CN116070214A

CN116070214A - Safety testing method and electronic equipment

Info

Publication number: CN116070214A
Application number: CN202211051030.6A
Authority: CN
Inventors: 马守亮; 汪自强
Original assignee: Honor Device Co Ltd
Current assignee: Honor Device Co Ltd
Priority date: 2022-08-30
Filing date: 2022-08-30
Publication date: 2023-05-05
Anticipated expiration: 2042-08-30
Also published as: CN116070214B

Abstract

The application provides a safety test method and electronic equipment, and relates to the technical field of safety test. According to the method, after threat modeling analysis is carried out, test items which need to be carried out by the first application are determined from test items corresponding to most safety risks, so that the test range is more comprehensive; after the test items are determined, the case and the test parameters can be automatically obtained and tested, and the safety test report is automatically output, so that manual operation of a user is not needed, and the test efficiency is high. The method comprises the following steps: the method comprises the steps of receiving a drawing instruction, generating a threat modeling analysis chart, receiving a selection instruction, selecting a first test item from a plurality of test items provided by a security asset library for a plurality of primitives, determining a first test case according to the first test item, acquiring a first plug-in and first test data, testing based on the first test data and the first plug-in, obtaining a first alarm result, and generating a security test report based on the first test item, the first test case and the first alarm result.

Description

Safety testing method and electronic equipment

Technical Field

The application relates to the technical field of safety test, in particular to a safety test method and electronic equipment.

Background

With the rapid development of the mobile internet, various applications have penetrated into aspects of the life of people. For example, in the fields of reading, traveling, learning, information, life, etc., there are a huge number of applications, and various kinds of rich and colorful services are provided for users. The security of these applications becomes an important factor affecting the user experience and protecting the privacy of the user.

Currently, in order to provide a user with a good user experience, an application vendor may perform security testing on an application before the application is formally online. The existing security test flow does not have security threat analysis, only the personal experience of the tester and a general security scanning tool are used for testing, so that the security requirement cannot be fully covered in the test process, and the test item is missed due to insufficient experience of the tester or insufficient functions of the security scanning tool, so that the security test is incomplete, and loopholes are easy to exist. In addition, when the test items are too many, test data are required to be respectively input into different safety tools, the operation is complex, and the efficiency of the test process is low.

Disclosure of Invention

The embodiment of the application provides a safety test method and electronic equipment, which are used for solving the problems of incomplete safety test and low efficiency.

In order to achieve the above purpose, the embodiments of the present application adopt the following technical solutions:

in a first aspect, a security test method is provided, the method comprising: and receiving a drawing instruction, and generating a threat modeling analysis chart, wherein the threat modeling analysis chart is used for indicating the security threat risk of the first application, and the threat modeling analysis chart comprises a plurality of primitives. The security threat risk of the first application comprises the security risk of 5 aspects of external interaction party, data flow, processing procedure, data storage and trust boundary. And receiving a selection instruction, and selecting a first test item from a plurality of test items provided by the secure asset library for a plurality of primitives. The safety asset library comprises a plurality of test items corresponding to safety risks collected in advance, so that the user can select more, and the test range is more comprehensive. And then, a first test case can be obtained from the secure asset library based on the first test item, wherein the first test case comprises a case type, the secure asset library further comprises a plurality of test cases and the corresponding relation between the plurality of test cases and the plurality of test items, and the plurality of test cases comprise the first test case. If the case type indicates that the first test case is an automatic case, a first plug-in is obtained by inquiring from a safety asset library based on the first test case, the safety asset library further comprises association relations between a plurality of test cases and a plurality of test plug-ins, and the plurality of test plug-ins comprise the first plug-in. That is, the security asset library also includes security test plug-ins for different test cases, which are more comprehensive than conventional security scan tools. Then, first test data can be acquired; testing based on the first test data and the first plug-in unit to obtain a first alarm result; and generating a security test report based on the first test item, the first test case and the first alarm result. The test can be automatically performed and the safety test report can be output, the manual operation of a user is not needed, and the test efficiency is high.

