A virtualization simulation system construction method for testing commercial cryptographic software

Abstract

The application discloses a virtualization simulation system construction method for testing commercial cryptographic software, and comprises the following steps: S1, a function decoupling and abstraction stage; S2, a container image and software construction stage; S3, a service arrangement configuration stage; S4, a virtual environment starting and running stage; and S5, a virtual environment destroying stage. The application can greatly reduce the cost and deployment complexity of a commercial cryptographic application security evaluation test environment construction, and improve resource utilization and environment consistency.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically to a method for constructing a virtualized simulation system for testing commercial cryptographic software. Background Technology

[0002] Currently, conducting standardized security assessments of commercial cryptographic applications requires building a complete testing environment that conforms to the relevant standards of the State Cryptography Administration. This environment typically includes the following core hardware devices:

[0003] Application server: The server that deploys the business system under test. When password operations are required, it completes the corresponding password operations by calling the API (Application Programming Interface) provided by the hardware server's cryptographic machine.

[0004] Server cryptographic machine: A dedicated hardware security device that provides high-performance cryptographic operations, such as SM2 / SM3 / SM4 / SM9 national cryptographic algorithms, and offers services including key generation, storage, and dedicated encryption / decryption operations. It is used to ensure the confidentiality, integrity, authenticity, and non-repudiation of data.

[0005] Smart cryptographic key: A hardware cryptographic device using a USB interface to implement security functions such as user authentication, multi-factor authentication, digital signature, and offline key protection.

[0006] like Figure 1 As shown, the working principle of the existing technical solution is as follows: The application under test is deployed on an application server. When the application under test reaches a stage requiring password protection, such as user login, encrypted data transmission, or encrypted data storage, the application server will call the API service interface provided by the server's cryptographic machine via the network or locally, sending the raw data to the dedicated server cryptographic machine. After performing encryption, decryption, signing, and verification operations, the server cryptographic machine returns the calculation results to the application server. The smart password key is usually inserted directly into the server or client computer by the administrator or user for authentication. The entire environment relies on physical hardware devices, and the devices communicate with each other through physical network interfaces or USB interfaces.

[0007] While existing solutions based entirely on hardware can meet the requirements for high security and high computing power, they have the following shortcomings in cryptographic evaluation practice, especially in cryptographic evaluation of small and medium-sized systems and during the R&D testing phase. The root cause of these shortcomings is directly related to the physical properties of the hardware devices:

[0008] (1) High deployment complexity and long cycle:

[0009] Due to the dependence on physical hardware, the machine room environment needs to be adapted first, such as reserving cabinet space, configuring redundant power supply, and controlling temperature and humidity within a reasonable range, and then the hardware wiring and driving debugging are carried out; and the hardware password machine and UKey (USB Key, intelligent password key) of different manufacturers have interface compatibility problems, such as some manufacturers using private communication protocols, which need to be customized and developed to adapt to the plug-in, resulting in a long deployment cycle of a single set of environment. The reason for this phenomenon is that the physical form of the hardware device limits the deployment flexibility, and the industry lacks a unified hardware integration adaptation standard, which needs to be debugged compatible with each device.

[0010] (2) Huge cost investment and heavy operation and maintenance burden:

[0011] The hardware server password machine is generally expensive, and is matched with three types of physical servers, security gateways and machine room infrastructure such as UPS power supply (uninterruptible power supply), fire extinguishing system, etc., which makes the deployment cost of small system security evaluation increase exponentially; at the same time, the hardware annual depreciation, machine room operation and maintenance may require a dedicated person to stand by, equipment inspection and other needs, and the long-term cost of equipment operation and maintenance. The reason for this phenomenon is that the hardware password product relies on special encryption chips and precise manufacturing processes, resulting in high research and development and production costs.

[0012] (3) Low resource utilization and poor reusability:

[0013] For some low-computing power scenarios, the demand is mostly for intermittent server password machine calls, and the computing power utilization rate of the hardware password machine is not high, which is easy to cause resource idling; and a single hardware device can only physically connect a limited number of servers, and the resource scheduling efficiency is low. The reason for this phenomenon is that the physical exclusivity of the hardware device causes the resources to be unable to be dynamically allocated, making it difficult to achieve multi-scenario sharing and reuse.

