Security test method and device, electronic equipment and storage medium

Abstract

The invention provides a security testing method and device, electronic equipment and a storage medium, and relates to the technical field of application testing. The method comprises the following steps: acquiring a plaintext data message of a target application, and adding a type identifier to the plaintext data message to obtain a marked message; transmitting the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; and receiving the processed message returned by the server, and returning the processed message to the target application to continue to execute corresponding cryptographic processing. According to the method, the plaintext data message can be marked with the corresponding cryptographic processing step and then sent to the server side for the corresponding security test, and then the plaintext data message is returned, so that the flexible security test on the plaintext data message is realized, and the security test efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of application testing technology, and in particular to a safety testing method, device, electronic equipment and storage medium. Background Art

[0002] In recent years, with increasing security requirements for mobile applications, iOS apps have widely adopted encryption and hashing technologies to protect network data transmission. When conducting security checks on iOS apps, dynamic code injection techniques (such as the Hook plugin based on the Theos framework) are often used to intercept the encryption and decryption methods of the target application.

[0003] However, when using the Theos framework to perform security testing on iOS applications that encrypt messages, after hooking into the relevant methods to obtain the plaintext data message, tampering with the parameters requires tedious steps such as re-modifying the code, compiling, installing, and restarting. Summary of the Invention

[0004] The present invention provides a security testing method, device, electronic device and storage medium to solve the defect of the prior art that the steps for tampering with parameter strings in plaintext data messages are cumbersome. The method can mark the plaintext data message with the corresponding cryptographic processing steps and then send it to the server for corresponding security testing and then return the plaintext data message, thereby realizing flexible security testing of the plaintext data message and improving the efficiency of security testing.

[0005] The present invention provides a safety testing method, comprising the following steps: Obtaining a plaintext data message of a target application, and adding a type identifier to the plaintext data message to obtain a marked message, wherein the type identifier is used to characterize the cryptographic processing step corresponding to the plaintext data message; Transmitting the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; Receive the processed message returned by the server, and return the processed message to the target application to continue to perform corresponding cryptographic processing.

[0006] According to a security testing method provided by the present invention, the cryptographic processing includes encryption processing, hash processing, or decryption processing. The obtaining of a plaintext data message of a target application and adding a type identifier to the plaintext data message to obtain a marked message includes: Obtaining the plaintext data message by hooking a target parameter of the target application, where the target parameter is an encryption function, a hash function, or a decryption function; Determine the corresponding type identifier according to the function type of the target function. If the hooked function is an encryption function, add a first type identifier, which is used to represent the data before encryption. If the hooked function is a hash function, add a second type identifier, which is used to represent the data before hashing. If the hooked function is a decryption function, add a third type identifier, which is used to represent the data after decryption. The type identifier is added to the plaintext data message in the form of a preset character string prefix or a preset character string suffix to obtain the marked message.

[0007] According to a security testing method provided by the present invention, obtaining the plaintext data message by hooking the target parameters of the target application includes: Develop hook plug-ins based on the Theos framework; A method for implementing encryption, hashing or decryption functions in a target application by hooking the hook plug-in; In the hook method, the input parameter or return value is obtained as the plaintext data message.

[0008] According to a security testing method provided by the present invention, the server is implemented in any one of the following ways: Python HTTP Server; Web service developed by Flask framework; Web service developed by FastAPI framework; HTTP service implemented in Java language.

[0009] According to a security testing method provided by the present invention, the processed message is obtained by the server performing the following operations: Parsing the type identifier in the marked message to determine the cryptographic processing steps corresponding to the plaintext data message; Removing the type identifier in the message after the mark to obtain the original plaintext data message; The processed message is obtained by performing a monitoring or tampering operation on the original plaintext data message according to the cryptographic processing steps.

[0010] According to a security testing method provided by the present invention, performing a monitoring or tampering operation on the original plaintext data message according to the cryptographic processing step to obtain the processed message includes: When the cryptographic processing step is before encryption, performing value replacement or format modification on a specified parameter in the original plaintext data message; When the cryptographic processing step is before hashing, injecting abnormal test data into the original plaintext data message; When the cryptographic processing step is after decryption, the content of the original plaintext data message and the receiving timestamp are recorded.

