A method and system for analyzing the compliance and validity of data of a cryptographic assessment object based on cryptographic algorithm data feature analysis.

Abstract

This invention provides a method and system for analyzing the compliance and validity of data in a cryptographic evaluation object based on cryptographic algorithm data features. The method includes: S1. obtaining the data format; S2. calculating the data length; S3. obtaining a pairing set of symmetric cryptographic algorithm names and their block lengths; S4. obtaining a pairing set of cryptographic hash algorithm names and their hash value lengths; S5. determining whether it conforms to the digital signature features of an asymmetric cryptographic algorithm; S6. determining whether it conforms to the digital envelope features specified in the cryptographic evaluation; S7. determining whether it conforms to the digital certificate features specified in the cryptographic evaluation; and S8. outputting the feature group results for the cryptographic evaluation task. The system can automatically perform structural parsing on the input raw data to obtain feature groups P, R, and Y. Based on the comprehensive analysis of the feature groups, the analysis results are quantitatively scored, and this score is added to the total score of the cryptographic evaluation report to draw a conclusion on whether the cryptographic application of the information system conforms to compliance and validity.

Description

Technical Field

[0001] This invention relates to the field of cryptographic evaluation technology and the field of cryptographic algorithm data feature analysis, and in particular to a method and system for analyzing the compliance and validity of cryptographic evaluation object data based on cryptographic algorithm data feature analysis. Background Technology

[0002] According to the "Administrative Measures for Security Assessment of Commercial Cryptography Applications," operators of important networks and information systems should conduct a commercial cryptography application security assessment (hereinafter referred to as "cryptography assessment") at least once a year. Cryptography assessment is a crucial step in ensuring the compliance of information systems and preventing data leakage and cyberattacks. The assessment results must be presented in a standardized cryptography assessment report. Cryptography assessment is a complex, time-consuming, and costly process. Currently, one of the core tasks of cryptography assessment is to accurately determine the compliance and effectiveness of the cryptographic algorithms used by the assessed entity. Compliance of cryptographic algorithms / technologies refers to whether they meet the technical standards stipulated in the cryptography assessment, while effectiveness refers to whether the algorithm can achieve the corresponding requirements after use. The cryptography assessment process scores cryptographic algorithms / technologies based on their specific compliance and effectiveness, and the scores are then summarized and reflected in the final cryptography assessment report to evaluate whether the overall security of the cryptographic applications of the assessed information system meets the basic requirements.

[0003] In specific cryptographic evaluation work, the raw data collected by the evaluator from the evaluation object's information system is usually not directly identified by the cryptographic algorithm used. Therefore, it is necessary to rely on the feature analysis of the raw data to infer the actual algorithm type and implementation method used, thereby supporting the objectivity and accuracy of the evaluation conclusion.

[0004] Currently, there is a lack of standardized, dedicated analysis tools in this field. In practice, cryptographic evaluators often rely on general-purpose readers (such as ASN.1) to decode encoded data and then perform manual analysis. This method has significant shortcomings: First, general-purpose readers are not tailored for cryptographic evaluation work and cannot automatically identify specific object identifiers and data structures using national cryptographic algorithms (such as SM2 / SM3 / SM4), lacking built-in compliance judgment rules; second, after successful decoding, cryptographic evaluators still need to manually analyze the parsed data structures one by one, such as comparing the ASN.1 format of digital signatures, digital envelopes, and digital certificates to verify whether they meet the requirements of cryptographic algorithm compliance and validity. The entire process is complex, time-consuming, costly, highly dependent on personal experience, difficult to promote, and prone to introducing the risk of misjudgment.

