A password compliance automatic analysis system and method based on a large model and tool calling protocol

Abstract

The application relates to a password compliance automatic analysis system and method based on a large model and a tool calling protocol. In view of the problems of low manual packet grabbing efficiency and difficult determination of complex logic in the process of security evaluation of commercial password application and detection and authentication of commercial secret products, the system captures underlying data packets and extracts password features to be converted into structured metadata; a commercial secret standard RAG knowledge base and a semantic alignment tool are scheduled through an MCP protocol; a large model hub performs multi-dimensional deep logic comparison on static elements, double certificate mechanisms and handshake timing of data based on a preset state machine; and finally, a traceability report with a Hex offset anchor point is generated in combination with conflict detection. The application solves the problem of automatic review of complex commercial secret protocols, and significantly improves the accuracy and auditability of secret evaluation.

Description

Technical Field

[0001] This invention patent relates to the fields of network security and cryptography technology and AI, and in particular to the field of automated detection of cryptographic algorithms and protocols in application systems and commercial cryptographic products based on a large set of model tools. Background Technology

[0002] In existing commercial cryptography application security assessments (such as GB / T 39786 compliance testing) or commercial cryptography product testing and certification processes, the detection of protocols such as SSL / TLS / IPSec and the GM / T cryptographic standard series specifications heavily relies on manual packet capture and comparison analysis. Traditional techniques suffer from technical shortcomings such as low parsing efficiency, inability to automatically determine complex logical associations, and lack of semantic understanding of non-standard implementations. This invention utilizes the semantic reasoning capabilities of Large Language Models (LLMs) combined with Model Context Protocols (MCPs) to propose an automated data surface feature extraction and compliance logic determination scheme, significantly improving the accuracy and automation of commercial cryptography detection. Summary of the Invention

[0003] An automated cryptographic compliance analysis system based on a large model and tool invocation protocol, characterized in that the network system comprises the following subsystems: A. Flow surface processing subsystem, which includes the following modules: ●Traffic mirroring and acquisition module: Used to capture low-level network data packets from the switch mirroring port in real time or offline; ●Protocol Feature Filtering and Stripping Module: Used to extract key cryptographic interaction data packets (such as key negotiation and certificate exchange packets) based on commercial cryptographic features (such as specific ports and national cryptographic protocol handshake flags). ● Heterogeneous data structuring module: The extracted raw Hex or binary payload is formatted into a unified JSON structured object, and key metadata such as IP, algorithm suite, and random number NONCE are extracted. B. Knowledge and Toolset Subsystem (MCP Server), which includes the following modules: ● RAG (Rich Knowledge Base) tool for commercial cryptography standards: Built-in and provides a semantic-based standard clause retrieval interface for the basic requirements of cryptographic applications in information systems and various commercial cryptography technical standards and specifications. ● Protocol semantic alignment tool: maps low-level values ​​(such as 0xE101) to high-level semantic descriptions (such as the SM2-SM4-SM3 algorithm suite). C. Core Reasoning and Control Subsystem (Large Model End), which includes the following modules: ●AI Large Model Control Center: As the core of inference, it receives structured data and is responsible for scheduling other tools through the MCP protocol; ● Multi-dimensional compliance logic reasoning engine: Based on the preset compliance judgment chain, compare the metadata with the standard clauses retrieved by RAG using vector space and semantic logic (such as determining whether the handshake process sequence is compliant and whether the certificate chain is complete). ●Conflict detection and confidence measurement module: performs secondary verification on the reasoning conclusion, calculates the confidence score of the judgment result, and triggers anomaly alarms or blocking flags when serious violations are found; D. Audit and Traceability Subsystem, which includes the following modules: ●Structured traceability and report generation module: Binds compliance judgment conclusions to feature offsets of the original data packets to automatically generate PDF detection reports with evidence anchors. An automated method for cryptographic compliance analysis based on a large model and tool invocation protocol, characterized in that the method includes the following steps: S1. Traffic plane processing subsystem for data capture and preprocessing: The system acquires the network mirror traffic to be analyzed through the traffic plane processing subsystem; it uses the protocol feature filtering and stripping module to extract key data packets containing key negotiation, handshake or API calls; then the heterogeneous data structuring module parses these key packets and converts them into a data stream in standard JSON format; S2. Knowledge and Toolset Subsystem (MCP Server) performs context construction and tool invocation: The system inputs JSON format data streams into the core inference and control subsystem; the AI ​​large model control center uses the MCP protocol to call the protocol semantic alignment tool to perform semantic translation of the underlying values, and calls the commercial cryptographic standard RAG knowledge base tool to retrieve the GM / T or GB / T specification clauses involved in the current context; S3. Core Reasoning and Control Subsystem (Large Model End): Performs multi-dimensional logical reasoning and comparison. In a trusted computing environment, the multi-dimensional compliance logical reasoning engine performs multi-dimensional logical and vector comparisons between the translated semantic features and the retrieved regulatory clauses, analyzing whether the algorithm suite, random numbers, dual certificate structure, and handshake sequence meet compliance requirements. Specifically, this includes the following sub-steps: S3.1. Comparison of static protocol features with compliance baselines, including: parameter extraction and version determination, cipher suite legality verification, and random number entropy value and length verification; S3.2. Cryptographic entity and certificate trust chain reasoning, including: national cryptographic dual certificate architecture analysis and key usage and entity binding reasoning; S3.3. Timing state machine and handshake logic verification, including: timing state graph construction, standard process template mapping, and timing dependency and context coherence reasoning; S3.4. Comprehensive vector output mapping, including: the inference engine aggregates the judgment results of the above three steps, and packages the violation point, the specific standard and specification clause number cited in the violation, and the corresponding message Hex offset to generate a structured compliance judgment conclusion vector; S4. The conflict detection and confidence measurement module performs conflict verification and blocking marking: The conflict detection and confidence measurement module evaluates the confidence of the preliminary judgment results in step S3 and filters out potential AI illusions; when it is confirmed to be non-compliant, it triggers an anomaly marking. S5. Audit and Traceability Subsystem performs traceability anchoring and report output: The structured traceability and report generation module structurally associates the final compliance conclusion, the original text of the cited standard clauses, and the characteristic positions of the original data packets, and finally automatically generates and outputs a PDF cryptographic compliance test report with traceability capabilities. Attached Figure Description