[0014] Therefore, there is an urgent need in the art for a new type of commercial password application security evaluation test environment construction scheme that can overcome the above-mentioned defects. SUMMARY

[0015] The technical problem to be solved by the present application is to provide a virtualization simulation system construction method for testing commercial password software, which can greatly reduce the cost and deployment complexity of constructing a commercial password application security evaluation test environment, and improve resource utilization and environment consistency.

[0016] To solve the above technical problems, the technical solutions adopted by the present application are as follows.

[0017] A virtualization simulation system construction method for testing commercial password software, comprising the following steps:

[0018] S1. Function decoupling and abstraction phase: decoupling the functions of the hardware devices relied on by the commercial cryptographic application security evaluation test environment; software abstraction of the decoupled functions to form independent service modules;

[0019] S2. Container image and software construction phase: writing image construction files for service modules that need to be containerized to construct corresponding container images, and constructing corresponding executable programs for service modules that need to be independently run to simulate corresponding hardware device entities; and version marking each container image and executable program to ensure consistency and traceability of the environment;

[0020] S3. Service orchestration configuration phase: writing container orchestration configuration files to define the dependency relationship and network topology between the container images obtained in step S2 on the preset container engine and orchestrator; and defining the access relationship between the executable program and the containerized environment to form a complete, functionally equivalent virtualized test environment;

[0021] S4. Virtual environment startup and running phase: based on the container orchestration configuration file, a unified orchestration command is executed to start the involved containers to run the virtualized test environment in one key;

[0022] S5. Virtual environment destruction phase: based on the container orchestration configuration file, a unified destruction command is executed to stop all containers to destroy the virtualized test environment and release the host hardware resources in one key.

[0023] Preferably, the hardware devices in step S1 include a server cryptographic machine, an intelligent cryptographic key, and an application server, and the service modules include a cryptographic operation module, an identity authentication module, and a business processing module; step S1 specifically includes: analyzing the cryptographic operation function of the server cryptographic machine, decoupling and abstracting it into a pure software implemented cryptographic operation module; analyzing the identity authentication function of the intelligent cryptographic key, decoupling and abstracting it into a pure software implemented identity authentication module; analyzing the business processing function of the application server, decoupling and abstracting it into a pure software implemented business processing module; step S1 further includes defining the interface specifications between the modules to ensure loose coupling and standardized interaction between the modules.

[0024] Preferably, step S2 specifically includes:

[0025] Constructing a virtual server cryptographic machine container image for the cryptographic operation module: based on a NodeJS base image, integrating support for function implementation interfaces including but not limited to SM2, SM3, and SM4 national cryptographic algorithms, exposing standard cryptographic service API interfaces, and managing keys through a defined key configuration file;

[0026] Building a virtual smart password key client executable program for the identity authentication module: using the SEA technology of NodeJS to generate a cross-platform executable application, simulating the certificate storage, signature and verification functions of the smart password key in software form, and being able to view the stored digital certificate;

[0027] Building a virtual application server container image for the business processing module: based on the business system running environment, configuring the password service calling endpoint; using the JSON Web Token mechanism for identity authentication; using the container multi-layer construction mechanism to optimize the final size of the virtual application server container image; using the Prisma ORM technology to define the data model for the business system under test, and setting the fields for confidentiality and integrity check in the data model;

[0028] Building an Nginx reverse proxy container image: configuring reverse proxy and SSL protocol technology, which can flexibly configure the cipher suites in the SSL protocol and the server digital certificate, to simulate the security requirements of various commercial password application security assessment test environments;

[0029] Building a database management system container image: integrating data storage functions and supporting custom database usernames and passwords.

[0030] Preferably, the key configuration file uses a.key.json file for key management; the.key.json file contains a uuid for uniquely identifying the key, a type field for indicating the algorithm type, an algorithm field for specifying the specific algorithm, and a real key value key or a public and private key pair privateKey and publicKey in hexadecimal form.

[0031] Preferably, the containers and executable programs contained in the virtualization test environment in step S3 include: a virtual server password machine container, a virtual application server container, a virtual smart password key client executable program, an Nginx reverse proxy container, and a database management system container; the virtual server password machine container, the virtual application server container, the Nginx reverse proxy container, and the database management system container are uniformly managed by the container engine and the orchestrator; step S3 specifically includes:

[0032] Configuring a service discovery mechanism: ensuring that each container can access each other through the service name;

[0033] Configuring the network endpoint information required by the virtual smart password key client executable program to access the containerized environment;

[0034] Setting resource limits and health check policies: defining storage volume mapping to achieve persistent data, shared data, and application configuration file injection to the container.

