A government affair cloud commercial password violation behavior detection method and system

Abstract

The present application relates to the technical field of password security management, in particular to a government affair cloud commercial password illegal behavior detection method and system. Including constructing a password illegal behavior list according to detection requirement information; connecting the government affair cloud password application environment, obtaining the task feature to be detected in the illegal behavior list; using a machine learning algorithm to estimate the execution difficulty identifier of the task feature to be detected; constructing a clustering distributed detection model, inputting the execution difficulty identifier, the illegal behavior list and the task feature to be detected into the clustering distributed detection model, using the clustering distributed detection model to distribute the task to be detected, outputting multiple distributed subtask packages, and the distributed subnodes detecting the password application illegal behavior of the distributed subtask packages. The problems of efficient identification and prevention of illegal behavior in password use are solved.

Description

Technical Field

[0001] This invention relates to the field of commercial cryptographic security management technology, and in particular to a method and system for detecting violations of commercial cryptographic rules in government cloud services. Background Technology

[0002] Commercial cryptography refers to technologies, products, and services that use specific transformation methods to encrypt and protect information that is not a state secret, and to provide security authentication. Government cloud platforms integrate numerous government information systems, involving a large amount of sensitive data and critical business processes. Commercial cryptography in government cloud platforms covers several key areas, including identity authentication, data encryption, integrity protection, and non-repudiation. However, the detection of violations in commercial cryptography applications currently faces many challenges. Relying on users to independently conduct regular detection of commercial cryptography violations is limited by their professional capabilities, resulting in ineffective detection and an inability to effectively and promptly eliminate compliance defects, leading to information security vulnerabilities. On the other hand, outsourcing the detection of commercial cryptography violations to third parties suffers from insufficient timeliness and unreliable results.

[0003] In summary, existing commercial cryptography violation detection methods have many shortcomings in terms of accuracy, efficiency, and reliability. There is an urgent need for a more comprehensive and effective cryptography violation supervision solution to improve the security and reliability of commercial cryptography violation detection in government cloud platforms and government information systems, and to identify, process, and prevent violations in cryptography use. Summary of the Invention

[0004] To address the problem of efficiently identifying, processing, and preventing violations in password usage, this invention provides a method and system for detecting violations in commercial password usage on government cloud platforms.

[0005] Firstly, the present invention provides a method for detecting violations of commercial cryptographic rules in government cloud services, which adopts the following technical solution: Collect and categorize testing requirements, and construct a list of password violations based on the testing requirements information; Connect to the government cloud cryptographic application environment to obtain the characteristics of the tasks to be detected in the list of violations, wherein the characteristics of the tasks to be detected include resource usage identifiers and risk level identifiers; Obtain historical data on the detection capabilities of detection nodes for password violations, and use machine learning algorithms to build a task difficulty assessment model to predict the execution difficulty of the features of the task to be detected. A clustering distributed detection model is constructed, which connects distributed nodes, including a central node and distributed sub-nodes. The execution difficulty identifier, the list of violations, and the characteristics of the task to be detected are input into the clustering distributed detection model. The clustering distributed detection model is used to allocate the task to be detected and output multiple allocation sub-task packages. The distributed sub-nodes perform password application violation detection on the allocation sub-task packages. The central node aggregates the detection results from the distributed child nodes, processes the data, and outputs a detection evaluation result identifier.

[0006] Furthermore, the detection requirement information includes cryptographic evaluation services, cryptographic products, business systems, and network traffic. The cryptographic evaluation services include cryptographic evaluation information data, cryptographic application scheme data, and cryptographic evaluation report data. The cryptographic products include commercial cryptographic product certification certificates, cryptographic product operation status data, call log data, and anomaly information data. The business systems include operation log data and anomaly information data. The network traffic includes encryption protocol data, encryption business data, and encryption algorithm data.

[0007] Furthermore, the collection and classification of detection requirement information includes data mining and feature extraction of the detection requirement information, classification of the detection requirement information using text classification algorithms, and identification of requirement descriptions related to security assessment business, cryptographic products, business systems, and network traffic.

[0008] Furthermore, the construction of the password violation list includes establishing a structured list database, wherein each record in the list database includes a description of the violation, a category, and fields indicating the scope of business impact.

[0009] Furthermore, the connection to the government cloud cryptographic application environment to obtain the characteristics of the tasks to be detected in the list of violations includes: Configure a secure connection interface for the government cloud cryptographic application environment; Use system monitoring tools to collect resource usage data during password application operations as the basis for calculating resource occupancy indicators; The risk level score of the task to be tested is determined based on the risk assessment value of commercial cryptography. The acquired resource usage data and risk level scores are associated with the corresponding tasks to be detected to form a task feature dataset. The elements in the task feature dataset are then labeled with resource occupancy identifiers and risk level identifiers.

[0010] Furthermore, the acquisition of historical password violation detection capability data of the detection node includes extracting historical password violation detection capability data from the detection node's log system, database records, and historical detection reports, and preprocessing and formatting the password violation detection capability data, which includes task characteristics and execution results. The task characteristics include password algorithm type, data size, and detection node configuration information, and the execution results include execution time, resource consumption, and success / failure fields.

[0011] Furthermore, the clustering distributed detection model connects distributed nodes, including performing resource evaluation on the distributed child nodes and registering the resource evaluation information of the distributed child nodes in the management center of the clustering distributed detection model. The management center is used to allocate sub-task packages according to the resource status of the distributed child nodes.