[0011] The present invention also provides a safety testing device, comprising the following modules: an identification adding module, configured to obtain a plaintext data message of a target application and add a type identification to the plaintext data message to obtain a marked message, wherein the type identification is used to characterize the cryptographic processing step corresponding to the plaintext data message; A message processing module, configured to transmit the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; The message recovery module is used to receive the processed message returned by the server and return the processed message to the target application to continue to perform corresponding cryptographic processing.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements any of the above-described security testing methods when executing the computer program.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements any of the above-described security testing methods when executed by a processor.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned security testing methods.

[0015] The security testing method, device, electronic device, and storage medium provided by the present invention obtain a plaintext data message from a target application, add a type identifier to the plaintext data message, and obtain a marked message; transmit the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; receive the processed message returned by the server, and return the processed message to the target application to continue performing the corresponding cryptographic processing. This method can mark the plaintext data message with the corresponding cryptographic processing step, send it to the server for the corresponding security test, and then return the plaintext data message, thus achieving flexible security testing of the plaintext data message and improving the efficiency of security testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a flow chart of the safety testing method provided by the present invention.

[0018] Figure 2 It is a flow chart of the method for obtaining marked messages provided by the present invention.

[0019] Figure 3 This is a schematic diagram of the data flow when the APP provided by the present invention is running normally.

[0020] Figure 4 It is a schematic diagram of the data flow guided by the method provided by the present invention.

[0021] Figure 5 It is a structural schematic diagram of the safety testing device provided by the present invention.

[0022] Figure 6 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0024] In recent years, with increasing security requirements for mobile applications, iOS apps have widely adopted encryption and hashing technologies to protect network data transmission. When conducting security checks on iOS apps, dynamic code injection techniques (such as the Hook plugin based on the Theos framework) are often used to intercept the encryption and decryption methods of the target application.

[0025] However, when using the Theos framework to perform security testing on iOS applications that encrypt messages, after hooking into the relevant methods to obtain the plaintext data message, tampering with the parameters requires tedious steps such as re-modifying the code, compiling, installing, and restarting.

[0026] In view of this, an embodiment of the present invention provides a security testing method, comprising obtaining a plaintext data message of a target application, adding a type identifier to the plaintext data message to obtain a marked message; transmitting the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; receiving the processed message returned by the server, and returning the processed message to the target application to continue performing the corresponding cryptographic processing. This method can mark the plaintext data message with the corresponding cryptographic processing step, send it to the server for the corresponding security test, and then return the plaintext data message, thereby achieving flexible security testing of the plaintext data message and improving the efficiency of security testing.

[0027] The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.

[0028] Figure 1 : is a flow chart of the security testing method provided by the present invention. The security testing method can be applied to electronic devices, which can be various types of devices with information processing capabilities during implementation. For example, the electronic device can include a personal computer, a laptop, a PDA or a server, etc.; the electronic device can also be a mobile terminal, for example, the mobile terminal can include a mobile phone, a car computer, a tablet computer or a projector, etc. Figure 1 As shown, the method may include the following steps 101 to 103: Step 101: Obtain a plaintext data message of a target application, and add a type identifier to the plaintext data message to obtain a marked message, wherein the type identifier is used to characterize the cryptographic processing step corresponding to the plaintext data message.

[0029] It should be noted that the method for obtaining the plaintext data message of the target application can adopt dynamic code injection (Hook technology) or network traffic middleman interception, so the present invention does not limit the method for obtaining the plaintext data message of the target application.

[0030] Among them, the method of adding a type identifier to the plaintext data message can adopt a prefix / suffix marking method, a JSON metadata nesting method, etc., so the present invention does not limit the method of adding a type identifier to the plaintext data message.

[0031] Step 102: Transmit the marked message to the server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message.

[0032] It should be noted that the marked message may be transmitted to the server via HTTP / HTTPS protocol or WebSocket long connection, and the present invention does not limit the method of transmitting the marked message to the server.

[0033] In addition, the method by which the server performs corresponding security testing on the marked message according to the type identifier may be a dynamic rule injection test, or a differentiated strategy testing engine, etc. The present invention does not limit the manner in which the server performs corresponding security testing on the marked message according to the type identifier.