[0035] Preferably, the step S4 specifically comprises:

[0036] The user executes a docker compose up -d command, and the container engine starts the involved containers according to the container orchestration configuration file;

[0037] After the containers are started, an internal network is automatically formed, and the containers discover each other through the container internal virtual network service;

[0038] An external user accesses a port exposed by the Nginx reverse proxy container through a general browser;

[0039] After the virtualization test environment is running, in response to a service request initiated by the external user through the browser, a simulation test process of security of the commercial cryptographic application is executed.

[0040] Preferably, the simulation test process includes but is not limited to at least one of the following:

[0041] A. Identity authentication process based on digital signature:

[0042] The user manually starts a virtual smart cryptographic key client executable program, and initiates a login request to the virtual application server container through the Nginx reverse proxy container; the virtual application server container requests a challenge random number from the virtual server cryptographic machine container, the virtual server cryptographic machine container generates a challenge random number and forwards it to the virtual smart cryptographic key client executable program through the virtual application server container and the Nginx reverse proxy container; the user signs the challenge random number through the virtual smart cryptographic key provided by the virtual smart cryptographic key client executable program, and returns the signature value to the Nginx reverse proxy container; the Nginx reverse proxy container forwards the signature value to the virtual application server container; after receiving the signature value, the virtual application server container initiates a signature verification request to the virtual server cryptographic machine container; at the same time, the virtual application server container interacts with the database management system container to verify the user's credentials; after successful signature verification and credential verification, identity authentication is completed;

[0043] B. Data encryption storage process:

[0044] The user submits plaintext data to be protected through the browser; the request is forwarded to the virtual application server container through the Nginx reverse proxy container; the virtual application server container forwards the encryption request to the virtual server cryptographic machine container; the virtual server cryptographic machine container encrypts the plaintext to generate a ciphertext value and an integrity check value, and returns them together; the virtual application server container stores the received ciphertext value and check value in the database management system container;

[0045] C. Data decryption query process:

[0046] The user requests to view the stored encrypted value through the browser; the request is forwarded to the virtual application server container through the Nginx reverse proxy container; the virtual application server container takes out the corresponding ciphertext value from the database management system container; then, a decryption request is initiated to the virtual server cryptomachine container; the virtual server cryptomachine container decrypts the ciphertext value using the corresponding key, restores the plaintext value and returns; the virtual application server container returns the decrypted plaintext value to the user browser through the Nginx reverse proxy container.

[0047] Preferably, the step S5 specifically comprises: the user executes a docker compose down command to one-key stop all containers, the orchestrator automatically stops and removes all containers and related resources to release the host hardware resources; immediate start of a new test environment or reservation of an image for subsequent reuse is also supported.

[0048] Thanks to the above technical solutions, the present application has achieved the following technical progress.

[0049] The present application realizes the technical effects of cost reduction, efficiency improvement, reuse and expansion through software and virtualization technology, specifically as follows:

[0050] (1) Cost optimization effect:

[0051] There is no need to purchase expensive hardware cryptographic devices, eliminating the hardware procurement costs of physical cryptographic machines, dedicated servers, intelligent cryptographic keys, etc., and there is no need to bear the costs of machine room operation and maintenance and hardware depreciation, greatly reducing hardware costs; in addition, the cryptographic software environment can be rented on demand through a cloud platform, further reducing the use threshold of small and medium-sized enterprises.

[0052] (2) Deployment efficiency improvement effect:

[0053] Hardware cryptographic environment deployment requires several weeks or even longer, while the virtualized cryptographic software environment does not need to wait for such a long period, and can be deployed and used on the same day after providing a complete configuration file, greatly improving deployment efficiency. It also supports multiple environment rebuilds and tests per day to meet the iterative cryptographic evaluation needs (such as rapid compliance verification after software version update); and the deployment process does not require professional hardware operation and maintenance personnel, and can be completed independently by R&D personnel through scripts. Through container images and orchestration scripts, the cryptographic software environment can be started and quickly copied in seconds, which is particularly suitable for agile development, automated testing and teaching demonstration scenarios.