[0012] Furthermore, the resource assessment includes evaluating the computing power, storage capacity, and network bandwidth of the distributed child nodes.

[0013] Furthermore, the allocation of detection tasks using the clustering distributed detection model includes: Construct a clustered distributed detection model using K-means clustering; The similarity between distributed child nodes is calculated based on the resource assessment information of the distributed child nodes, and the distributed child nodes are divided into K clusters. The clustering distributed detection model calculates the allocation cost between the task to be detected and the distributed child nodes based on the characteristics of the task to be detected and the resource evaluation information of the distributed nodes. The clustering distributed detection model is used to allocate the detection tasks to distributed child nodes, forming an allocation subtask package.

[0014] Furthermore, the distributed child nodes perform password application violation detection on the allocated subtask packages, including: Distributed child nodes invoke local password detection tools and resources to detect the allocated subtask packages; Distributed child nodes report task execution progress, resource usage, and monitoring results to the management center; The clustering distributed detection model redistributes the detection tasks, and the management center exchanges the distributed sub-task packages among the distributed sub-nodes through the central node.

[0015] Furthermore, the central node aggregates the detection results of the distributed sub-nodes and performs data processing to output a detection evaluation result identifier. This includes the central node receiving the detection results of the distributed sub-nodes to form a detection result dataset. The central node performs a consistency check on the data in the detection result dataset. If the data check results are inconsistent, a pending investigation identifier is generated. If the data is consistent, a detection evaluation result identifier is generated.

[0016] Secondly, a government cloud commercial cryptographic violation detection system includes: The detection requirement collection module is configured to collect and classify detection requirement information, and build a list of password violation behaviors based on the detection requirement information. The task acquisition module is configured to connect to the government cloud cryptographic application environment and acquire the characteristics of the tasks to be detected in the list of violations, wherein the characteristics of the tasks to be detected include resource usage identifiers and risk level identifiers. The execution difficulty estimation module is configured to obtain historical data on the detection capabilities of detection nodes for detecting password violations, use machine learning algorithms to build a task difficulty assessment model, and estimate the execution difficulty identifier of the features of the task to be detected. The task allocation module is configured to construct a clustered distributed detection model, which connects distributed nodes, including a central node and distributed sub-nodes. The execution difficulty identifier, a list of violations, and the characteristics of the task to be detected are input into the clustered distributed detection model. The clustered distributed detection model is used to allocate the task to be detected and output multiple allocation sub-task packages. The distributed sub-nodes perform password application violation detection on the allocation sub-task packages. The results evaluation module is configured such that the central node aggregates the detection results of the distributed child nodes, processes the data, and outputs a detection evaluation result identifier.

[0017] Thirdly, the present invention provides a computer-readable storage medium storing a plurality of instructions adapted to be loaded and executed by a processor of a terminal device as described in the method for detecting violations of commercial cryptography in government cloud services.

[0018] Fourthly, the present invention provides a terminal device, including a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, the instructions being adapted to be loaded and executed by the processor as described in the method for detecting violations of commercial cryptography in government cloud.

[0019] In summary, the present invention has the following beneficial technical effects: 1. This invention proposes a method and system for detecting violations of commercial cryptography rules in government cloud environments. This invention utilizes data mining, feature extraction, and text classification algorithms for classification, enabling accurate identification of various requirement descriptions and effectively avoiding detection vulnerabilities. A secure connection interface is configured when connecting to the government cloud cryptography application environment to ensure data acquisition security. Resource usage data is collected using system monitoring tools to provide a basis for calculating resource occupancy indicators. Risk level scores are determined based on commercial cryptography risk assessment values ​​and correlated with data to form a complete feature dataset of the tasks to be detected. This ensures the continuity and reliability of detection, allowing detection personnel to rationally allocate detection resources according to the risk level, prioritizing high-risk tasks, enhancing the risk response capability of the government cloud commercial cryptography system, and avoiding impacts on detection progress and results due to connection or data issues.

[0020] 2. This invention features accurate execution difficulty prediction and adaptability. It acquires historical data on cryptographic violation detection capabilities from multiple sources and utilizes machine learning algorithms to construct a task difficulty assessment model. This model fully considers the impact of multiple factors on task execution difficulty, and the multi-source data makes the model more accurate and reliable, enabling precise prediction of execution difficulty indicators. This provides crucial reference for task allocation and avoids problems caused by unreasonable task allocation. Furthermore, the model can learn and adjust as detection nodes and task characteristics change, exhibiting good adaptability and foresight. For example, it can reasonably arrange detection when dealing with new cryptographic algorithms or product applications.

[0021] 3. This invention optimizes task allocation and collaborative detection. It performs multi-faceted resource assessments on distributed sub-nodes and registers this information with the management center. The management center then rationally allocates task packages based on this information, achieving efficient resource utilization and balanced task distribution, thus avoiding node resource issues. A model is constructed using K-means clustering to calculate allocation costs and assign tasks based on node similarity and task characteristics. This leverages the advantages of a distributed system to improve task processing speed, such as enabling rapid and accurate task allocation in government cloud password detection. Distributed sub-nodes work collaboratively, reporting status in real time and reassigning tasks as needed to address various situations during detection, improving system flexibility and robustness.