In one possible implementation, acquiring the first test data includes: analyzing the configuration file of the first plug-in to obtain task parameters, wherein the task parameters are parameters required by running the first plug-in; and sending the task parameters to the client so that the client displays an input box for inputting the task parameters, and after a user inputs first test data through the input box, sending the first test data to the electronic equipment (such as a server), and receiving the first test data sent by the client by the electronic equipment. That is, only parameters required in the test process can be obtained without the need of the user to inquire, so that the omission of the user can be avoided, and the test efficiency can be improved. Particularly, when the number of the first plug-ins is multiple, the test data of the multiple first plug-ins can be obtained in batches, manual input of a user for each plug-in is not needed, time for inputting the test data is saved, and test efficiency is improved.

In one possible implementation, the first test case is a test case of a first type (e.g., DAST), the first test data includes parameters required for running the first plugin, testing is performed based on the first test data and the first plugin, and obtaining the first alarm result includes: writing the first test data into a configuration file of the first plug-in; and operating the first plug-in after the first test data are written to obtain a first alarm result.

In one possible implementation manner, running the first plug-in after writing the first test data, and obtaining the first alarm result includes: generating a plug-in package of the first plug-in based on the configuration file written with the first test data; sending a plug-in package of the first plug-in to an executive machine; establishing remote connection with an execution machine and sending an operation instruction to the execution machine; and receiving a first alarm result sent by the executor.

In one possible implementation, if the first test case is a test case of a second type (for example, SAST), the first test data includes a code address of the first application, and the performing the test based on the first test data and the first plugin, to obtain the first alarm result includes: acquiring a service code of a first application according to the first test data; and scanning the service code of the first application by using the first plug-in based on the scanning rule carried by the first test case to obtain a first alarm result.

In one possible embodiment, the method further comprises: determining an alarm state of the first alarm result, wherein the alarm state is used for indicating whether the first alarm result needs to be declared; based on the first test item, the first test case and the first alarm result, generating the security test report includes: and generating a security test report based on the first test item, the first test case, the first alarm result and the alarm state of the first alarm result.

In one possible implementation, determining the alert status of the first alert result includes: judging whether the historical alarm result comprises a second alarm result matched with the first alarm result; if the historical alarm result comprises a second alarm result matched with the first alarm result, determining the alarm state of the first alarm result according to the alarm state of the second alarm result, wherein the alarm state of the first alarm result is consistent with the alarm state of the second alarm result.

In one possible implementation, the second alarm result is an alarm result obtained by running the second plug-in based on the second test data; if the first test case is a first type test case, the second alarm result is the same as the first alarm result, the second plug-in is the same as the first plug-in, the first test data is the same as the second test data, and the first alarm result is matched with the second alarm result.

In one possible implementation, the second alarm result is an alarm result obtained by running the second plug-in based on the second test data; if the first test case is a second type test case, the second alarm result is the same as the first alarm result, the second plug-in is the same as the first plug-in, the first test data is the same as the second test data, the service code indicated by the first test data is the same as the service code indicated by the second test data, and the first alarm result is matched with the second alarm result.

In a second aspect, the present application further provides a security testing method, applied to a testing system, where the testing system includes a client and a server, and the method includes: the client displays a first interface, wherein the first interface comprises a plurality of test items provided by a safety asset library, and the safety asset library also comprises a plurality of test cases and corresponding relations between the plurality of test cases and the plurality of test items; responding to the drawing operation of a user on a first interface, and sending a drawing instruction to a server by a client; the method comprises the steps that a server receives a drawing instruction, and a threat modeling analysis chart is generated, wherein the threat modeling analysis chart is used for indicating security threat risks of a first application and comprises a plurality of primitives; the server sends a threat modeling analysis graph to the client; the client receives the threat modeling analysis graph and displays the threat modeling analysis graph on a first interface; responding to the selection operation of a user, and sending a selection instruction to a server by a client; the method comprises the steps that a server receives a selection instruction and selects a first test item from a plurality of test items for a plurality of primitives; the server obtains a first test case from a security asset library based on the first test item, wherein the first test case comprises a case type, the security asset library further comprises a plurality of test cases and corresponding relations between the plurality of test cases and the plurality of test items, and the plurality of test cases comprise the first test case; if the case type indicates that the first test case is an automatic case, the server queries from a secure asset library based on the first test case to obtain a first plug-in, the secure asset library further comprises association relations between a plurality of test cases and a plurality of test plug-ins, and the plurality of test plug-ins comprise the first plug-in; the server acquires first test data; the server tests based on the first test data and the first plug-in to obtain a first alarm result; the server generates a security test report based on the first test item, the first test case and the first alarm result.