[0005] Therefore, the data analysis stage of the current confidentiality assessment work is still a manual process that combines general tools with expert experience, which requires a high level of professional competence from the assessors. This also highlights the urgent need to develop automated and intelligent confidentiality assessment tools. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of the prior art mentioned above by providing a method and system for analyzing the compliance and validity of cryptographic evaluation object data based on cryptographic algorithm data features. This provides an automated and intelligent solution for cryptographic evaluation work to determine whether the cryptographic algorithm of the original data to be analyzed meets the requirements for compliance and validity of cryptographic evaluation, greatly improving the efficiency and accuracy of cryptographic evaluation work and reducing the reliance on expert experience.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A method for analyzing the compliance and validity of cryptographic assessment object data based on cryptographic algorithm data feature analysis, the method comprising:

[0009] Step S1. Obtain data format: Obtain the raw data D to be analyzed in binary format of the evaluation object;

[0010] Step S2. Calculate data length: Calculate and obtain the length L in bytes of the original data D to be analyzed;

[0011] Step S3. Obtain the pairing set of symmetric cryptographic algorithm names and their block lengths: Obtain the symmetric cryptographic algorithm name N and its corresponding block length G, forming a pair of algorithm name N and its block length G, and forming a first set S; Calculate the multiple relationship between the block length G of each pair and the number of bytes L. If the number of bytes L is divisible by the block length G, then form a second set S' with the pairs corresponding to the divisible block length G; Add the algorithm name N in the second set S' to the possible feature group P, and add the algorithm name N in the first set S but not in the second set S' to the exclusion feature group R;

[0012] Step S4. Obtain the pairing set of cryptographic hash algorithm name and its hash value length: Obtain the cryptographic hash algorithm name M and its corresponding hash value length Q, forming a pair of hash algorithm name M and hash value length Q, and forming a third set H; compare the hash value length Q of each pair with the size relationship of the number of bytes L, and form a fourth set H' with the pair of hash value length Q that are the same as the number of bytes L after comparison; add the hash algorithm name M in the fourth set H' to the possible feature group P, and add the hash algorithm name M in the third set H but not in the fourth set H' to the exclusion feature group R;

[0013] Step S5. Determine whether it conforms to the digital signature characteristics of an asymmetric cryptographic algorithm: Decode the original data D to be analyzed using the digital signature format specified by the asymmetric cryptographic algorithm. If the decoding result is successful, add the decoding result and the name of the asymmetric cryptographic algorithm to the determined feature group Y; otherwise, add it to the excluded feature group R.

[0014] Step S6. Determine whether it meets the digital envelope characteristics specified in the confidentiality assessment: Decode the original data D to be analyzed in the format specified in the digital envelope. If the decoding result is successful, add the decoding result and the name of the digital envelope algorithm to the determined feature group Y; otherwise, add it to the excluded feature group R.

[0015] Step S7. Determine whether the digital certificate meets the requirements of the security assessment: Decode the original data D to be analyzed in the format specified by the digital certificate. If the decoding result is successful, add the decoding result and the name of the digital certificate algorithm to the determined feature group Y; otherwise, add it to the excluded feature group R.

[0016] Step S8. Output feature group results for confidentiality assessment: Output the determined feature group Y, the possible feature group P, and the excluded feature group R, which are used to provide a basis for judging the compliance and validity of the data of the confidentiality assessment object in the confidentiality assessment operation.

[0017] This method analyzes the length characteristics of ciphertext and hash values ​​to generate a possible feature group P and an exclusion feature group R, serving as the basis for preliminary algorithm identification. Simultaneously, the tool incorporates the standard structures for digital signatures, digital envelopes, and digital certificates as defined in the cryptographic evaluation guidelines. The data to be analyzed is then structured and parsed. During parsing, successfully decoded results and their corresponding algorithm names are assigned to the confirmed feature group Y, while failed decoding algorithm names are assigned to the exclusion feature group R. Based on the comprehensive analysis results of feature groups P, R, and Y, and a quantitative score is applied, this score is ultimately included in the total score of the cryptographic evaluation report, leading to a conclusion on whether the cryptographic application of the information system under evaluation complies with compliance and effectiveness.

[0018] In step S8, if feature group Y contains the name of any compliant algorithm specified in the confidential assessment, the compliance and validity of the assessment data are directly determined to meet the requirements; if feature group R excludes names containing the names of all compliant algorithms specified in the confidential assessment, the compliance and validity of the assessment data are determined to not meet the requirements.

