual application example, when the test role of the logged-in person is the project leader, the test permissions provided by the test terminal platform 301 may include the first workbench permission, the first project management permission, the first task management permission, the first resource management permission, and the first solution management permission. The first workbench permission allows you to have an overview of the test projects, testers, test tasks, and test results. The first project management permission allows you to create or modify test projects (including a variety of test tasks, such as use case writing tasks, use case execution tasks, and result submission tasks). The first task management permission allows you to approve test tasks. The first resource management permission allows you to call user test standards and user test cases, and install or execute user test tools. The first solution management permission allows you to download or edit user test solutions.

[0068] Specifically, the project leader can create a new test project and assign a test manager to the test project. The operation interface of the project leader can include modules such as workbench, project management, task management, terminal resource management, and terminal solution management.

[0069] The workbench module for project managers is similar to a dashboard, which provides an overview of all test projects, testers involved in different test projects, approval of test tasks, test execution results and other information.

[0070] The project management module for project leaders can display all test projects related to the project leader and can complete, close, delete and perform other operations on the test projects.

[0071] The task management module for project leaders can display the approval flow of all test tasks in the test projects created by project leaders (for example, assigning testers, test case writing approval, test case modification approval, test execution result approval, etc.), making it easier to discover blockages in project execution and promote problem solving in a timely manner.

[0072] The terminal resource management module for project leaders can display the same content as the user resource management module 201 of the user management subsystem 200, except that the terminal resource management module does not have the authority to add or modify user test resources. The terminal resource management module can customize the name of the called user test case to facilitate the understanding of the unit personnel. The terminal resource management module can install and execute the called user test tool, and can troubleshoot and verify the problems of the user test tool.

[0073] The terminal solution management module for project leaders can display the same content as the user solution management module 202 of the user management subsystem 200. These user test solutions can be edited after being called to be more suitable for specific test projects of the unit.

[0074] In an actual application example, when the test role of the logged-in person is a test manager, the test permissions provided by the test terminal platform 301 include a second workbench permission, a second project management permission, a second task management permission, a second resource management permission, and a second solution management permission. The second workbench permission allows you to have an overview of the test projects, testers, test tasks, and test results. The second project management permission allows you to check the project progress of the test project. The second task management permission allows you to approve test tasks. The second resource management permission allows you to check user test standards and user test cases, and to install or execute user test tools. The second solution management permission allows you to check user test solutions.

[0075] Specifically, the test manager can view the assigned test projects, assign testers to the test projects, and approve the test cases and test reports of the test projects. The test manager's operation interface can include modules such as workbench, project management, task management, terminal resource management, and terminal solution management.

[0076] The workbench module for test managers is also similar to a dashboard, which provides an overview of information such as assigned test projects, testers involved in assigned test projects, approval of test tasks, and test execution results.

[0077] The project management module for test managers can display all test projects related to the test manager. Using the project management module for test managers, the test manager can only view these test projects and cannot complete, close, delete, etc.

[0078] The task management module for test managers can display the approval flow of test tasks assigned to test managers, including tester assignment, test case writing approval, test case modification approval, test execution result approval, etc. After the test execution result is approved, the test report can also be automatically generated in the task management module.

[0079] The terminal resource management module for test managers can also display user testing resources such as user testing standards, user testing cases, and user testing tools. Through the terminal resource management module, test managers can only view user testing standards and user testing cases, and have no operation permissions. Through the terminal resource management module, test managers can install or execute a user testing tool.

[0080] The terminal plan management module for test managers can display user test plans that meet the test manager's viewing permissions. However, through the terminal plan management module, the test manager can only view the corresponding user test plans and has no operation permissions.

[0081] In an actual application example, when the test role of the logged-in person is a tester, the test permissions provided by the test terminal platform 301 include a third workbench permission, a third project management permission, a third task management permission, and a third resource management permission. With the third workbench permission, the target test project, target test task, and target test result that match the tester can be viewed. With the third project management permission, the project progress of the target test project can be viewed. With the third task management permission, the target test task can be executed. With the third resource management permission, the user test standards and user test cases can be consulted, and the user test tool can be executed.

[0082] Specifically, the tester is the role that actually performs the test. According to the assigned test tasks, he can write test cases, execute test cases, and submit test results. The tester's operation interface can include modules such as workbench, project management, task management, and terminal resource management.