[0054] (3) Resource reuse effect:

[0055] A single host server can carry multiple sets of environment-independent cryptanalysis test environments, and the physical hardware resource utilization is improved. Moreover, the Docker image ensures environment consistency: the container image ensures that the environment (including algorithm library version, system configuration) of each start is completely consistent, effectively avoids the deviation of test results caused by environment difference, and improves the accuracy and reproducibility of the cryptosystem environment.

[0056] (4) Enhancing flexibility and scalability:

[0057] The deployment personnel can easily modify the image build file or the container orchestration configuration file to quickly build a test environment containing different algorithms and different configurations, build different commercial cryptosystem simulation environments, facilitate compatibility and security comparison testing, and greatly enhance flexibility and scalability. BRIEF DESCRIPTION OF DRAWINGS

[0058] Figure 1 Fig. 1 is a hardware device diagram of an existing commercial cryptosystem application security evaluation test environment;

[0059] Figure 2 Fig. 4 is a flowchart of the method of the present application;

[0060] Figure 3 Fig. 5 is a business flowchart of identity authentication based on digital signature of the present application;

[0061] Figure 4 Fig. 6 is a business flowchart of data encryption storage of the present application;

[0062] Figure 5 Fig. 7 is a business flowchart of data decryption query of the present application. DETAILED DESCRIPTION

[0063] The present application will be further described in detail below in combination with the drawings and specific embodiments.

[0064] A virtualization simulation system construction method for testing commercial cryptosystem software adopts Docker container virtualization technology, realizes the functions of server cryptomachine, application server and other devices in software form, encapsulates them into independent Docker images, and uniformly manages and runs them through container orchestration technology, so as to simulate a complete and functionally equivalent software and hardware cryptanalysis environment (commercial cryptosystem application security evaluation test environment), which is combined with Figure 2 As shown in Fig. 1, the method comprises the following steps:

[0065] S1. Function decoupling and abstraction stage: decouple the functions of the hardware devices relied on by the commercial cryptosystem application security evaluation test environment; software abstract the decoupled functions to form independent service modules.

[0066] In this step, the hardware devices include a server cryptomachine, a smart cryptographic key and an application server, and the service modules include a cryptographic operation module, an identity authentication module and a business processing module.

[0067] This step specifically includes:

[0068] The cryptographic operation function of the server cryptomachine is analyzed, decoupled and abstracted into a pure software implemented cryptographic operation module; the identity authentication function of the smart cryptographic key is analyzed, decoupled and abstracted into a pure software implemented identity authentication module; and the business processing function of the application server is analyzed, decoupled and abstracted into a pure software implemented business processing module.

[0069] The interface specifications between the modules are defined to ensure loose coupling and standardized interaction between the modules.

[0070] S2. Container image and software construction stage: writing an image construction file (Dockerfile file) for the service module that needs to be containerized to construct a corresponding container image, and constructing a corresponding executable program for the service module that needs to be independently run to simulate the corresponding hardware device entity; and version marking each container image and executable program to ensure consistency and traceability of the environment.

[0071] Specifically, a Dockerfile file is written to construct a corresponding Docker image, including:

[0072] A virtual server cryptomachine container image is constructed for the cryptographic operation module: based on a NodeJS base image, using a NodeJS standard API interface, integrating a function implementation interface of a national cryptographic algorithm, supporting SM2, SM3, SM4 and other national cryptographic algorithms, exposing a standard cryptographic service API interface, and having strong extensibility, key management is performed through a defined key configuration file, and more international algorithm implementations can be easily extended. Specifically, the key configuration file uses a.key.json file to manage keys, the.key.json file includes uuid, type, algorithm, key or privateKey and publicKey, the key does not directly provide a specific key value to the outside, and the uuid value is provided for unique identification of the key, and the key is used; the type field is used to indicate the algorithm type to confirm the algorithm type supported by the key, such as a message authentication code, a symmetric algorithm or an asymmetric algorithm; the algorithm field is used to specify a specific algorithm, such as sm3, sm4 or sm2 algorithm; the key refers to a real key value represented in hexadecimal form; and the privateKey and publicKey refer to a public-private key pair represented in hexadecimal form.

[0073] Build a virtual application server container image for the business processing module: Configure the password service call endpoint based on the business system's operating environment; use JWT (JSON Web Token) mechanism for identity authentication; optimize the final size of the virtual application server container image using Docker's multi-layer build mechanism; use Prisma ORM technology to define a data model for the business system under test, and set database fields such as password, content, and checksum in the data model as fields for confidentiality and integrity verification.