[0034] Step 103: Receive the processed message returned by the server, and return the processed message to the target application to continue executing the corresponding cryptographic processing.

[0035] It should be noted that after receiving the processed message returned by the server, the method of returning the processed message to the target application to continue executing the corresponding cryptographic processing can adopt return value replacement type return, asynchronous callback injection type return, etc. The present invention does not limit the method of returning the processed message to the target application to continue executing the corresponding cryptographic processing.

[0036] As can be understood, the security testing method provided by the present invention obtains the target application's plaintext data packets, adds a cryptographic processing type identifier, and then transmits the data to a preset server. The preset server can then perform the corresponding security test as needed and, after the test is complete, return the data for further cryptographic processing. This enables flexible security testing of plaintext data packets, avoids the tedious steps of re-modifying the interception plug-in code, compiling, installing, and restarting it, and improves the efficiency of security testing.

[0037] Figure 2 FIG. 1 is a flow chart of the method for obtaining a marked message provided by the present invention. Figure 2 As shown, the cryptographic processing includes encryption processing, hash processing or decryption processing. The step 101 obtains the plaintext data message of the target application and adds a type identifier to the plaintext data message to obtain the marked message, which may include: Step 201: Obtain the plaintext data message by hooking the target parameter of the target application, where the target parameter is an encryption function, a hash function, or a decryption function.

[0038] It should be noted that you can use theos to develop a hook plug-in to hook the encryption / hash method to obtain the plaintext HTTP request message, mark the plaintext HTTP request message according to the (encryption / hash) type, and then send it to the preset server; or use theos to develop a hook plug-in to hook the decryption method to obtain the plaintext HTTP response message, mark the plaintext HTTP response message as needed, and then send it to the preset server.

[0039] Step 202: Determine the corresponding type identifier based on the function type of the target function, wherein, if the hooked function is an encryption function, add a first type identifier, and the first type identifier is used to represent the data before encryption; if the hooked function is a hash function, add a second type identifier, and the second type identifier is used to represent the data before hashing; if the hooked function is a decryption function, add a third type identifier, and the third type identifier is used to represent the data after decryption.

[0040] It should be noted that different function types can be marked with different type identifiers. If the function being hooked is an encryption function, the first type identifier is added; if the function being hooked is a hash function, the second type identifier is added; if the function being hooked is a decryption function, the third type identifier is added.

[0041] Step 203: Add the type identifier to the plaintext data message in the form of a preset character string prefix or a preset character string suffix to obtain the marked message.

[0042] It should be noted that the marking may be performed by adding a prefix or suffix string to the original string, that is, adding the first type identifier, the second type identifier, or the third type identifier to the prefix or suffix of the original plaintext data message.

[0043] It is understandable that the above method can maintain the persistence of the hook plug-in while flexibly determining the corresponding cryptographic processing steps and type identification of the plaintext parameter data, thereby laying the foundation for server-side inspection and modification, and avoiding tedious steps such as re-modifying the hook plug-in code, compiling, installing, and restarting.

[0044] In some embodiments, the obtaining of the plaintext data message by hooking the target parameters of the target application, where the target parameters are encryption functions, hash functions, or decryption functions, may include: developing a hook plug-in based on the Theos framework; hooking the target application through the hook plug-in to implement a method for encryption, hashing, or decryption functions; and obtaining input parameters or return values ​​in the hook method as the plaintext data message.

[0045] It should be noted that the present invention develops a hook plug-in through the Theos framework, and guides the APP plaintext data flow to the preset server through the hook plug-in. While maintaining the persistence of the hook plug-in, the corresponding cryptographic processing steps and type identification of the plaintext parameter data can be flexibly determined, so that the preset server can monitor the APP plaintext HTTP request / response data messages, and can also tamper with the data according to needs for security tests.

[0046] In some embodiments, the server is implemented in any one of the following ways: a Python HTTP Server; a Web service developed with a Flask framework; a Web service developed with a FastAPI framework; or an HTTP service implemented in Java.