[0083] The workbench module for testers can display the progress of the test projects and test tasks involved by the testers, including completed and unfinished ones.

[0084] The project management module for testers can display all the test projects in which the testers participate. Here, only the project progress and progress reports can be viewed.

[0085] The task management module for testers can display the test tasks of testers, which mainly include three categories: case writing tasks, case execution tasks, and result submission tasks. Case writing tasks require secondary editing of the original test cases and execution after approval by the test manager. Case execution tasks require testers to execute test cases according to test steps. Result submission tasks require uploading test results and submitting them to the test manager for review. Optionally, result submission tasks can be merged into case execution tasks.

[0086] The terminal resource management module for testers can display user testing resources such as user testing standards, user testing cases, user testing tools, etc. Through the terminal resource management module, the test manager can only view these user testing resources and has no operation authority.

[0087] In some implementations, the test terminal device 302 includes at least one of the following attributes: supports multiple operating systems; supports disassembly and use in the form of independent modules; supports remote control; supports a graphical display interface and at least one input device.

[0088] Specifically, the test terminal device 302 may include three forms: an integrated test cabinet, a portable tool box, and a teaching tool box, which can be used in different application scenarios to improve reliability and applicability. The test terminal device 302 can support the operation of different types of computer operating systems, including but not limited to Linux, Kali, and Windows. The test terminal device 302 can implement remote access testing and support testers to conduct information security testing remotely, especially for some test items with longer test cycles, which can be operated flexibly. The test terminal device 302 can have its own operating terminal, and can directly use the graphical interface and input devices (mouse / keyboard) to carry out testing without relying on additional test computers.

[0089] In a practical application example, the integrated test cabinet is an intelligent connected car information security testing product developed for professional laboratory testing scenarios. It can integrate high-performance industrial computers and a variety of software and hardware testing tools. The hardware of the integrated test cabinet can integrate industrial control power supplies, industrial computers, operating terminals, test platforms, test tool sets, electromagnetic shielding boxes, servers, oscilloscopes, etc. The integrated test cabinet can directly power the device under test, build basic test conditions, and conduct tests through the test tool set. The integrated test cabinet can be disassembled separately in the form of an independent running module and connected to the test computer to conduct tests on specific functions and specific scenarios.

[0090] In a practical application example, the portable test toolbox is a test product developed for outdoor test scenarios, which can integrate hardware such as industrial control notebooks and test tool sets. The test tool set and the industrial control notebook are wired together inside the portable test toolbox to improve data interaction efficiency. The portable test toolbox has rich hardware interfaces that can meet basic vehicle and outdoor test needs, has a long battery life of more than 6 hours, and can directly connect to the network to upload and download data.

[0091] The teaching toolbox is developed to meet the current shortage of information security testers and the lack of corresponding teaching tools in teaching institutions. It can integrate hardware tool sets. The main features of the teaching toolbox are that it is small and convenient, can be closely connected to teaching needs, and can be connected to the test platform through an external teaching computer to carry out actual testing through wired or wireless connection with the device under test.

[0092] See also Figure 2 The network and data security testing system provided in one embodiment of the present disclosure can be divided into three-level platforms, namely, the operation platform, the merchant platform and the client, which can correspond to the above-mentioned operation management subsystem, the user management subsystem and the test terminal subsystem respectively. The operation platform can be oriented to all test units and test models, and can continuously update the operation test resources (for example, operation test standards, operation test cases, operation test tools, operation test plans, etc.). The operation test data of the operation platform can be published externally, and the subscription acquisition of the merchant platform can be supported. The merchant platform can be deployed locally in the test unit, forming a closed-loop flow with the data of the client. The merchant platform can pull down the operation test resources from the operation platform, update the local user test resources, and the user can also customize the new local test resources on the merchant platform. The local test resources customized by the user can only be seen by the personnel under the merchant, ensuring the privacy of the data. The client can be compatible with different computer operating systems and can meet the requirements of the operating environment of different test tools. The client can realize remote access testing and support testers to conduct information security testing remotely, especially for some test items with a long test cycle, which can be operated flexibly.

[0093] The network and data security testing system provided by this embodiment has the following multiple beneficial effects: For testing companies, it can transform the reliance of information security testing on personal experience into reliance on the testing platform, thus improving the overall testing efficiency. Based on the platform management of the operation platform and the merchant platform, a complete project management process can be established, from project establishment to vulnerability repair, forming an efficient closed-loop management. Test reports can be automatically generated based on test data, improving efficiency and reducing human errors.