[0074] Build an Nginx reverse proxy container image: Configure reverse proxy and SSL protocol technologies, and flexibly configure cipher suites and server digital certificates in the SSL protocol to simulate the security requirements of various commercial cryptographic application security assessment and testing environments.

[0075] Build a database management system container image: integrate data storage functionality and support custom database usernames and passwords, specifically for PostgreSQL databases.

[0076] Write the source code and build the corresponding executable program, including:

[0077] A virtual smart key client executable program is built for the identity authentication module: This program simulates the certificate storage and signature verification functions of a smart key in software. Specifically, using NodeJS's SEA (Single executable applications) technology, a cross-platform executable application is generated that can run on Windows and macOS operating systems. This application can view stored digital certificates, perform signature verification using national cryptographic algorithms, and facilitate program distribution and use.

[0078] S3. Service Orchestration Configuration Phase: Write the container orchestration configuration file (Docker Compose configuration file). On the preset container engine and orchestrator, define the dependencies and network topology between the container images obtained in step S2; and define the access relationship between the executable program and the containerized environment to form a complete and functionally equivalent virtualization test environment.

[0079] The virtualization test environment includes containers and executable programs, such as a virtual server cryptomachine container, a virtual application server container, a virtual smart cryptographic key client executable program, an Nginx reverse proxy container, and a database management system container, and the virtual server cryptomachine container, the virtual application server container, the Nginx reverse proxy container, and the database management system container are uniformly managed by a container engine and an orchestrator. The virtual server cryptomachine container, the virtual application server container, the virtual smart cryptographic key client executable program, the Nginx reverse proxy container, the database management system container, and the container engine and the orchestrator jointly constitute a virtualization simulation system. Specifically:

[0080] The virtual server cryptomachine container: The container runs a software cryptographic middleware, simulates the core API interface of a real server cryptomachine, such as encryption and decryption, signature verification, and the like, by implementing corresponding national cryptographic algorithms, and receives a cryptographic service request from the virtual application server container, performs software algorithm operation, and returns a result.

[0081] The virtual application server container: The container is used to deploy a business system under test. Its internal configuration is to direct a cryptographic operation request to a network address and a port of the virtual server cryptomachine container, rather than a traditional hardware IP address.

[0082] The virtual smart cryptographic key client executable program: The software runs a simulated smart cryptographic key, provides certificate storage, signature verification, and the like. It simulates one or more virtual USB keys, and the certificate and key files stored in the USB keys are mounted in the client in the form of an encrypted volume for calling.

[0083] The Nginx reverse proxy container: The container runs an Nginx server as a unified entrance of the entire application system. It receives an Http / Https request of an external user, and balances the request to the virtual application server container according to a configured rule. The container is used to simulate a common Web front-end proxy architecture in a production environment to test an end-to-end identity authentication mechanism, communication confidentiality, and communication integrity cryptographic requirements.

[0084] The database management system container: The container runs a PostgreSQL database for storing application data of the business system under test. The virtual application system performs encrypted storage on sensitive fields in the database, thereby testing a confidentiality protection mechanism of data storage, and can also perform integrity storage protection on the sensitive fields in the database, thereby testing an integrity protection mechanism of data storage.

[0085] Container engine and orchestrator: as the underlying core, responsible for creating, running and managing all the above containers. Docker Compose and other tools can be used for orchestration, defining the dependencies between containers, health status, network connection and other related configurations.

[0086] This architecture completely simulates the full link of commercial cryptographic applications from network access, business processing, identity authentication, password service to data storage, providing a comprehensive virtualization of commercial cryptographic software simulation environment.

[0087] This step specifically includes:

[0088] Configure the service discovery mechanism: ensure that each container can access each other through the service name, such as the virtual application server container connecting the virtual server cryptographic machine container through the service name virtual-hsm, and the database management system container through the service name postgres-db;

[0089] Configure the virtual smart cryptographic key client executable program to access the network endpoint information required by the containerized environment;

[0090] Set resource limits and health check policies: define storage volume mapping to achieve persistent data, shared data, and application configuration file injection to containers.