[0019] Specifically, step S8 uses a sequential elimination method to analyze whether the compliance and validity of the assessment object data meet the requirements. First, by determining whether feature group Y contains the name of any compliance algorithm specified in the confidential assessment, it is possible to directly determine whether the assessment object data meets the requirements. This determination method provides a "fast track" for objects that use mature, robust, and effective algorithms, avoiding unnecessary in-depth analysis, saving a lot of computing resources and time, and enabling the data analysis system to focus on high-risk or marginal cases that truly require in-depth review.

[0020] Secondly, if all the algorithm names used by the evaluation object are included in the exclusion feature group R, then the evaluation object data can be directly and decisively determined to be non-compliant. This design establishes a solid "safety bottom line" and adopts a "one-vote veto" mechanism, which can instantly identify high-risk and non-compliant data, effectively preventing it from slipping through the cracks, and demonstrating the rigor and security of the system.

[0021] In step S8 above, if the feature group P contains the name of any algorithm, the compliance and validity of the evaluation object data are initially determined to meet the requirements; then, the specified use and actual use of the algorithm in feature group P are analyzed again. If they match, the compliance and validity are determined to meet the requirements; if they do not match, the compliance is determined to meet the requirements, but the validity is not.

[0022] Specifically, in step S8, it is further determined whether the possible feature group P consists only of algorithms that cannot achieve password validity, such as hash algorithms. If the corresponding evaluation unit is used for identity authentication and confidentiality, it meets compliance requirements but not validity requirements, thus concluding that its validity is invalid. This method adds a secondary verification mechanism based on the possible feature group P, upgrading this evaluation method from an efficient initial screening tool to a smart, comprehensive security assessment system with deep analysis capabilities and scenario-based judgment. This mechanism not only improves the accuracy and practicality of the evaluation but also achieves a technological leap from static compliance detection to dynamic validity verification.

[0023] In step S8, the confidential assessment work assigns different quantitative scores based on whether the compliance and validity of the assessment object's data meet the requirements. These quantitative scores are then included in the total score of the confidential assessment report.

[0024] Specifically, this quantitative scoring mechanism transforms the original binary qualitative conclusion of "compliant / non-compliant" into quantifiable and comparable continuous scoring values. This transformation not only makes the presentation of assessment results more refined but also significantly enhances its structured expression in reports. By automatically generating scores through pre-set objective rules, the system effectively eliminates human subjective bias in the scoring process, thereby ensuring the standardization of the assessment process and the fairness of the conclusions.

[0025] Furthermore, the various quantitative scores are systematically aggregated into the overall score of the security assessment report, and the generated analysis report includes all key data characteristics. This transforms the report from a single-dimensional compliance statement into a comprehensive decision support document that integrates quantitative assessment of security maturity, visual analysis of risk posture, and guidance on prioritizing remedial measures. This significantly enhances the report's management value and practical guidance, enabling assessors to fully understand the data characteristics and providing decision-makers at all levels with clear and reliable security governance basis, thereby improving the depth and breadth of security assessments.

[0026] In step S1, the initial data of the object to be evaluated and its encoding format are first obtained. If the encoding format of the initial data is not binary, it is decoded into binary format to obtain the original data D to be analyzed. If the initial data is in binary format, it is directly used as the original data D to be analyzed.

[0027] Specifically, the initial data collected by the evaluators during the assessment process comes from the information system being tested and is typically stored in binary format. This data may be dynamically generated computational data during system operation and may have undergone specific encoding processing before collection. If the initial data collected is unencoded raw binary data, it can be analyzed directly without additional decoding steps.

[0028] This system automatically identifies data encoding formats and performs standardized decoding, effectively avoiding delays and biases that may be introduced by manual judgment and conversion. It uniformly restores various encoding formats such as Base64 and Hex hexadecimal to a standard binary stream, providing a stable, consistent, and standardized data input interface for all subsequent analysis modules. This step ensures the integrity of the data processing chain and the accuracy of the analysis results. When the initial data is already in binary format, the system automatically skips the decoding step and directly enters the analysis process. This design significantly saves unnecessary computational overhead and time delays, enabling the system to start core analysis tasks at the optimal path, thereby greatly improving overall processing efficiency, especially suitable for high-concurrency scenarios requiring rapid batch evaluation of massive targets.