[0022] 4. This invention provides reliable detection result evaluation and feedback. The central node performs a rigorous consistency check on the detection results of distributed child nodes. Inconsistencies are identified by generating a pending investigation flag, ensuring the accuracy and reliability of the results and preventing erroneous assessments due to data inconsistencies. This ensures the credibility of the detection result flags. Consistent data generates result flags, and security issues discovered during child node detection can be shared and notified to relevant departments, enabling effective use of results and timely problem handling. For example, vulnerabilities in cryptographic products can be promptly addressed, improving the security and compliance of the government cloud commercial cryptographic system.

[0023] 5. This invention enhances the security and oversight of cryptography in government cloud platforms. It optimizes the entire process from requirement gathering to result evaluation, effectively identifying and preventing cryptographic violations, reducing information security vulnerabilities, comprehensively testing key areas of commercial cryptography in government cloud platforms, ensuring the security of cryptographic applications on government cloud platforms and information systems, and guaranteeing the security of user identities, data, and operations during government business processing. It overcomes the shortcomings of existing testing methods, providing a more comprehensive and effective oversight solution to meet the cryptographic security needs of government informatization development. Attached Figure Description

[0024] Figure 1 This is a flowchart of a method for detecting cryptographic violations in government cloud commercial applications, according to Embodiment 1 of the present invention. Figure 2 This is a module diagram of a government cloud commercial cryptography violation detection system according to Embodiment 2 of the present invention. Detailed Implementation

[0025] The present invention will be further described in detail below with reference to the accompanying drawings.

[0026] Example 1 Reference Figure 1 This embodiment of a method for detecting violations of commercial cryptography rules in government cloud services includes: S1. Collect and categorize detection requirements, and construct a list of password violations based on the detection requirements; The detection requirement information includes cryptographic evaluation services, cryptographic products, business systems, and network traffic. The cryptographic evaluation services include cryptographic evaluation information data, cryptographic application scheme data, and cryptographic evaluation report data. The cryptographic products include commercial cryptographic product certification certificates, cryptographic product operation status data, call log data, and anomaly information data. The business systems include operation log data and anomaly information data. The network traffic includes encryption protocol data, encryption business data, and encryption algorithm data.

[0027] The process of collecting and classifying testing requirements includes data mining and feature extraction of the testing requirements, classifying the testing requirements using text classification algorithms, and identifying requirement descriptions related to security assessment services, cryptographic products, business systems, and network traffic.

[0028] The construction of the password violation list includes establishing a structured list database, where each record in the list database includes a description of the violation, a category, and fields indicating the scope of business impact.

[0029] The list of cryptographic violations includes categories such as cryptographic technology violations, cryptographic algorithm violations, cryptographic product or service violations, and cryptographic evaluation business violations. Description of cryptographic technology violations: failure to use cryptographic technology, use of cryptographic technologies with defects or security warnings, such as SSH 1.0, SSL 2.0, SSL 3.0, TLS 1.0, etc., use of cryptographic technologies with unknown security, such as self-designed cryptographic communication protocols or cryptographic communication protocols without security verification, etc.

[0030] Description of cryptographic algorithm violations: Using cryptographic algorithms with security vulnerabilities or insufficient security strength to protect important data, such as MD5, DES, SHA-1, RSA (less than 2048 bits), etc.; using cryptographic algorithms with unknown security, such as self-designed cryptographic algorithms or cryptographic algorithms that have not been verified for security.

[0031] Description of violations related to cryptographic products or services: using self-implemented cryptographic products without providing security evidence; using cryptographic products with high-risk security vulnerabilities; using cryptographic products that do not meet the prerequisites for their secure operation; using cryptographic services whose service providers do not have the relevant qualifications.

[0032] Description of violations in the cryptography assessment business: failure to upload cryptography application solutions or cryptography application security assessment reports, and failure to conduct cryptography application security assessments regularly.

[0033] S2. Connect to the government cloud cryptographic application environment and obtain the characteristics of the tasks to be detected in the list of violations, wherein the characteristics of the tasks to be detected include resource usage identifiers and risk level identifiers; The government cloud cryptographic application environment is a system that uses commercial cryptographic technology to ensure information security in the government cloud environment. Its functions cover data security, identity authentication and access control, and ensure the secure operation of government business. In terms of architecture, it includes cryptographic devices, cryptographic technology, cryptographic services, cryptographic applications and interfaces.

[0034] The connected government cloud cryptographic application environment obtains the characteristics of the tasks to be detected from the list of violations, including: S21. Configure a secure connection interface with the government cloud cryptographic application environment; S22. Use system monitoring tools to collect resource usage data during password application operations as the basis for calculating resource occupancy indicators; S23. Determine the risk level score of the task to be tested based on the risk assessment value of commercial cryptography; S24. Associate the acquired resource usage data and risk level scores with the corresponding tasks to be detected to form a task feature dataset, and label the elements in the task feature dataset with resource occupancy identifiers and risk level identifiers.

[0035] S3. Obtain historical data on the detection capabilities of detection nodes for password violations, construct a task difficulty assessment model using machine learning algorithms, and estimate the execution difficulty indicators of the features of the task to be detected; construct the task difficulty assessment model using decision tree regression algorithms.