[0047] For example, the preset server can use Python's http server tool, or tools such as flask, fastapi, etc. to quickly complete the server construction, or other servers implemented in languages ​​such as Java to meet the corresponding functions.

[0048] In some embodiments, the processed message is obtained by the server performing the following operations: parsing the type identifier in the marked message to determine the cryptographic processing steps corresponding to the plaintext data message; removing the type identifier in the marked message to obtain the original plaintext data message; performing monitoring or tampering operations on the original plaintext data message according to the cryptographic processing steps to obtain the processed message.

[0049] It should be noted that the present invention establishes a preset server to start service monitoring, which is used to collect the plaintext data messages sent by the hook plug-in, and distinguish whether they are messages before encryption, before hashing, or plaintext response messages after decryption, etc. according to the mark, and then removes the cryptographic processing steps corresponding to the mark and returns it to the hook plug-in after security testing. Here, the security test can tamper with specific message data according to the test requirements, such as the content of a specific parameter.

[0050] It is understandable that the server performs real-time monitoring based on the collected plaintext HTTP request and response data, and can tamper with the data as needed to perform security testing, thereby improving the efficiency of security testing.

[0051] Furthermore, the monitoring or tampering operation performed on the original plaintext data message according to the cryptographic processing step to obtain the processed message may include: when the cryptographic processing step is before encryption, replacing the value or modifying the format of the specified parameters in the original plaintext data message; when the cryptographic processing step is before hashing, injecting abnormal data for testing into the original plaintext data message; when the cryptographic processing step is after decryption, recording the content and receiving timestamp of the original plaintext data message.

[0052] It is understandable that the security testing method provided by the present invention can utilize the Theos framework to develop encryption methods, hash methods, or decryption methods for hooking data messages. After hooking the method, the data message type is marked (marking can be done by adding prefixes or suffixes to the original string), and then sent to the preset server. The server can distinguish the data message type based on the mark, remove the cryptographic processing steps corresponding to the mark, and return it to the hook plug-in as is. The server can monitor the plaintext HTTP requests and responses and tamper with the plaintext data messages according to the test requirements. This avoids the tedious steps of re-modifying the code, compiling, installing, and restarting the hook plug-in, thereby improving the efficiency of security testing.

[0053] The following describes an exemplary application of an embodiment of the present invention in a practical application scenario.

[0054] Figure 3 This is a schematic diagram of the data flow when the APP provided by the present invention is running normally. Figure 3 As shown, the plaintext data is processed by the encryption / hash method to obtain the ciphertext / hash summary value, and the ciphertext data is processed by the decryption method to obtain the plaintext data.

[0055] Figure 4 This is a schematic diagram of the data flow guided by the method provided by the present invention. Figure 4 As shown, scenario one includes the following steps: 1. Method input to obtain plaintext data; 2. Hook obtains plaintext parameters, marks the corresponding cryptographic processing steps, and sends them to the preset server; 3. The preset server distinguishes the source and type of plaintext data based on the mark; removes the mark and returns the plaintext data as is; monitors the plaintext data and modifies the plaintext data as needed for security testing; 4. The preset server returns the plaintext data; 5. The plaintext data continues to be encrypted / hashed to obtain the ciphertext / hash summary value.

[0056] Scenario 2 includes the following steps: 1. Obtain ciphertext data; 2. Obtain decrypted data through a decryption method; 3. Obtain plaintext data through the method return value; 4. Hook obtains the plaintext method return value, marks the corresponding cryptographic processing step, and sends it to the preset server; 5. The preset server distinguishes the source and type of the plaintext data based on the mark, removes the mark and returns the plaintext data as is, monitors the plaintext data, and modifies the plaintext data as needed for security testing; 6. The preset server returns the plaintext data; 7. The plaintext data continues to execute subsequent steps.

[0057] This method implements the idea of ​​directing the flow of plaintext data during cryptographic processing (encryption / hashing / decryption). Due to the persistence of Theos, flexible modifications to certain content often require recompilation, installation, and restart. The security testing method provided by this invention allows for flexible data message tampering while maintaining persistence, avoiding the tedious tasks of recompiling hook plugins, installing hooks, and restarting applications, thereby improving security testing efficiency.