[0029] In step S3 above, the name of the symmetric cryptography algorithm is obtained from the technical standard.

[0030] In step S4 above, the name of the cryptographic hash algorithm is obtained from the technical standard.

[0031] Specifically, steps S3 and S4 establish an algorithm feature library based directly on national standards (such as the GB / T series), national industry standards (such as the GM / T series), and international standards (ISO / IEC series). This library contains various algorithms specified in the technical standards, providing a unified and authoritative basis for identifying symmetric cryptographic algorithms and cryptographic hash algorithms. This avoids misjudgments caused by individual misunderstandings or the use of non-standard parameters from the outset.

[0032] The names of the asymmetric cryptography algorithm in step S5, the digital envelope algorithm in step S6, and the digital certificate algorithm in step S7 are all obtained from technical standards.

[0033] Specifically, anchoring the source of algorithm names to authoritative technical standards is a crucial systemic design decision. It fundamentally solves the problem of "where the measuring stick comes from" in evaluation work, providing institutional guarantees for the entire evaluation system in terms of authority, objectivity, consistency, and sustainability. It is the cornerstone for ensuring the long-term effectiveness, widespread acceptance, and trustworthiness of evaluation work.

[0034] In steps S5, S6, and S7, the decoding format is pre-selected and set, and then built into the analysis tool.

[0035] Specifically, conventional reader parsing requires evaluators to manually compare each item against standard documents. This technical solution, however, automates parsing through a built-in standard structure. By incorporating the structural standards for digital signatures, digital envelopes, and digital certificates specified by asymmetric cryptographic algorithms into the tool, the system can automatically and accurately identify whether data contains these structures. This technical feature solves the inefficiency of traditional methods that rely on manual parsing of structures, achieving accurate identification of cryptographic algorithms.

[0036] This invention also provides a system for analyzing the compliance and validity of data of a security assessment object based on cryptographic algorithm data features. The system applies the aforementioned method for analyzing the compliance and validity of data of a security assessment object based on cryptographic algorithm data features.

[0037] By adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art:

[0038] (1) This invention employs a mechanism based on data length features that enables rapid and automated identification, and performs fast feature extraction and classification analysis on ciphertext and hash values. This technical solution automatically completes data length calculation and feature matching through cryptographic algorithms, eliminating errors that may be introduced by manual calculation, significantly improving the accuracy and efficiency of cryptographic algorithm identification, greatly shortening the evaluation cycle of cryptographic evaluation work, and providing a reliable quantitative basis for subsequent algorithm compliance determination.

[0039] (2) This invention integrates the structural standards of digital signatures and digital envelopes and digital certificates specified by asymmetric cryptographic algorithms into the analysis tool, thereby achieving automated parsing and verification of cryptographic algorithm data structures. This innovative design effectively solves the technical defects of relying on manual comparison in traditional methods, significantly reduces the technical threshold for operators, ensures the standardization of the analysis process and the consistency of results, and improves the accuracy, reliability and compliance of cryptographic algorithm identification.

[0040] (3) This invention integrates and processes the analysis results generated during the evaluation process by constructing a structured automated output system. Based on the determination of the identified feature group Y, possible feature group P, and excluded feature group R, and combined with the specific performance of the evaluated object in the dimensions of compliance and effectiveness, the system automatically generates corresponding differentiated quantitative scores, and ultimately incorporates this scoring system into the comprehensive score of the security assessment report. This technical solution realizes a closed-loop automated evaluation process from data collection, algorithm identification, compliance determination to quantitative output, significantly improving the system's capabilities in terms of systematicness, comprehensiveness, and traceability, and providing authoritative, reliable, and operable technical support for compliance management, risk quantification, and security decision-making in information system cryptography applications. Attached Figure Description

[0041] Figure 1 A flowchart illustrating a method for assessing the compliance and validity of cryptographic object data based on cryptographic algorithm data feature analysis, provided in an embodiment of the present invention. Detailed Implementation

[0042] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0043] like Figure 1 As shown in the figure, this embodiment provides a method for analyzing the compliance and validity of cryptographic evaluation object data based on cryptographic algorithm data feature analysis. The method includes the following steps:

[0044] Step S1. Obtain the data format: First, obtain the initial data of the object to be evaluated and the encoding format of the initial data. If the encoding format of the initial data is a non-binary format, such as Hex hexadecimal or Base64 format, then decode it into binary format to obtain the raw data D to be analyzed; if the encoding format of the initial data is unencoded raw binary data, then you can directly enter the analysis step without additional decoding steps.