[0091] S4. Virtual environment startup and running phase: based on the container orchestration configuration file, execute a unified orchestration command to start the involved containers to run the virtualization test environment.

[0092] This step specifically includes:

[0093] The user executes the docker compose up -d command, and the container engine starts the involved containers according to the container orchestration configuration file.

[0094] After the container is started, an internal network is automatically formed, and each container discovers each other through the Docker internal virtual network.

[0095] External users access the port exposed by the Nginx reverse proxy container through a general browser, which can be customized by the container orchestration configuration file, such as the 443 port, 80 port, etc.

[0096] After the virtualization test environment is running, in response to the business request initiated by the external user through the browser, the simulation test process of the security of the commercial cryptographic application is executed.

[0097] The following describes three typical business processes in conjunction with the drawings:

[0098] (1) Identity authentication process based on digital signature (as shown in Figure 3 ):

[0099] The user manually starts the virtual smart password key client executable program, and initiates a login request to the virtual application server container through the Nginx reverse proxy container. The virtual application server container requests a challenge random number from the virtual server cryptomachine container, and the virtual server cryptomachine container generates a challenge random number and forwards it to the virtual smart password key client executable program through the virtual application server container and the Nginx reverse proxy container. The user signs the challenge random number through the virtual smart password key provided by the virtual smart password key client executable program, and returns the signature value to the Nginx reverse proxy container. The Nginx reverse proxy container forwards the signature value to the virtual application server container. After receiving the signature value, the virtual application server container initiates a signature verification request to the virtual server cryptomachine container. At the same time, the virtual application server container interacts with the database management system container to verify the user's credentials (such as username and password). After successful signature verification and credential verification, identity authentication is completed, and the user is allowed to access. This process simulates and tests the identity authentication process based on digital signature.

[0100] (2) Data encryption storage process (as shown in Figure 4 ):

[0101] The user submits the plaintext data to be protected through the browser. The request is forwarded to the virtual application server container through the Nginx reverse proxy container. The virtual application server container forwards the encryption request (including plaintext) to the virtual server cryptomachine container. The virtual server cryptomachine container uses the specified national cryptographic algorithm (such as SM4) to encrypt the plaintext, generates a ciphertext value, and simultaneously calculates an integrity check value (such as checksum), and then returns them together. The virtual application server container stores the received ciphertext value and check value in the database management system container. This process simulates and tests the confidentiality and integrity protection mechanism of the data storage link.

[0102] (3) Data decryption query process (as shown in Figure 5 ):

[0103] The user requests to view the stored encrypted value through the browser. The request is forwarded to the virtual application server container through the Nginx reverse proxy container. The virtual application server container retrieves the corresponding ciphertext value from the database management system container. Then, it initiates a decryption request to the virtual server cryptomachine container. The virtual server cryptomachine container uses the corresponding key to decrypt the ciphertext value, restores the plaintext value and returns it. The virtual application server container returns the decrypted plaintext value to the user's browser through the Nginx reverse proxy container. This process simulates and tests the authorized user's compliance access and decryption capability for encrypted stored data.

[0104] The simulation test flow includes but is not limited to the above business flow, and the password operation result and the database operation result are finally returned along the original path to the external user through the Nginx reverse proxy container, to complete a complete request-response process, so as to realize simulation and test of the security evaluation points of the commercial password application.

[0105] S5. Virtual environment destruction phase: based on the container orchestration configuration file, all containers are stopped by executing a unified destruction command to destroy the virtualization test environment and release the host hardware resources.

[0106] If the virtual environment needs to be destroyed, the user executes the Docker command (docker compose down), stops all containers in one key, and the orchestrator automatically stops and removes all containers and related resources to release the host hardware resources such as CPU, memory, storage space, etc. It also supports immediate start of a new test environment or preservation of the image for subsequent reuse.

[0107] The innovation points of the present application are as follows:

[0108] (1) The password function is divided into independent software modules:

[0109] The present application does not simply simulate the hardware password device with software, but decouples and abstracts its core function. The password operation service provided by the hardware password machine, the identity authentication and key storage service provided by the intelligent password key, and the business processing function of the application server are decoupled from the specific physical form and refined into standardized service modules in pure software form. Subsequently, using the Docker container technology, these service modules are encapsulated into independent, portable virtual password device images; or the source code is encapsulated into an independent executable program.