In one possible implementation, the server obtaining the first test data includes: the server analyzes the configuration file of the first plug-in to obtain task parameters, wherein the task parameters are parameters required by running the first plug-in; the server sends task parameters to the client; the client receives the task parameters and displays a second interface, wherein the second interface comprises an input box which is used for prompting a user to input the task parameters; responding to input operation of a user in an input box, and sending first test data to a server by a client; the server receives the first test data.

In a third aspect, the present application also provides an electronic device comprising a processor, the processor and memory coupled, the memory storing program instructions that, when executed by the processor, cause the electronic device to implement the security test method of any one of the first aspects or the method performed by any one of the servers of the second aspects. The electronic device may be a server or a terminal device such as a personal computer.

In a fourth aspect, the present application also provides a computer-readable storage medium comprising computer instructions; when the computer instructions are run on the server, causing the server to perform the security test method of any one of the first and second aspects; when the computer instructions are run on the client, the client is caused to perform the security test method as in any of the second aspects.

In a fifth aspect, the present application provides a computer program product which, when run on a computer, causes the computer to perform the method according to the first aspect and any one of its possible designs.

In a sixth aspect, the present application provides a chip system comprising one or more interface circuits and one or more processors. The interface circuit and the processor are interconnected by a wire. The chip system described above may be applied to an electronic device including a communication module and a memory. The interface circuit is for receiving signals from a memory of the electronic device and transmitting the received signals to the processor, the signals including computer instructions stored in the memory. When executed by a processor, the electronic device may perform the method as described in the first aspect and any one of its possible designs.

It may be appreciated that the advantages achieved by the security test method according to the second aspect, the electronic device according to the third aspect, the computer readable storage medium according to the fourth aspect, the computer program product according to the fifth aspect and the chip system according to the sixth aspect may refer to the advantages as in the first aspect and any one of the possible design manners thereof, and will not be described herein.

Drawings

FIG. 1 is a schematic diagram of a security test flow provided in the prior art;

FIG. 2 is a schematic structural diagram of a test system according to an embodiment of the present disclosure;

FIG. 3 is a schematic structural diagram of another test system according to an embodiment of the present disclosure;

FIG. 4 is a schematic flow chart of a method for constructing a secure asset library according to an embodiment of the present application;

FIG. 5 is a schematic flow chart of determining a test case type according to an embodiment of the present application;

FIG. 6 is a schematic diagram of a security test flow provided in an embodiment of the present application;

FIG. 7 is a threat modeling analysis diagram provided by an embodiment of the application;

FIG. 8 is an interface diagram provided in an embodiment of the present application;

FIG. 9 is a schematic diagram of another security test flow provided in an embodiment of the present application;

FIG. 10 is a schematic diagram of a security test procedure according to an embodiment of the present disclosure;

FIG. 11 is a schematic diagram of a safety test flow according to an embodiment of the present disclosure;

fig. 12 is a schematic structural diagram of a chip system according to an embodiment of the present application.

Detailed Description

Exemplary embodiments of the present application are described below in conjunction with the accompanying drawings, which include various details of the embodiments of the present application to facilitate understanding, and should be considered as merely exemplary. Accordingly, one of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present application. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

For clarity and conciseness in the description of the embodiments below, a brief introduction to related concepts or technologies is first given:

the test item is a potential safety risk item in the application to be tested.

Test Case (Test Case) refers to the description of a specific software product for testing tasks, and the Test scheme, method, technology and strategy are embodied. The content of the method comprises a test target, a test environment, input data, a test step, an expected result, a test script and the like, and finally a document is formed. Briefly, a test case is a set of test inputs, execution conditions, and expected results tailored for a particular goal to verify that a particular software requirement is met.

In order to provide a good user experience for the user, the application vendor may perform security testing on the application before the application is formally online. As shown in fig. 1, the current security test flow mainly includes two types: automated testing and manual testing. The automatic test means that the security tool is used for scanning the application to be tested, after the security tool obtains a scanning result, a tester performs vulnerability analysis on the scanning result, and a security test report is manually generated. Among them, common safety tools include Appscan, awvs, nessus, dbSacn, xray, sqlmap and the like. The manual testing may include a tester inspecting the code or black box testing the application under test, and performing vulnerability analysis on the test results, manually generating a security test report. In the black box testing process, a tester regards a program of an application to be tested as a black box which cannot be opened, and tests a program interface of the application to be tested under the condition that the internal structure and the internal characteristics of the program are not considered at all, and only checks whether the program function is normally used according to the specification of a requirement specification, and whether the program can properly receive input data to generate correct output information.