[0045] The initial data collected by the evaluators during the assessment process comes from the information system being tested and is typically stored in binary format. This data may be dynamically generated computational data during system operation and may have undergone specific encoding processing before collection. If the initial data collected is unencoded raw binary data, it can be analyzed directly without additional decoding steps.

[0046] This system automatically identifies data encoding formats and performs standardized decoding, effectively avoiding delays and biases that may be introduced by manual judgment and conversion. It uniformly restores various encoding formats such as Base64 and Hex hexadecimal to a standard binary stream, providing a stable, consistent, and standardized data input interface for all subsequent analysis modules. This step ensures the integrity of the data processing chain and the accuracy of the analysis results. When the initial data is already in binary format, the system automatically skips the decoding step and directly enters the analysis process. This design significantly saves unnecessary computational overhead and time delays, enabling the system to start core analysis tasks at the optimal path, thereby greatly improving overall processing efficiency, especially suitable for high-concurrency scenarios requiring rapid batch evaluation of massive targets.

[0047] Step S2. Calculate data length: Calculate and obtain the length L in bytes of the original data D to be analyzed;

[0048] Step S3. Obtain the set of pairs of symmetric cryptographic algorithm names and their block lengths: Obtain the pairs of standard symmetric cryptographic algorithm names N and their block lengths G from national and international standards, for example...<SM4, 128> ,<AES,128> ,<DES, 64> <3DES, 64>, forms a first set S by pairing known symmetric cryptographic algorithms with their block lengths:<N, G> Calculate the multiple relationship between the group length G of each pair and the number of bytes L, which satisfies the function operation: L mod G = 0. If the number of bytes L of the data D to be analyzed is divisible by the group length G of the set S, then the divisible group length G and its corresponding pair form a second set S'. Add N in the second set S' to the possible feature group P, and add N in the first set S but not in the second set S' to the exclusion feature group R.

[0049] Step S4. Obtain the set of pairs of cryptographic hash algorithm names and their hash value lengths: Obtain pairs of cryptographic hash algorithm names M and their hash value lengths Q from national and international standards, for example...<SM3, 256> ,<SHA-256,256> ,<MD5, 128> ,<SHA-1, 160> The pairings of known cryptographic hash algorithms with their hash value lengths form a third set H:<M, Q> The hash value length Q of each pair is compared with the length of the number of bytes L in turn. The relationship between the hash value length Q and the length of the number of bytes L satisfies the function operation: L = Q. If the number of bytes L of the data D to be analyzed is equal to the hash value length Q of the first set H, then the hash value length Q that is the same as the length of the number of bytes L after comparison is combined with its corresponding pair to form the fourth set H'. Then, the M in the fourth set H' is added to the possible feature group P, and the M in the third set H but not in the fourth set H' is added to the exclusion feature group R.

[0050] In steps S3 and S4, obtaining known algorithm names and their lengths from national and international standards is achieved by directly establishing an algorithm feature library based on national standards (such as the GB / T series), national industry standards (such as the GM / T series), and international standards (such as the ISO / IEC series). This library contains various algorithms specified in the technical standards, providing a unified and authoritative basis for identifying symmetric cryptographic algorithms and cryptographic hash algorithms. This avoids misjudgments caused by personal misunderstandings or the use of non-standard parameters from the outset.