[0094] For OEMs, after the information security testing tools of the merchant platform are unified and integrated, users can use them directly. For specific testing tools, users can visit the operation platform to apply for them. The overall operation process is simple and easy to use. Based on the platform management of the operation platform and the merchant platform, a complete project management process can be established to achieve efficient closed-loop management and meet the needs of OEM project management. In addition, the high test automation rate can greatly reduce manual operation time and improve the accuracy of test results.

[0095] Compared with related technologies, the network and data security testing system provided by this embodiment can integrate a large number of test tools and test cases for information security testing, and can cover most of the supporting data for Internet of Vehicles information security testing. The operation platform can continuously provide updates on basic test resources, meet new industry testing standards, and meet the testing requirements of new models and new functions.

[0096] See also Figure 3 , a network and data security testing method provided by an embodiment of the present disclosure may include the following steps.

[0097] S31: Downloading operation test resources, and generating and maintaining user test resources based on the operation test resources.

[0098] S32: In response to the call request of the test terminal subsystem, the user test resources are sent to the test terminal subsystem, so that the test terminal subsystem uses the user test resources to perform a connection test with the test object, and automatically generates a test report according to a preset template.

[0099] In this embodiment, the operation test resources can be maintained by the operation management subsystem. The operation test resources can include operation test standards, operation test tools, operation test cases and operation test plans. The operation test cases can include test objectives, test conditions, test steps, expected conditions and judgment conditions. The operation test plan can include test pieces, test types, plan standards and plan cases. User test resources can include user test standards, user test tools, user test cases and user test plans.

[0100] The network and data security testing method provided in this embodiment can be applied to Figure 1 For detailed descriptions of the operation management subsystem, user management subsystem, test terminal subsystem, and the data interaction process between them, please refer to Figure 1 The detailed description in the corresponding implementation manner will not be repeated here.

[0101] See also Figure 4 , a network and data security testing method provided by an embodiment of the present disclosure may include the following steps.

[0102] S41: Send a call request to the user management subsystem, and receive user test resources fed back by the user management subsystem.

[0103] S42: Utilize user test resources to perform connection test with the test object, and automatically generate a test report based on a preset template.

[0104] In this embodiment, user test resources can be generated by the user management subsystem according to the operation test resources issued by the operation management subsystem. Operation test resources may include operation test standards, operation test tools, operation test cases and operation test plans. Operation test cases may include test purposes, test conditions, test steps, expected conditions and judgment conditions. Operation test plans may include test pieces, test types, plan standards and plan cases. User test resources may include user test standards, user test tools, user test cases and user test plans.

[0105] The network and data security testing method provided in this embodiment can be applied to Figure 1 The detailed description of the operation management subsystem, user management subsystem, and test terminal subsystem, as well as the data interaction process between them, can be found in Figure 1 The detailed description in the corresponding implementation manner will not be repeated here.

[0106] The technical solution provided by one or more embodiments of the present invention can create and maintain operation test plans, operation test standards, operation test tools, operation test cases, and other operation test resources that can serve different users through the operation management subsystem, thereby integrating a large number of test tools and test cases for information security testing, and flexibly expanding and updating these operation test resources.

[0107] The technical solution provided by one or more embodiments of the present disclosure can download required operation test plans, operation test standards, operation test tools, operation test cases and other operation test resources from the operation management subsystem through the user management subsystem. On this basis, the user management subsystem can generate and maintain user test plans, user test standards, user test tools, user test cases and other user test resources that serve a specific user, so as to efficiently manage local user test resources and set user-specific test projects and test tasks.

[0108] The technical solution provided by one or more embodiments of the present disclosure can call user testing resources such as user testing plans, user testing standards, user testing tools, user testing cases, etc. maintained by the user management subsystem through the test terminal subsystem, so that after connecting with the test object, the test task can be carried out conveniently and the test report can be automatically generated.

[0109] The technical solution provided by one or more embodiments of the present disclosure, through the joint use of the operation management subsystem, the user management subsystem and the test terminal subsystem, enables the information security testing process to be transformed from relying on the personal experience of the technicians to relying on the test platform, thereby improving the reliability and convenience of the information security testing work. On the one hand, the management process that can be established in different subsystems not only simplifies the user operation process, but also ensures the repeatability of the testing work. On the other hand, the test terminal subsystem can automatically carry out the test and generate the test report, which not only improves the test efficiency, but also improves the accuracy of the test report.