The test flow has the following problems:

1. threat modeling analysis is not performed on the application to be tested from a business aspect, and the risk of missing test items exists.

2. Lacking the safety test standard and method for specific business characteristics, the test process relies on the personal experience of the tester.

3. The safety tool has a limit and tests based on the safety tool are limited.

4. When the test items are too many, test data are required to be input into different safety tools respectively, the operation is complex, and the efficiency of the test process is low.

5. After the safety test is finished, a tester is required to manually summarize the scanning results of various safety tools and manually output a safety test report, which is complicated and affects the test efficiency.

Therefore, the test flow provided by the prior art has the problems of incomplete safety test and lower test efficiency.

The embodiment of the application provides a security testing method which can be used for a tester to conduct threat analysis modeling on a first application and select a plurality of first test items for the first application in a security asset library, wherein the security asset library comprises a plurality of test items, and the plurality of test items correspond to potential safety hazards possibly existing in different scenes of different applications. Thus, the test performed by the first application can be as comprehensive as possible, and the risk of missing test items is reduced.

Based on the security test method provided by the embodiment of the application, the test data of each first test item is obtained after a plurality of first test items are determined, and the alarm result is obtained by testing based on the test data of each test item and the corresponding plug-in unit respectively, so that a plurality of tests can be performed in parallel, and the effect of improving the test efficiency is achieved.

Based on the safety test method provided by the embodiment of the application, the safety test report can be automatically generated based on the first test item selected by the user, the test case corresponding to the first test item and the alarm result, manual arrangement and output of the user are not needed, and the test efficiency is improved.

Fig. 2 is a schematic diagram of a scenario of a test system provided in the present application, where the test system may include devices such as a client 110 and a server 120, and the devices may implement communication through a network, so as to implement transmission of information such as first test data or other data. The network may be the internet, a cellular network, or other network, etc. The network may include one or more network devices, e.g., the network devices may be routers or switches, etc.

For example, the client 110 in the embodiments of the present application may be a mobile phone, a tablet computer, a desktop (desktop), a handheld computer, a notebook (laptop), an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook, a personal digital assistant (personal digital assistant, PDA), an augmented reality (augmented reality, AR) \virtual reality (VR) device, and the specific form of the client 110 is not limited in particular.

During testing, server 120 may be an application server supporting security test functions, for example, the application server may be a providing threat analysis modeling service, security test service, to provide test items to users during testing, and to output security test reports.

In addition, the server 120 may also be a data center, which may include one or more physical devices with testing functions, such as a server, a mobile phone, a tablet computer, or other devices. For example, the server 120 employed in the testing process refers to a data center deployed with multiple servers, which may also be referred to as a server cluster, which may have racks that may establish communications for the multiple servers through wired connections, such as a universal serial bus (universal serial bus, USB) or a peripheral component interconnect express (peripheral component interconnect express, PCIe) high speed bus, or the like.

By way of example, the server 120 shown in fig. 2 may be implemented by the server 220 shown in fig. 3, and the client 110 may also be implemented by the client 210 shown in fig. 3, and fig. 3 is a schematic structural diagram of another test system provided in the present application, where the test system includes the server 220, the client 210, and the accelerator 215. Server 220 is a common computer device. A user may input data to server 220 through client 210. The client 210 is a terminal device including, but not limited to, a personal computer, a server, a cell phone, a tablet computer, a smart car, etc.

Server 220 may include an input/output (I/O) interface 214, a processor 211, and a memory 212. The I/O interface 214 is used to communicate with devices external to the server 220. For example, the client 210 inputs data to the server 220 through the I/O interface 214, or the server 220 sends a security test report to the client 210 through the I/O interface 214.

The processor 211 is an operation core and a control core of the server 220, and may be a central processing unit (central processing unit, CPU) or other specific integrated circuits. The processor 211 may also be other general purpose processors, digital signal processors (digital signal processing, DSP), application specific integrated circuits (application specific integrated circuit, ASIC), field programmable gate arrays (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. In practice, the server 220 may also include multiple processors. One or more processor cores may be included in processor 211. An operating system and other software programs are installed in processor 211 so that processor 211 can implement access to memory 212 and various PCIe devices.