[0036] The process of obtaining historical password violation detection capability data of the detection node includes extracting historical password violation detection capability data from the detection node's log system, database records, and historical detection reports. The detection capability data is then preprocessed and formatted, including task characteristics and execution results. The task characteristics include password algorithm type, data size, and detection node configuration information. The execution results include execution time, resource consumption, and success / failure fields.

[0037] First, the data is standardized and information gain is calculated. A decision tree is then constructed using the success or failure of a discrete task as the classification objective to calculate a specific feature. (For example, regarding information gain for classification objectives, such as cryptographic algorithm types) ,in, Representation of features Relative to dataset The information gain value indicates that the higher the information gain, the more helpful it is to use this feature to divide the dataset for the classification objective (whether the task is successful). Decision tree algorithms will prioritize features with high information gain as splitting nodes. Represents the dataset Information entropy. For classification problems (where task success or failure is a binary classification), its calculation formula is: ,in This represents the proportion of samples in the dataset that successfully completed the task. This indicates the proportion of samples where the task was unsuccessful. Representation of features The set of all possible values; for example, the feature of cryptographic algorithm type could have different values ​​such as MD5, DES, SHA-1, etc. Indicates in the dataset Chinese characteristics Values The number of sample subsets, Represents the entire dataset The total number of samples is the total number of historical data samples used to build the model for detecting password violations, extracted from various records of the detection nodes.

[0038] Prediction is performed based on a trained decision tree regression model. The execution difficulty is quantified numerically using the following formula: , in, This represents the predicted value of the execution difficulty indicator of the features of the task to be detected. The larger the value, the higher the predicted execution difficulty. Different ranges are set according to the actual business situation to correspond to different difficulty levels (0 - 0.3 is low difficulty, 0.3 - 0.7 is medium difficulty, and 0.7 - 1 is high difficulty).

[0039] This represents the number of features involved in predicting execution difficulty. It is the number of key features used to build the model after screening and other processing, such as cryptographic algorithm type, data size, and detection node configuration information. It is the total number of these features.

[0040] Indicates the first The weight coefficients corresponding to each feature are learned during the training of the decision tree regression model and are used to measure the relative importance of each feature in predicting the difficulty of execution.

[0041] Indicates the first The standardized values ​​of each feature (such as the feature values ​​after data preprocessing mentioned earlier), for example... Time represents the processed feature representation value corresponding to the cryptographic algorithm type, which is related to the weight coefficient. The result of multiplication is used in the final calculation of the execution difficulty indicator.

[0042] S4. Construct a clustered distributed detection model, which connects distributed nodes, including a central node and distributed sub-nodes. Input the execution difficulty identifier, violation list, and characteristics of the task to be detected into the clustered distributed detection model. Use the clustered distributed detection model to allocate the task to be detected and output multiple allocation sub-task packages. The distributed sub-nodes perform password application violation detection on the allocation sub-task packages. The clustering distributed detection model connects distributed nodes, including performing resource evaluation on the distributed child nodes and registering the resource evaluation information of the distributed child nodes in the management center of the clustering distributed detection model. The management center is used to allocate sub-task packages according to the resource status of the distributed child nodes.

[0043] In this embodiment, the distributed sub-node architecture has five automatic detection functions. The main content of the automatic detection function is to analyze the characteristics of the task to be detected based on the list of password violations and determine whether there are any password violations.

[0044] Detection Function A: Analyzes the cryptographic application provider's security assessment business data collected through page-based submissions to determine if there are any violations. Possible violations include: failure to upload cryptographic application solutions or cryptographic application security assessment reports, failure to conduct regular cryptographic application security assessments, and the use of cryptographic services whose service providers do not have the relevant qualifications.

[0045] Detection Function B: Analyzes the cryptographic asset data of cryptographic service providers collected through page-based submissions to determine whether there are any violations. Possible violations include: using self-implemented cryptographic products without providing security evidence, and cryptographic service providers lacking relevant qualifications.

[0046] Detection Function C: Analyzes Syslog log data collected in real time from the cryptographic service platform. Based on filtering conditions such as log level, source IP, and message content, it extracts data items for cryptographic violation analysis, such as log generation timestamp, cryptographic product IP, log level, unique identifier of government information system, cryptographic service type, and request IP, to determine whether there are any violations. Possible violations include: using cryptographic algorithms with security issues or insufficient security strength to protect important data, and using cryptographic algorithms with unknown security.

[0047] Detection Function D: Analyzes log data collected in real time from government information systems, sets filtering rules based on log formats and content learned from research, and extracts data items for password violation analysis, such as log generation timestamp, system IP, log level, authorization identifier of the password service platform, operation type, data type (important data, authentication data), etc., to determine whether there are password violations. Possible violations include: not using password technology, using password technology with defects or security warnings, and using password technology with unknown security.

[0048] Detection Function E: Analyzes network traffic data obtained in real time from the government cloud platform, extracts trusted site certificate information and cipher suite information in the SSL / TLS protocol from the network traffic information, and analyzes and determines whether there are any cryptographic violations. Possible violations include: not using cryptographic technology, using cryptographic technology with defects or security warnings, using cryptographic technology with unknown security, using cryptographic algorithms with security problems or insufficient security strength to protect important data, and using cryptographic algorithms with unknown security.

[0049] The resource assessment includes evaluating the computing power, storage capacity, and network bandwidth of the distributed sub-nodes.