[0051] Step S5. Determine if it conforms to the digital signature characteristics of an asymmetric cryptographic algorithm: Decode the original data D to be analyzed using the digital signature format specified by the asymmetric cryptographic algorithm. If the decoding result is successful, add the decoding result and the name of the asymmetric cryptographic algorithm to the determined feature group Y; otherwise, add it to the exclusion feature group R. For example, decode using the ASN.1 format of the digital signature of the SM2 algorithm. The decoding standard is recorded in GB / T32918.2-2016 and GB / T 35276-2017 according to the ASN.1 format standard of the SM2 algorithm, and use the decoding method of ASN.1 according to the method recorded in standard GB / T 16262 / ISO / IEC8824. If the decoding result is successful, add the decoding result and the name of "SM2 algorithm digital signature" to the determined feature group Y; otherwise, add the name of "SM2 algorithm digital signature" to the exclusion feature group R.

[0052] Step S6. Determine if the data meets the digital envelope characteristics specified in the confidentiality assessment: Decode the original data D to be analyzed in the format specified in the digital envelope. If the decoding result is successful, add the decoding result and the name of the digital envelope algorithm to the determined feature group Y; otherwise, add them to the exclusion feature group R. For example, the original data D to be analyzed is decoded in the ASN.1 format of the digital envelope. The decoding standard is recorded in GB / T 35275-2017 according to the ASN.1 format standard of the digital envelope, and the decoding method of ASN.1 is used according to the method recorded in standard GB / T 16262 / ISO / IEC 8824. If the decoding result is successful, add the decoding result and the name of the "digital envelope" to the determined feature group Y; otherwise, add the name of the "digital certificate" to the exclusion feature group R.

[0053] Step S7. Determine if the digital certificate meets the requirements of the security assessment: Decode the original data D to be analyzed in the format specified by the digital certificate. If the decoding result is successful, add the decoding result and the name of the digital certificate algorithm to the determined feature group Y; otherwise, add them to the exclusion feature group R. For example, decode the original data D to be analyzed in the ASN.1 format of the digital certificate. The decoding standard is recorded in the international standard RFC 5280 according to the ASN.1 format standard of digital certificates, and the decoding method of ASN.1 is used according to the method recorded in the standard GB / T 16262 / ISO / IEC 8824. If the decoding result is successful, add the decoding result and the name of the "digital certificate" to the determined feature group Y; otherwise, add the name of the "digital certificate" to the exclusion feature group R.

[0054] Among these steps, steps S5 to S7 anchor the source of the algorithm name to authoritative technical standards, which is a key systematic design decision. It fundamentally solves the problem of "where does the measuring stick come from" in the evaluation work, and provides institutional guarantees for the authority, objectivity, consistency and sustainability of the entire evaluation system. It is the cornerstone for ensuring the long-term effectiveness, widespread acceptance and trust of the evaluation work.

[0055] Traditional reader parsing requires evaluators to manually compare each item against standard documents. This technical solution, however, automates parsing by incorporating a built-in standard structure. By embedding the structural standards for digital signatures, digital envelopes, and digital certificates specified by asymmetric cryptographic algorithms into the tool, the system can automatically and accurately identify whether data contains these structures. This feature solves the inefficiency of traditional methods that rely on manual parsing of structures, achieving precise identification of cryptographic algorithms.

[0056] Step S8. Output feature group results for confidentiality assessment: Output the determined feature group Y, the possible feature group P, and the excluded feature group R. The confidentiality assessment gives different quantitative scores based on whether the compliance and validity of the assessment object data meet the requirements. The quantitative scores are finally included in the total score of the confidentiality assessment report, providing a basis for judging the compliance and validity of the assessment object data in the confidentiality assessment.

[0057] Step S8 uses a process of elimination to analyze whether the compliance and validity of the data of the evaluation object meet the requirements:

[0058] First, by determining whether feature group Y contains the name of any compliant algorithm specified in the confidential assessment, it is possible to directly determine whether the data of the assessment object meets the requirements. This determination method provides a "fast track" for objects that use mature, robust, and effective algorithms, avoiding unnecessary in-depth analysis, saving a lot of computing resources and time, and enabling the data analysis system to focus on high-risk or marginal cases that truly require in-depth review.

[0059] Secondly, if all the algorithm names used by the evaluation object are included in the exclusion feature group R, then the evaluation object data can be directly and decisively determined to be non-compliant. This design establishes a solid "safety bottom line" and adopts a "one-vote veto" mechanism, which can instantly identify high-risk and non-compliant data, effectively preventing it from slipping through the cracks, and demonstrating the rigor and security of the system.