[0110] (2) One-key deployment of containerized test environment:

[0111] The present application uses container orchestration tools such as Docker Compose to abstract the complex topology and dependency relationship between the originally discrete and manually networked physical devices, application servers, server password machines, database servers, etc. into a declarative configuration file. The file defines the service discovery, network interconnection and startup order of all virtual components, realizes the conversion from device stacking to service collection, and realizes one-key deployment and rapid replication without worrying about the complex installation and configuration details of the underlying. Only one command needs to be executed, and the system can automatically complete the construction and initialization of the entire heterogeneous environment, greatly shortening the deployment time. The entire environment can be easily copied, versioned, managed and distributed through the image repository, realizing out-of-box use.

[0112] (3) Efficient reuse of hardware resources:

[0113] The application realizes fine management and isolation of hardware resources, and a single physical server can run multiple independent and complete cryptanalysis environments simultaneously, greatly improving the utilization rate of hardware resources.

[0114] (4) Environment consistency guarantee:

[0115] All the elements of the cryptanalysis environment, including the national secret algorithm library version, the configuration file, the measured application and its dependencies, are solidified in an immutable Docker image. The image serves as the only true source of environment construction, and the binary content deployed and run anywhere is exactly the same. The environment drift problem is eliminated, and the reproducibility of the measurement and evaluation results is ensured due to the immutability of the image. Meanwhile, changes in the virtual environment need to be implemented by building a new image version, which makes all changes in the environment traceable and auditable, and the versioned image management simplifies the rollback, upgrade and troubleshooting process.

Claims

1. A method for constructing a virtualized simulation system for testing commercial cryptographic software, characterized in that: Includes the following steps: S1. Functional Decoupling and Abstraction Phase: Decouple the hardware functions on which the commercial cryptographic application security assessment and testing environment depends; abstract the decoupled functions into independent service modules, including cryptographic operation modules, identity authentication modules, and business processing modules. S2. Container Image and Software Building Phase: For service modules requiring containerization, write image build files and build corresponding container images; for service modules requiring independent operation, build corresponding executable programs to simulate the corresponding hardware devices; and version-code each container image and executable program to ensure environment consistency and traceability; specifically including: Build a virtual server cryptographic machine container image for the cryptographic operation module: Based on the NodeJS base image, it integrates functional implementation interfaces that support the SM2, SM3, and SM4 national cryptographic algorithms, exposes standard cryptographic service API interfaces, and manages keys through a defined key configuration file; Build a virtual smart key client executable program for the identity authentication module: Use NodeJS's SEA technology to generate a cross-platform executable application that simulates the certificate storage, signature verification and signing functions of the smart key in software form, and allows users to view the stored digital certificates. Build a virtual application server container image for the business processing module: Configure the password service call endpoint based on the business system's operating environment; use the JSON Web Token mechanism for identity authentication; optimize the final size of the virtual application server container image using a multi-layer container building mechanism; use Prisma ORM technology to define a data model for the business system under test, and set fields for confidentiality and integrity verification in this data model; Build an Nginx reverse proxy container image: Configure reverse proxy and SSL protocol technologies, and flexibly configure cipher suites and server digital certificates in the SSL protocol to simulate the security requirements of various commercial cryptographic application security assessment test environments; Build a database management system container image: integrate data storage functionality and support custom database usernames and passwords; S3. Service Orchestration and Configuration Phase: Write container orchestration configuration files to define the dependencies and network topology between the container images obtained in step S2 on the preset container engine and orchestrator; and define the access relationship between the executable program and the containerized environment to form a complete and functionally equivalent virtualization test environment. S4. Virtual Environment Startup and Operation Phase: Based on the container orchestration configuration file, the involved containers are started with one click by executing unified orchestration commands to run the virtualization test environment; after the virtualization test environment is running, a simulated test process for the security of commercial cryptographic applications is executed, which includes at least one of the following: digital signature-based identity authentication process, data encryption storage process, and data decryption query process; S5. Virtual Environment Destruction Phase: Based on the container orchestration configuration file, a unified destruction command is executed to stop all containers with one click to destroy the virtualized test environment and release host hardware resources.