[0050] S41. The allocation of detection tasks using the clustering distributed detection model includes: S411. Construct a clustered distributed detection model using K-means clustering; S412. Calculate the similarity between distributed child nodes based on the resource assessment information of the distributed child nodes, and divide the distributed child nodes into K clusters; Calculate the distance from distributed child nodes to the cluster center. ,in, Indicates the first The distributed child node to the first The distance between cluster centers is such that the smaller the distance, the more likely the node is to belong to the cluster category represented by that cluster center. Representing the The distributed child node is at the _ ... The values ​​taken on each feature dimension correspond to various indicators in the resource evaluation information of the distributed child nodes. Indicates the first The cluster centers at the in The values ​​taken on each feature dimension Indicates the number of feature dimensions.

[0051] Update the coordinates of the cluster centers by calculating the mean. ,in, Indicates the updated number The coordinates of the cluster centers Indicates belonging to the first The number of distributed child nodes in each cluster, which is the set The number of elements (distributed child nodes) in the middle. Indicates belonging to the first Clusters (i.e., sets) The first element in the (element) Distributed child nodes.

[0052] The sum of squared errors in clustering is used to evaluate the clustering performance. ,in, This represents the sum of squared errors. The smaller the value, the more tightly the data points (distributed child nodes) within each cluster are clustered around their cluster centers, indicating better clustering results. This indicates the pre-defined number of clusters, which is the number of clusters into which the distributed child nodes will be divided. Indicates the first The distributed child node belongs to the first The distributed child nodes are divided into different clusters through the above calculations, so that the detection tasks can be assigned subsequently.

[0053] S413. The clustering distributed detection model calculates the allocation cost between the task to be detected and the distributed child nodes based on the characteristics of the task to be detected and the resource evaluation information of the distributed nodes. , in, Indicates the first The task to be detected was assigned to the first... The allocation cost of each distributed child node. Indicates the first The difficulty indicator of the execution of the task to be tested itself. Indicates the first The resources required for each task to be tested and the first The degree of disparity in resources among distributed child nodes. Indicates the first The task to be detected is in the first The network-related costs involved when executing on distributed child nodes Indicates the first The task to be detected is in the first Storage costs when executing on distributed child nodes , This represents the corresponding weighting coefficient.

[0054] S414. Use a clustering distributed detection model to allocate the task to be detected to distributed child nodes, forming an allocation subtask package.

[0055] , in, Indicates the first The task to be detected and the first The matching degree value between distributed child nodes. Indicates the first The task to be detected and the first The similarity of features among distributed child nodes (measured using the Euclidean distance method). Indicates the first The task to be detected is for the first... The degree of resource capacity adaptation of each distributed child node is quantified by comparing the amount of various resources required for task execution (such as computing resources, storage resources, etc.) with the amount of resources actually possessed by the node. Indicates the first The task to be detected was assigned to the first... Cost-effectiveness of each distributed child node , This indicates the maximum allocation cost set. , This represents the weight coefficient of the corresponding item.

[0056] In this embodiment, the allocated sub-task package mainly includes seven application and data security detection tasks: identity authentication task, access control information and sensitive tag integrity task, important data transmission confidentiality task, important data storage confidentiality task, important data transmission integrity task, important data storage integrity task, and non-repudiation task, to detect violations of commercial cryptography in the government cloud. Each detection task is detailed below: Identity Authentication Task, Evaluation Indicators: Use cryptographic technology to identify and authenticate logged-in users, ensuring user authenticity. Evaluation Targets: Application system administrators, application systems, cryptographic products (terminal cryptographic modules, digital certificates, signature verification servers, server cryptographic machines), and technical documentation. Evaluation Implementation: Interview administrators using technical documentation to understand the identity authentication methods and the cryptographic technologies and security equipment used. Check the compliance of cryptographic algorithms, the approval or certification of cryptographic products, and confirm the effectiveness of cryptographic functions. If password authentication is used, verify its anti-interception, anti-impersonation, and anti-reuse capabilities. Evaluation Methods: Verify the compliance of the authentication mechanism of cryptographic products or modules using cryptographic technology, referring to evaluation methods for authenticity implementation. Testing Functions Used: Testing functions A, B, and C.

[0057] The task of ensuring the integrity of access control information and sensitive labels, with the following evaluation indicators: Ensuring the integrity of access control policies, database table access control information, and sensitive labels for important information resources using cryptographic techniques. Evaluation targets: Application system administrators, application systems, cryptographic products (server cryptographic machines), and technical documentation. Evaluation implementation: Reviewing documentation and interviewing administrators to understand the system's methods for protecting the integrity of important information. If cryptographic techniques are used, checking the compliance and effectiveness of the algorithms and cryptographic products. Evaluation methods: Verifying whether the cryptographic product functions can be used for information integrity protection, checking the security of MAC or digital signature keys, and referring to storage integrity evaluation methods. Testing functions: Testing functions C, D, and E.

[0058] Evaluation Indicators for Important Data Transmission Confidentiality: Utilizing cryptographic techniques to ensure the confidentiality of important data transmission (such as authentication data, business data, user information, etc.). Evaluation Objects: Business systems, cryptographic products (server cryptographic machines), and technical documentation. Evaluation Implementation: Review the transmission confidentiality protection technologies and mechanisms in the documentation, verify their correctness and effectiveness, and check whether the cryptographic algorithms and products are compliant and functionally effective. Evaluation Methods: Check the confidentiality protection functions of the application layer communication protocol, focusing on key security. Network packet capture can be used for confirmation. Refer to the transmission confidentiality evaluation methods. Testing Functions: Testing functions B, C, and E.