[0058] Based on the foregoing embodiments, an embodiment of the present invention provides a safety testing device. The modules included in the device and the units included in each module can be implemented by a processor; of course, they can also be implemented by specific logic circuits. During implementation, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0059] The safety testing device provided by the present invention is described below. The safety testing device described below and the safety testing method described above can be referenced to each other.

[0060] Figure 5 This is a schematic diagram of the structure of the safety test device provided by the present invention. Figure 5 As shown, the apparatus 300 includes an identification adding module 301, a message processing module 302, and a message recovery module 303, wherein: The identifier adding module 301 is used to obtain a plaintext data message of a target application and add a type identifier to the plaintext data message to obtain a marked message, wherein the type identifier is used to indicate the cryptographic processing step corresponding to the plaintext data message; The message processing module 302 is used to transmit the marked message to the server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; The message recovery module 303 is configured to receive the processed message returned by the server, and return the processed message to the target application to continue executing corresponding cryptographic processing.

[0061] In some embodiments, the cryptographic processing includes encryption processing, hash processing or decryption processing, and the identification adding module 301 includes a message acquisition unit, a type determination unit and a type marking unit, wherein: The message acquisition unit is configured to acquire the plaintext data message by hooking a target parameter of the target application, where the target parameter is an encryption function, a hash function, or a decryption function; The type determination unit is configured to determine a corresponding type identifier according to the function type of the target function, wherein if the hooked function is an encryption function, a first type identifier is added, and the first type identifier is used to represent the data before encryption; if the hooked function is a hash function, a second type identifier is added, and the second type identifier is used to represent the data before hashing; if the hooked function is a decryption function, a third type identifier is added, and the third type identifier is used to represent the data after decryption; The type marking unit is used to add the type identifier to the plaintext data message in the form of a preset character string prefix or a preset character string suffix to obtain the marked message.

[0062] In some embodiments, the message acquisition unit is specifically used to: develop a hook plug-in based on the Theos framework; hook a method of implementing encryption, hashing or decryption functions in the target application through the hook plug-in; and obtain input parameters or return values ​​in the hook method as the plaintext data message.

[0063] In some embodiments, the server is implemented in any one of the following ways: a Python HTTP Server; a Web service developed with a Flask framework; a Web service developed with a FastAPI framework; or an HTTP service implemented in Java.

[0064] In some embodiments, the processed message is obtained by the server performing the following operations: parsing the type identifier in the marked message to determine the cryptographic processing steps corresponding to the plaintext data message; removing the type identifier in the marked message to obtain the original plaintext data message; performing monitoring or tampering operations on the original plaintext data message according to the cryptographic processing steps to obtain the processed message.

[0065] In some embodiments, the server is specifically used to: when the cryptographic processing step is before encryption, replace the value or modify the format of the specified parameter in the original plaintext data message; when the cryptographic processing step is before hashing, inject abnormal data for testing into the original plaintext data message; when the cryptographic processing step is after decryption, record the content and receiving timestamp of the original plaintext data message.

[0066] In an embodiment of the present invention, the plaintext data message can be marked with the corresponding cryptographic processing steps and then sent to the server for corresponding security testing and then returned to the plaintext data message, thereby realizing flexible security testing of the plaintext data message and improving the efficiency of security testing.

[0067] Figure 6 Schematic diagram of the physical structure of the electronic device provided by the present invention. Figure 6 As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other via the communications bus 440. The processor 410 may call logic instructions in the memory 430 to execute a security testing method, which includes: obtaining a plaintext data message of a target application, adding a type identifier to the plaintext data message to obtain a marked message, wherein the type identifier is used to represent the cryptographic processing step corresponding to the plaintext data message; transmitting the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; receiving the processed message returned by the server, and returning the processed message to the target application to continue to perform the corresponding cryptographic processing.

[0068] Furthermore, the logic instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0069] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the security testing method provided by the above methods, which includes: obtaining a plaintext data message of the target application, and adding a type identifier to the plaintext data message to obtain a marked message, wherein the type identifier is used to characterize the cryptographic processing steps corresponding to the plaintext data message; transmitting the marked message to a server, so that the server performs corresponding security testing on the marked message according to the type identifier to obtain a processed message; receiving the processed message returned by the server, and returning the processed message to the target application to continue to perform corresponding cryptographic processing.