[0060] Secondly, based on whether the possible feature group P consists only of algorithms that cannot achieve password validity, such as hash algorithms, the corresponding evaluation unit, when used for identity authentication and confidentiality, meets compliance requirements but not validity requirements, thus concluding that its validity is invalid. This method adds a secondary verification mechanism based on the possible feature group P, upgrading this evaluation method from an efficient initial screening tool to an intelligent comprehensive security assessment system with in-depth analysis capabilities and scenario-based judgment. This mechanism not only improves the accuracy and practicality of the evaluation but also achieves a technological leap from static compliance detection to dynamic validity verification.

[0061] This quantitative scoring mechanism transforms the original binary qualitative conclusion of "compliant / non-compliant" into quantifiable and comparable continuous scoring values. This transformation not only makes the presentation of assessment results more refined but also significantly enhances its structured expression in reports. By automatically generating scores through pre-set objective rules, the system effectively eliminates human subjective bias in the scoring process, thereby ensuring the standardization of the assessment process and the fairness of the conclusions.

[0062] By systematically aggregating all quantitative scores into the overall score of the security assessment report, and generating an analysis report that includes all key data characteristics, the report has evolved from a single-dimensional compliance statement into a comprehensive decision support document that integrates quantitative assessment of security maturity, visual analysis of risk posture, and guidance on prioritizing remedial measures. This significantly enhances the report's management value and practical guidance, enabling assessors to fully understand the data characteristics and providing decision-makers at all levels with clear and reliable security governance basis, thereby improving the depth and breadth of security assessments.

[0063] The following example illustrates step S8 in the cryptographic evaluation process: If the national cryptographic algorithms SM2, SM3, and SM4 are all in the excluded feature group R, then the conclusion for item A (cryptographic algorithm / technical compliance) of the corresponding evaluation object is non-compliant. If the national cryptographic algorithm SM2 is in the determined feature group Y, then the conclusion for items D (cryptographic usage validity) and A (cryptographic algorithm / technical compliance) of the corresponding evaluation object is compliant. If the possible feature group P consists only of DES (an insecure symmetric encryption algorithm that has been cracked), then the conclusion for item D (cryptographic usage validity) of the corresponding evaluation object is non-compliant. Different quantitative scores are given based on the conclusions. These scores are calculated by mathematical operations such as weighted averages, and the scores are added to the total score of the cryptographic evaluation report. The final score of the cryptographic evaluation report presents the overall conclusion that the information system "complies" (final score equals 100 points), "basically complies" (final score is less than 100 points but greater than or equal to 60 points), or "does not comply" (final score is less than 60 points) regarding the basic requirements for cryptographic application.

[0064] Based on the disclosure and teachings of the foregoing specification, those skilled in the art can make changes and modifications to the above embodiments. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and some modifications and changes to the present invention should also fall within the protection scope of the claims of the present invention. Furthermore, although some specific terms are used in this specification, these terms are only for convenience of explanation and do not constitute any limitation on the present invention.