[0059] The assessment of critical data storage confidentiality is based on the following evaluation metrics: ensuring the confidentiality of critical data storage through cryptographic technology. Evaluation objects include: business systems, cryptographic products (server cryptographic machines), and technical documentation. The assessment implementation involves reviewing the storage confidentiality protection technologies and mechanisms in the documentation, verifying their correctness and effectiveness, and checking the compliance and functionality of cryptographic algorithms and products. The assessment method depends on the storage method (encrypted hard drive, external storage encryption device, or server cryptographic machine-encrypted storage). The effectiveness of the protection mechanism is determined by reading data, capturing data entering and leaving cryptographic products, or reviewing logs, referring to the storage confidentiality assessment methods. Testing functions used include: functions B, C, and D.

[0060] The assessment of critical data transmission integrity is based on the following evaluation metrics: Ensuring the integrity of critical data transmission (such as authentication data, business data, and audit data) using cryptographic techniques. The assessment targets include: business systems, cryptographic products (server cryptographic machines, signature verification servers), and technical documentation. The assessment implementation involves reviewing the transmission integrity protection technologies and mechanisms in the documentation, verifying their correctness and effectiveness, and checking the compliance and functionality of cryptographic algorithms and products. The assessment method involves checking the application layer's protection functions using MAC or digital signature technologies, focusing on key security, which can be confirmed through network packet capture, and referring to the transmission integrity assessment methods. Testing functions used include: Functions B, C, and E.

[0061] Important data storage integrity task, evaluation indicator: Maintaining the integrity of important data storage using cryptographic technology. Evaluation objects: Business systems, cryptographic products (server cryptographic machines), and technical documentation. Evaluation implementation: Review the storage integrity protection technologies and mechanisms in the documentation, verify their correctness and effectiveness, and check whether the cryptographic algorithms and products are compliant and functionally effective. Evaluation method: Depending on the storage method (storage-type cryptographic products or storage after integrity protection is provided by server cryptographic machines), determine the effectiveness of the protection mechanism by reading data, capturing data entering and leaving the cryptographic products, or reviewing logs, referring to the storage integrity evaluation method. Testing functions used: Testing functions A, B, C, and D.

[0062] Non-repudiation task, evaluation indicators: In applications and data involving legal liability determination, use cryptographic technology to provide original and received evidence to ensure the non-repudiation of data origination and reception. Evaluation objects: Business systems, cryptographic products (certificate authentication systems, electronic signature systems, signature verification servers), and technical documentation. Evaluation implementation: Verify the use of cryptographic technology to ensure the non-repudiation of data transmission and reception in the technical documentation, and check the compliance and effectiveness of cryptographic technology and products. Evaluation method: Verify the compliance of cryptographic services (electronic authentication services) and related cryptographic products, referring to the non-repudiation evaluation method. Testing functions used: Testing functions B, C, and D.

[0063] S42. The distributed child nodes perform password application violation detection on the allocated sub-task packages, including: S421. Distributed child nodes call local password detection tools and resources to detect the allocated subtask packages; S422. Distributed child nodes report task execution progress, resource usage, and monitoring results to the management center; S423. The clustering distributed detection model reallocates the tasks to be detected, and the management center exchanges the allocated sub-task packages among the distributed sub-nodes through the central node.

[0064] Once the clustering distributed detection model assigns tasks involving identity authentication or data storage confidentiality checks to distributed child nodes, the distributed child nodes initiate the corresponding task execution process. First, based on the task requirements, it determines which detection functions' data needs to be invoked and how to process this data. For example, in a critical data transmission integrity task, it needs to obtain encryption configuration information for cryptographic products such as server cryptographic machines during data transmission from detection function B, obtain the usage of transmission cryptographic algorithms recorded in logs from detection function C, and obtain information related to data transmission encryption suites and integrity verification from network traffic from detection function E.

[0065] Distributed child nodes parse data from different sources. For cryptographic product data, they parse out information such as the product type, its operational status, and any abnormal calls. For government information system log data, they parse out event records and operation types related to user authentication or data storage operations. For network traffic data, they parse out information such as encryption protocols and cipher suites. These parsed data are then correlated according to task logic. For example, in important data storage confidentiality testing, the encryption settings in cryptographic products are correlated with data storage operation records in government information system logs and encryption during data transmission in network traffic to determine whether the data confidentiality protection meets requirements throughout the entire storage and transmission process.

[0066] Distributed child nodes perform comprehensive checks on the associated data based on the built-in architecture's detection capabilities. For confidentiality checks of critical data storage, this includes verifying the security and reliability of encryption algorithms used by cryptographic products, whether data storage operations in government information system logs followed the correct encryption process, and whether the encryption conversion during data transmission from network traffic to storage devices was correct.