[0070] The computer program product includes one or more computer instructions. When loaded and executed on a computer, the computer program instructions fully or partially perform the processes or functions described in accordance with the embodiments of the present invention. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium capable of computer storage or a data storage device such as a server or data center that integrates one or more available media. The available medium may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0071] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the security testing method provided by the above-mentioned methods, the method comprising: obtaining a plaintext data message of a target application, and adding a type identifier to the plaintext data message to obtain a marked message, wherein the type identifier is used to characterize the cryptographic processing steps corresponding to the plaintext data message; transmitting the marked message to a server, so that the server performs corresponding security testing on the marked message according to the type identifier to obtain a processed message; receiving the processed message returned by the server, and returning the processed message to the target application to continue to perform corresponding cryptographic processing.

[0072] The computer-readable storage medium may be any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0073] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0074] Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0075] Computer program code for performing the operations of this specification may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0076] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0077] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A security testing method, characterized in that: include: Obtaining a plaintext data message of a target application, and adding a type identifier to the plaintext data message to obtain a marked message, wherein the type identifier is used to characterize the cryptographic processing step corresponding to the plaintext data message; Transmitting the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; Receive the processed message returned by the server, and return the processed message to the target application to continue to perform corresponding cryptographic processing.

2. The safety testing method according to claim 1, characterized in that: The cryptographic processing includes encryption processing, hash processing, or decryption processing. The obtaining of the plaintext data message of the target application and adding a type identifier to the plaintext data message to obtain a marked message includes: Obtaining the plaintext data message by hooking a target parameter of the target application, where the target parameter is an encryption function, a hash function, or a decryption function; Determine the corresponding type identifier according to the function type of the target function. If the hooked function is an encryption function, add a first type identifier, which is used to represent the data before encryption. If the hooked function is a hash function, add a second type identifier, which is used to represent the data before hashing. If the hooked function is a decryption function, add a third type identifier, which is used to represent the data after decryption. The type identifier is added to the plaintext data message in the form of a preset character string prefix or a preset character string suffix to obtain the marked message.

3. The safety testing method according to claim 2, characterized in that: The obtaining of the plaintext data message by hooking the target parameter of the target application includes: Develop hook plug-ins based on the Theos framework; A method for implementing encryption, hashing or decryption functions in a target application by hooking the hook plug-in; In the hook method, the input parameter or return value is obtained as the plaintext data message.

4. The safety testing method according to claim 1, wherein: The processed message is obtained by the server performing the following operations: Parsing the type identifier in the marked message to determine the cryptographic processing steps corresponding to the plaintext data message; Removing the type identifier in the message after the mark to obtain the original plaintext data message; The processed message is obtained by performing a monitoring or tampering operation on the original plaintext data message according to the cryptographic processing steps.

5. The safety testing method according to claim 4, characterized in that: The performing of a monitoring or tampering operation on the original plaintext data message according to the cryptographic processing step to obtain the processed message includes: When the cryptographic processing step is before encryption, performing value replacement or format modification on a specified parameter in the original plaintext data message; When the cryptographic processing step is before hashing, injecting abnormal test data into the original plaintext data message; When the cryptographic processing step is after decryption, the content of the original plaintext data message and the receiving timestamp are recorded.

6. The safety testing method according to claim 1, characterized in that: The server is implemented in any of the following ways: HTTP Server in Python; Web service developed by Flask framework; Web service developed by FastAPI framework; HTTP service implemented in Java language.

7. A safety testing device, characterized in that: include: an identification adding module, configured to obtain a plaintext data message of a target application and add a type identification to the plaintext data message to obtain a marked message, wherein the type identification is used to characterize the cryptographic processing step corresponding to the plaintext data message; A message processing module, configured to transmit the marked message to a server, so that the server performs a corresponding security test on the marked message according to the type identifier to obtain a processed message; The message recovery module is used to receive the processed message returned by the server and return the processed message to the target application to continue to perform corresponding cryptographic processing.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the security testing method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the security testing method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the security testing method according to any one of claims 1 to 6 is implemented.

Images