Claims

1. A method for analyzing compliance and effectiveness of cryptanalysis object data based on data characteristics of a cryptographic algorithm, characterized in that, The method comprises: Step S1. Obtain data format: obtain the binary format of the original data D to be analyzed of the evaluation object; Step S2. Calculate data length: calculate and obtain the byte length L of the original data D to be analyzed; Step S3. Obtain a paired set of symmetric cryptographic algorithm name and its block length: obtain the symmetric cryptographic algorithm name N and its corresponding block length G, each forming a pair of algorithm name N and its block length G, and forming a first set S; the multiple relationship between the block length G of each pair and the byte length L is calculated in turn, if the byte length L can be divided by the block length G, the pair corresponding to the block length G that can be divided is formed into a second set S'; the name N of the algorithm in the second set S' is added to the possible feature group P, and the name N of the algorithm in the first set S but not in the second set S' is added to the exclusion feature group R; Step S4. Obtain a paired set of cryptographic hash algorithm name and its hash value length: obtain the cryptographic hash algorithm name M and its corresponding hash value length Q, each forming a pair of hash algorithm name M and hash value length Q, and forming a third set H; the size relationship between the hash value length Q of each pair and the byte length L is compared in turn, and the pair of the hash value length Q that is the same as the byte length L after comparison is formed into a fourth set H'; the name M of the hash algorithm in the fourth set H' is added to the possible feature group P, and the name M of the hash algorithm in the third set H but not in the fourth set H' is added to the exclusion feature group R; Step S5. Determine whether it meets the digital signature feature of asymmetric cryptographic algorithm: decode the original data D to be analyzed in the digital signature format specified by the asymmetric cryptographic algorithm, if the decoding result is successful decoding, the decoding result and the name of the asymmetric cryptographic algorithm are added to the determination feature group Y, otherwise, they are added to the exclusion feature group R; Step S6. Determine whether it meets the digital envelope feature specified by the cryptographic evaluation: decode the original data D to be analyzed in the format specified by the digital envelope, if the decoding result is successful decoding, the decoding result and the name of the digital envelope algorithm are added to the determination feature group Y, otherwise, they are added to the exclusion feature group R; Step S7. Determine whether it meets the digital certificate feature specified by the cryptographic evaluation: decode the original data D to be analyzed in the format specified by the digital certificate, if the decoding result is successful decoding, the decoding result and the name of the digital certificate algorithm are added to the determination feature group Y, otherwise, they are added to the exclusion feature group R; Step S8. Output the feature group result for the cryptographic evaluation work: output the determination feature group Y, the possible feature group P, and the exclusion feature group R for the compliance and effectiveness of the cryptographic evaluation object data in the cryptographic evaluation work to provide a judgment basis.

2. The method for analyzing the compliance and effectiveness of the cryptographic evaluation object data based on the data features of the cryptographic algorithm according to claim 1, characterized in that, In the step S8, if the name of any compliance algorithm in the feature group Y is determined, it is directly determined that the compliance and validity of the evaluation object data meet the requirements; if the name of all compliance algorithms in the feature group R is excluded, it is determined that the compliance and validity of the evaluation object data do not meet the requirements.

3. The method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to claim 1 or 2, characterized in that, In the step S8, if the name of any algorithm in the possible feature group P is included, it is determined that the compliance and validity of the evaluation object data preliminarily meet the requirements; the use of the algorithm in the feature group P is analyzed again, and if the actual use is consistent with the specified use, it is determined that the compliance and validity meet the requirements, and if not, it is determined that the compliance meets the requirements but the validity does not meet the requirements.

4. The method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to claim 3, characterized in that, In the step S8, the cryptographic evaluation job gives different quantitative scores according to different situations of whether the compliance and validity of the evaluation object data meet the requirements, and the quantitative scores are finally added into the total score of the cryptographic evaluation report.

5. The method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to claim 1, characterized in that, In the step S1, the initial data of the evaluation object to be evaluated and the encoding format of the initial data are obtained first; if the encoding format of the initial data is a non-binary format, the initial data is decoded into a binary format to obtain the original data D to be analyzed; if the initial data is already in a binary format, the initial data is directly used as the original data D to be analyzed.

6. The method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to claim 1, characterized in that, In the step S3, the names of symmetric cryptographic algorithms are obtained from the technical standards.

7. The method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to claim 1, characterized in that, In the step S4, the names of cryptographic hash algorithms are obtained from the technical standards.

8. The method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to claim 1, characterized in that, The names of asymmetric cryptographic algorithms in the step S5, the names of digital envelope algorithms in the step S6, and the names of digital certificate algorithms in the step S7 are all obtained from the technical standards.

9. The method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to claim 1, characterized in that, In the steps S5, S6, and S7, the decoding format is preselected and set and is built into the analysis tool.

10. A system for analyzing the compliance and validity of data of a cryptographic assessment object based on cryptographic algorithm data feature analysis, characterized in that, The system applies the method for analyzing the compliance and validity of the evaluation object data based on the data features of the cryptographic algorithm according to any one of claims 1 to 9.

Images