[0004] Figure 1 This is a module architecture diagram of an automated cryptographic compliance analysis system based on a large model and tool calling protocol, according to the present invention. Figure 2 This is a flowchart illustrating the steps of an automated cryptographic compliance analysis method based on a large model and tool invocation protocol according to the present invention.

Claims

1. An automated cryptographic compliance analysis system based on a large model and tool invocation protocol, characterized in that, The network system includes the following subsystems: A. Flow surface processing subsystem, which contains the following modules: ● Traffic mirroring and acquisition module: Used to capture low-level network data packets from the switch mirroring port in real time or offline; ● Protocol Feature Filtering and Stripping Module: Used to extract key cryptographic interaction data packets (such as key negotiation and certificate exchange packets) based on commercial cryptographic features (such as specific ports and national cryptographic protocol handshake flags). ● Heterogeneous data structuring module: The extracted raw Hex or binary payload is formatted into a unified JSON structured object, and key metadata such as IP, algorithm suite, and random number NONCE are extracted; B. Knowledge and Toolset Subsystem (MCP Server), which includes the following modules: ● Commercial cryptography standard RAG knowledge base tool: Built-in and provides a semantic-based standard clause retrieval interface for the basic requirements of cryptographic applications in information systems and various commercial cryptography technical standards and specifications; ● Protocol semantic alignment tool: maps low-level numerical values ​​(such as 0xE101) to high-level semantic descriptions (such as the SM2-SM4-SM3 algorithm suite). C. Core Reasoning and Control Subsystem (Large Model End), containing the following modules: ● AI Large Model Control Center: As the core of inference, it receives structured data and is responsible for scheduling other tools through the MCP protocol; ● Multi-dimensional compliance logic reasoning engine: Based on the preset compliance judgment chain, compare the metadata with the standard clauses retrieved by RAG using vector space and semantic logic (such as determining whether the handshake process sequence is compliant and whether the certificate chain is complete). ● Conflict Detection and Confidence Measurement Module: Performs secondary verification on the reasoning conclusion, calculates the confidence score of the judgment result, and triggers anomaly alarms or blocking flags when serious violations are detected; D. Audit and traceability subsystem, which includes the following modules: ● Structured traceability and report generation module: Binds compliance judgment conclusions to feature offsets of the original data packets, automatically generating PDF detection reports with evidence anchors.

2. An automated method for cryptographic compliance analysis based on a large model and tool invocation protocol, characterized in that, The method includes the following steps: S1. Traffic plane processing subsystem for data capture and preprocessing: The system acquires the network mirror traffic to be analyzed through the traffic plane processing subsystem; and uses the protocol feature filtering and stripping module to extract key data packets containing key negotiation, handshake or API calls. These key packets are then parsed and converted into a data stream in standard JSON format by the heterogeneous data structuring module; S2. Knowledge and Toolset Subsystem (MCP Server) performs context construction and tool invocation: The system inputs JSON format data streams into the core inference and control subsystem; the AI ​​large model control center uses the MCP protocol to call the protocol semantic alignment tool to perform semantic translation of the underlying values, and calls the commercial cryptographic standard RAG knowledge base tool to retrieve the GM / T or GB / T specification clauses involved in the current context; S3. Core Reasoning and Control Subsystem (Large Model End) performs multi-dimensional logical reasoning and comparison: In a trusted computing environment, the multi-dimensional compliance logical reasoning engine performs multi-dimensional logical and vector comparison between the translated semantic features and the retrieved regulatory clauses, and analyzes whether its algorithm suite, random number, dual certificate structure and handshake sequence meet the compliance requirements. Specifically, it includes the following sub-steps: S3.

1. Comparison of static protocol features with compliance baselines, including: parameter extraction and version determination, cipher suite legality verification, and random number entropy and length verification; S3.

2. Cryptographic entity and certificate trust chain reasoning, including: parsing of the national cryptographic dual certificate architecture and reasoning on the binding of key usage with entities; S3.

3. Verification of temporal state machine and handshake logic, including: construction of temporal state graph, mapping of standard process template, and reasoning on temporal dependencies and contextual coherence; S3.

4. Comprehensive vector output mapping, including: the inference engine aggregates the judgment results of the above three steps, and packages the violation point, the specific standard and specification clause number cited in the violation, and the corresponding message Hex offset to generate a structured compliance judgment conclusion vector; S4. The conflict detection and confidence measurement module performs conflict verification and blocking marking: The conflict detection and confidence measurement module evaluates the confidence of the preliminary judgment results in step S3 and filters out potential AI illusions; when it is confirmed to be non-compliant, it triggers an anomaly marking. S5. The audit and tracing subsystem performs tracing anchoring and report output: The structured tracing and report generation module structurally associates the final compliance conclusion, the original text of the cited standard clauses, and the characteristic positions of the original data packets, and finally automatically generates and outputs a PDF cryptographic compliance test report with tracing capabilities.

Images