[0067] During data processing and detection, distributed child nodes monitor for anomalies in real time, such as data format errors, missing data, and abnormal execution of detection algorithms. Once an anomaly is detected, it records detailed information, including the time of occurrence, the source of the data involved (e.g., which part of detection functions B, D, or E it pertains to), and the type of anomaly. The distributed child nodes then report this anomaly information to the management center. The management center determines whether to reassign tasks, adjust detection strategies, or optimize the resources of the distributed child nodes based on the anomaly. For example, if a distributed child node frequently experiences data parsing anomalies, it may be due to insufficient resources causing untimely data processing. The management center can then transfer some of its tasks to nodes with sufficient resources and perform resource expansion or troubleshooting on that node.

[0068] Distributed sub-nodes collaborate through information exchange with the management center. During the execution of various "Application and Data Security Testing" tasks, if a distributed sub-node encounters insufficient computing resources while performing a specific task—such as conducting cryptographic product compliance checks based on testing function B to support the integrity testing of important data storage—it will report the task execution progress and resource usage to the management center. Based on the overall task allocation and the resource status of other distributed sub-nodes, the management center, through the central node, will reassign some or all of the tasks in that sub-task package to other distributed sub-nodes with available resources, ensuring the smooth progress of all tasks and optimizing resource utilization.

[0069] Under the management mechanism of the clustered distributed detection model, the data acquired by the five detection functions can be shared and interacted among distributed child nodes to improve the detection accuracy of each task. For example, if a distributed child node discovers a clue to a suspected cryptographic violation while performing a task based on detection function D, it can share the relevant information with other distributed child nodes that are performing related tasks, such as identity authentication or data transmission confidentiality checks, and that may need the clue, thereby improving the entire system's ability to detect cryptographic violations.

[0070] S5. The central node aggregates the detection results of the distributed child nodes, processes the data, and outputs the detection evaluation result identifier.

[0071] The central node aggregates the detection results of the distributed sub-nodes and processes the data, outputting a detection evaluation result identifier. This includes the central node receiving the detection results from the distributed sub-nodes and forming a detection result dataset. The central node performs a consistency check on the data in the detection result dataset. If the data check results are inconsistent, a pending investigation identifier is generated. If the data is consistent, a detection evaluation result identifier is generated.

[0072] Consistency check formula: , in, Indicates the first This is a consistency flag for the test results corresponding to each test indicator. A value of 1 indicates that the test results reported by all distributed child nodes are consistent for that test indicator; a value of 0 indicates that there are inconsistencies. Based on this flag, a test evaluation result flag or a pending investigation flag is generated for the result corresponding to that test indicator. This represents the ID of the distributed child node, with a value ranging from 1 to... , This represents the total number of distributed child nodes that participated in the detection and reported the results. Indicates the number of the detection indicator. Indicates the first The distributed child node targets the first... The reported test results for each test indicator (the test results are expressed in numerical quantification).

[0073] In addition, the consistency of overall test results can be judged by combining multiple detection indicators, which can be expressed by the formula: , in, This indicates the overall consistency of the test results, with a value ranging from [0, 1]. A value closer to 1 indicates greater consistency across all test indicators, while a value closer to 0 indicates poorer overall consistency. A threshold can be set to compare and determine whether the final output is a test evaluation result label or a pending investigation label. This indicates the total number of indicators detected.

[0074] After completing comprehensive testing of multi-source data, the distributed sub-nodes generate corresponding test results. For example, for data storage confidentiality testing, the results will show whether the confidentiality protection during data storage meets the standards. The distributed sub-nodes report the test results to the management center. Simultaneously, if any violations affecting the tasks of other distributed sub-nodes or the security of the entire system are discovered during the testing process, such as finding widespread security vulnerabilities in a certain cryptographic product, it will also share this information with the management center and notify relevant departments to replace the cryptographic product.

[0075] Example 2 Reference Figure 2 This embodiment provides a government cloud commercial cryptography violation detection system, including: The detection requirement collection module is configured to collect and classify detection requirement information, and build a list of password violation behaviors based on the detection requirement information. The task acquisition module is configured to connect to the government cloud cryptographic application environment and acquire the characteristics of the tasks to be detected from the list of violations, wherein the characteristics of the tasks to be detected include resource usage identifiers and risk level identifiers. The execution difficulty estimation module is configured to obtain historical data on the detection capabilities of detection nodes for detecting password violations, use machine learning algorithms to build a task difficulty assessment model, and estimate the execution difficulty identifier of the features of the task to be detected. The task allocation module is configured to construct a clustered distributed detection model, which connects distributed nodes, including a central node and distributed sub-nodes. The execution difficulty identifier, a list of violations, and the characteristics of the task to be detected are input into the clustered distributed detection model. The clustered distributed detection model is used to allocate the task to be detected and output multiple allocation sub-task packages. The distributed sub-nodes perform password application violation detection on the allocation sub-task packages. The results evaluation module is configured such that the central node aggregates the detection results of the distributed child nodes, processes the data, and outputs a detection evaluation result identifier.

[0076] A computer-readable storage medium storing a plurality of instructions adapted to be loaded and executed by a processor of a terminal device, the aforementioned method for detecting cryptographic violations in a government cloud commercial application.

[0077] A terminal device includes a processor and a computer-readable storage medium, the processor being used to implement various instructions; the computer-readable storage medium being used to store multiple instructions, the instructions being adapted to be loaded and executed by the processor as described in the method for detecting violations of commercial cryptography in government cloud applications.