2. The method for constructing a virtualization simulation system for testing commercial cryptographic software according to claim 1, characterized in that: The hardware devices in step S1 include a server cryptographic machine, a smart cryptographic key, and an application server. Step S1 specifically includes: analyzing the cryptographic operation function of the server cryptographic machine, decoupling and abstracting it into a pure software-implemented cryptographic operation module; analyzing the identity authentication function of the smart cryptographic key, decoupling and abstracting it into a pure software-implemented identity authentication module; analyzing the business processing function of the application server, decoupling and abstracting it into a pure software-implemented business processing module; Step S1 also includes defining the interface specifications between each module to ensure loose coupling and standardized interaction between modules.

3. The method for constructing a virtualization simulation system for testing commercial cryptographic software according to claim 1, characterized in that: The key configuration file uses a .key.json file for key management; the .key.json file contains a UUID for uniquely identifying the key, a type field for indicating the algorithm type, an algorithm field for specifying the specific algorithm, and the actual key value key or public-private key pair privateKey and publicKey represented in hexadecimal form.

4. The method for constructing a virtualization simulation system for testing commercial cryptographic software according to claim 1, characterized in that: The virtualization test environment in step S3 includes the following containers and executable programs: a virtual server cryptographic machine container, a virtual application server container, a virtual smart key client executable program, an Nginx reverse proxy container, and a database management system container; the virtual server cryptographic machine container, virtual application server container, Nginx reverse proxy container, and database management system container are uniformly managed by the container engine and orchestrator; step S3 specifically includes: Configure a service discovery mechanism: ensure that containers can access each other by service name; Configure the network endpoint information required for the virtual smart key client executable to access the containerized environment; Configure resource limits and health check policies: Define storage volume mappings to enable persistent data, shared data, and injection of application configuration files into containers.

5. A method for constructing a virtualization simulation system for testing commercial cryptographic software according to claim 4, characterized in that: Step S4 specifically includes: When a user executes the command `docker compose up -d`, the container engine starts the containers involved according to the container orchestration configuration file. Once a container starts, it automatically forms an internal network, and each container discovers each other through the container's internal virtual network service. External users access the ports exposed by the Nginx reverse proxy container through a common browser; Once the virtualized test environment is running, it responds to business requests initiated by external users through a browser and executes a simulated test process for the security of commercial cryptographic applications.

6. The method for constructing a virtualization simulation system for testing commercial cryptographic software according to claim 5, characterized in that: The digital signature-based identity authentication process specifically includes: The user manually starts the virtual smart key client executable program and initiates a login request to the virtual application server container via the Nginx reverse proxy container. The virtual application server container requests a challenge random number from the virtual server cryptographic machine container. The virtual server cryptographic machine container generates a challenge random number and forwards it to the virtual smart key client executable program through the virtual application server container and the Nginx reverse proxy container. The user signs the challenge random number using the virtual smart key provided by the virtual smart key client executable program and returns the signature value to the Nginx reverse proxy container. The Nginx reverse proxy container forwards the signature value to the virtual application server container. After receiving the signature value, the virtual application server container initiates a signature verification request to the virtual server cryptographic machine container. At the same time, the virtual application server container interacts with the database management system container to verify the user's credentials. After successful signature verification and credential verification, identity authentication is completed. The data encryption and storage process specifically includes: The user submits plaintext data to be protected through a browser; the request is forwarded to the virtual application server container via the Nginx reverse proxy container; the virtual application server container forwards the encrypted request to the virtual server cryptographic machine container; the virtual server cryptographic machine container encrypts the plaintext, generates a ciphertext value, and simultaneously calculates its integrity check value, and then returns both; the virtual application server container stores the received ciphertext value and check value into the database management system container. The data decryption and query process specifically includes: The user requests to view the stored encrypted value through a browser; the request is forwarded to the virtual application server container via the Nginx reverse proxy container; the virtual application server container retrieves the corresponding ciphertext value from the database management system container; then, it sends a decryption request to the virtual server cryptographic machine container; the virtual server cryptographic machine container uses the corresponding key to decrypt the ciphertext value, recovers the plaintext value, and returns it; the virtual application server container returns the decrypted plaintext value to the user's browser via the Nginx reverse proxy container.

7. A method for constructing a virtualization simulation system for testing commercial cryptographic software according to claim 4, characterized in that: Step S5 specifically involves the user executing the `docker compose down` command to stop all containers with a single click. The orchestrator automatically stops and removes all containers and related resources to free up host hardware resources. It also supports immediately starting a new test environment or retaining the image for later reuse.

Images