[0110] See also Figure 5 The present disclosure also provides an electronic device, the electronic device comprising a memory and a processor, the memory is used to store a computer program, and when the computer program is executed by the processor, the above-mentioned Figure 3 or Figure 4 Corresponding network and data security testing methods.

[0111] The present disclosure also provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the above Figure 3 or Figure 4 Corresponding network and data security testing methods.

[0112] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0113] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, implementing the method in the above method embodiment.

[0114] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0115] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FlashMemory), a hard disk (HardDiskDrive, abbreviated as: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0116] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the embodiments of the method, device, and storage medium, since they are basically similar to the system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment.

[0117] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

[0118] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A network and data security testing system, characterized in that: The system includes: an operation management subsystem, a user management subsystem and a test terminal subsystem; wherein, The operation management subsystem is used to maintain operation test resources, wherein the operation test resources include operation test standards, operation test tools, operation test cases and operation test plans, wherein the operation test cases include test objectives, test conditions, test steps, expected conditions and judgment conditions, and the operation test plans include test pieces, test types, plan standards and plan cases; The user management subsystem is used to download the operation test resources and generate and maintain user test resources based on the operation test resources, wherein the user test resources include user test standards, user test tools, user test cases and user test plans; The test terminal subsystem is used to call the user test resource, perform a connection test with the test object, and automatically generate a test report according to a preset template.

2. The system according to claim 1, characterized in that The operation management subsystem includes an operation resource management module, an operation plan management module, an operation release module and an operation member management module; wherein, The operation resource management module is used to manage the operation test standard, the operation test case and the operation test tool; The operation plan management module is used to manage the operation test plan; The operation publishing module is used to publish the operation test plan; The operating member management module is used to manage the resource download authority of the user management subsystem.

3. The system according to claim 1, characterized in that The user management subsystem is also used to receive resource creation instructions, and generate and maintain the user test resources according to the resource creation instructions.

4. The system according to claim 1 or 3, characterized in that: The user management subsystem includes a user resource management module, a user scheme management module and a user role management module; wherein, The user resource management module is used to manage the user testing standards, the user testing tools and the user testing cases; The user program management module is used to manage the user test program; The user role management module is used to set a test role and allocate resource calling permissions to the test role.

5. The system according to claim 1, characterized in that The test terminal subsystem includes a test terminal platform and a test terminal device; The test terminal platform is used to identify the test role of the login personnel and provide the login personnel with the test authority matching the test role, so that the login personnel can call the user test resources according to the test authority; The test terminal device is used to utilize the user test resources to perform a connection test with the test object, and automatically generate the test report according to the preset template.

6. The system according to claim 5, characterized in that The test terminal device includes at least one of the following attributes: Support multiple operating systems; Supports disassembly and use as an independent module; Support remote control; Supports a graphical display interface and at least one input device.

7. A network and data security testing method, characterized in that: The method comprises: Downloading operational test resources, and generating and maintaining user test resources based on the operational test resources; In response to a call request of the test terminal subsystem, the user test resource is sent to the test terminal subsystem, so that the test terminal subsystem uses the user test resource to perform a connection test with the test object, and automatically generates a test report according to a preset template; Among them, the operation test resources are maintained by the operation management subsystem, and the operation test resources include operation test standards, operation test tools, operation test cases and operation test plans. The operation test cases include test purposes, test conditions, test steps, expected conditions and judgment conditions. The operation test plans include test pieces, test types, plan standards and plan cases. The user test resources include user test standards, user test tools, user test cases and user test plans.

8. A network and data security testing method, characterized in that: The method comprises: Sending a call request to the user management subsystem and receiving user test resources fed back by the user management subsystem; Utilize the user test resources to conduct connection test with the test object, and automatically generate a test report based on a preset template; Among them, the user testing resources are generated by the user management subsystem based on the operation testing resources issued by the operation management subsystem, the operation testing resources include operation testing standards, operation testing tools, operation testing cases and operation testing plans, the operation testing cases include test purposes, test conditions, test steps, expected conditions and judgment conditions, the operation testing plans include test pieces, test types, plan standards and plan cases, and the user testing resources include user testing standards, user testing tools, user testing cases and user testing plans.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and when the computer program is executed by the processor, the method according to claim 7 or 8 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the method according to claim 7 or 8 is implemented.

Images