[0078] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting cryptographic violations in government cloud commercial applications, characterized in that, include: Collect and categorize testing requirements, and construct a list of password violations based on the testing requirements information; Connect to the government cloud cryptographic application environment to obtain the characteristics of the tasks to be detected in the list of violations, wherein the characteristics of the tasks to be detected include resource usage identifiers and risk level identifiers; The process of connecting to the government cloud cryptographic application environment and obtaining the characteristics of the tasks to be tested from the list of violations includes: configuring a secure connection interface with the government cloud cryptographic application environment; using system monitoring tools to collect resource usage data during the cryptographic application operation process as the basis for calculating resource occupancy identifiers; determining the risk level score of the task to be tested based on the risk assessment value of commercial cryptography; associating the obtained resource usage data and risk level score with the corresponding task to be tested to form a task to be tested feature dataset, and marking the elements in the task to be tested feature dataset with resource occupancy identifiers and risk level identifiers; Obtain historical data on the detection capabilities of detection nodes for password violations, and use machine learning algorithms to build a task difficulty assessment model to predict the execution difficulty of the features of the task to be detected. A clustering-based distributed detection model is constructed, connecting distributed nodes, including a central node and distributed child nodes. The model inputs execution difficulty indicators, a list of violations, and characteristics of the tasks to be detected. It then allocates these tasks, outputting multiple allocated sub-task packages. The distributed child nodes perform password application violation detection on these sub-task packages. The allocation of tasks using the clustering-based distributed detection model includes: constructing the clustering-based distributed detection model using K-means clustering; calculating the similarity between distributed child nodes based on their resource evaluation information, dividing the distributed child nodes into K clusters; and cluster distribution. The detection model calculates the allocation cost between the task to be detected and the distributed child nodes based on the characteristics of the task to be detected and the resource evaluation information of the distributed nodes. It then uses a clustering distributed detection model to allocate the task to be detected to the distributed child nodes, forming allocation sub-task packages. The distributed child nodes perform password application violation detection on the allocation sub-task packages, including: the distributed child nodes calling local password detection tools and resources to detect the allocation sub-task packages; the distributed child nodes reporting task execution progress, resource usage, and monitoring results to the management center; and the clustering distributed detection model reallocates the task to be detected, with the management center exchanging the allocation sub-task packages among the distributed child nodes through a central node. The clustering distributed detection model connects distributed nodes, including performing resource evaluation on the distributed child nodes and registering the resource evaluation information of the distributed child nodes in the management center of the clustering distributed detection model. The management center is used to allocate sub-task packages according to the resource status of the distributed child nodes. The central node aggregates the detection results of the distributed sub-nodes and processes the data, outputting a detection evaluation result identifier. This includes the central node receiving the detection results from the distributed sub-nodes to form a detection result dataset. The central node performs a consistency check on the data in the detection result dataset. If the data check results are inconsistent, a pending investigation identifier is generated. If the data is consistent, a detection evaluation result identifier is generated.

2. The method for detecting violations of commercial cryptographic rules in government cloud services according to claim 1, characterized in that, The detection requirement information includes cryptographic evaluation services, cryptographic products, business systems, and network traffic. The cryptographic evaluation services include cryptographic evaluation information data, cryptographic application scheme data, and cryptographic evaluation report data. The cryptographic products include commercial cryptographic product certification certificates, cryptographic product operation status data, call log data, and anomaly information data. The business systems include operation log data and anomaly information data. The network traffic includes encryption protocol data, encryption business data, and encryption algorithm data.

3. The method for detecting violations of commercial cryptographic rules in government cloud services according to claim 1, characterized in that, The process of collecting and classifying testing requirements includes data mining and feature extraction of the testing requirements, classifying the testing requirements using text classification algorithms, and identifying requirement descriptions related to security assessment services, cryptographic products, business systems, and network traffic.

4. The method for detecting violations of commercial cryptography in government cloud services according to claim 1, characterized in that, The process of obtaining historical password violation detection capability data of the detection node includes extracting historical password violation detection capability data from the detection node's log system, database records, and historical detection reports. The detection capability data is then preprocessed and formatted, including task characteristics and execution results. The task characteristics include password algorithm type, data size, and detection node configuration information. The execution results include execution time, resource consumption, and success / failure fields.

5. A government cloud commercial cryptographic violation detection system, characterized in that, The method according to any one of claims 1-4 comprises: The detection requirement collection module is configured to collect and classify detection requirement information, and build a list of password violation behaviors based on the detection requirement information. The task acquisition module is configured to connect to the government cloud cryptographic application environment and acquire the characteristics of the tasks to be detected from the list of violations, wherein the characteristics of the tasks to be detected include resource usage identifiers and risk level identifiers. The execution difficulty estimation module is configured to obtain historical data on the detection capabilities of detection nodes for detecting password violations, use machine learning algorithms to build a task difficulty assessment model, and estimate the execution difficulty identifier of the features of the task to be detected. The task allocation module is configured to construct a clustered distributed detection model, which connects distributed nodes, including a central node and distributed sub-nodes. The execution difficulty identifier, a list of violations, and the characteristics of the task to be detected are input into the clustered distributed detection model. The clustered distributed detection model is used to allocate the task to be detected and output multiple allocation sub-task packages. The distributed sub-nodes perform password application violation detection on the allocation sub-task packages. The results evaluation module is configured such that the central node aggregates the detection results of the distributed sub-nodes, processes the data, and outputs a detection evaluation result identifier.

Images