The processor 211 is connected to the memory 212 via a Double Data Rate (DDR) bus or other type of bus. Memory 212 is the main memory of server 220. Memory 212 is typically used to store various running software in the operating system, input data received from clients 210, security test reports for future transmission to clients 210, and the like. In order to increase the access speed of the processor 211, the memory 212 needs to have an advantage of a high access speed. In conventional computer devices, dynamic random access memory (dynamic random access memory, DRAM) is typically employed as the memory 212. In addition to DRAM, memory 212 may be other random access memory, such as static random access memory (static random access memory, SRAM) or the like. The memory 212 may be a Read Only Memory (ROM). For read-only memory, for example, it may be a programmable read-only memory (programmable read only memory, PROM), erasable programmable read-only memory (erasable programmable read only memory, EPROM), etc. The present embodiment is not limited in the number and type of memories 212.

For persistent storage of data, as shown in fig. 3, a data storage system 213 (or called a database, a secure asset library, etc.) is disposed in the test system, and the data storage system 213 may be located outside the server 220 (as shown in fig. 3), and disposed on a different physical device from the server 220, and exchanges data with the server 220 through a network. Alternatively, the data storage system 213 may be located inside the server 220, deployed on the same physical device as the server 220, where the data storage system 213 exchanges data with the processor 211 over the PCIe bus 216. At this time, the data storage system 213 is represented as a storage medium such as a hard disk.

Illustratively, the data storage system 213 may be used to store security specifications, security test guidelines, test case tables, security test plug-ins, security scan rules, and the like. The safety specification comprises a guiding and specification file for safety test of each large manufacturer and enterprise; the security test guidelines are security specifications that are arranged in a format. The test case table includes test cases, test items, and the correspondence between test cases and test items, and can provide services for the server 220 to query the test cases corresponding to the test items. The security test plug-ins include plug-ins required to conduct a security test. The security scan rules include rules for performing code scans. In addition, the data storage system 213 further stores the corresponding relationship between the test case and the security test plug-in or the security scan rule, and can provide the server 220 with the service of querying the corresponding security test plug-in or the security scan rule according to the test case.

Optionally, as shown in FIG. 2, the data processing system may also include an acceleration device 215 for performing test tasks. The processor 211 transmits the data processing task and the input data to the acceleration device 215, and the acceleration device 215 transmits the processing result to the processor 211 after completing the data processing task according to the input data. As shown in FIG. 3, accelerator 215 may be plugged directly into a card slot on the motherboard of server 220, exchanging data with processor 211 over PCIe bus 216. It should be noted that PCIe bus 216 in fig. 1 may be replaced with a bus accelerator 215 that is a computing interconnect express (compute express link, CXL), universal serial bus (universal serial bus, USB) protocol, or other protocol for data transfer.

In addition, the acceleration device 215 may be located in the acceleration apparatus instead of being directly inserted into a card slot on the motherboard of the server 220. Such as the acceleration device is a device independent of the server 220. In this case, the server 220 may be connected to the accelerator 215 via a wired network such as a network cable, or may be connected to the accelerator 215 via a wireless network such as a wireless hotspot or bluetooth (bluetooth). Such as acceleration device 215, for processing AI tasks, e.g., training and reasoning, the acceleration device may be implemented by one or more chips. The chip comprises any one of CPU, graphics processor (graphics processing unit, GPU), neural network processor (neural-network processing units, NPU), tensor processing unit (tensor processing unit, TPU), FPGA and ASIC. The GPU is also called a display core, a visual processor, and a display chip, and is a microprocessor that is specially used for image operation on a personal computer, a workstation, a game machine, and some mobile devices (such as a tablet computer, a smart phone, etc.). The NPU mimics human neurons and synapses at the circuit layer and processes large-scale neurons and synapses directly with a deep learning instruction set, one instruction to complete the processing of a set of neurons. An ASIC is suitable for a single use integrated circuit product.

The above-mentioned data processing task may be a security risk test, database update, or various tasks in database-based data export, data matching, data query, or data search for the first application.

In order to implement the security test method provided in the present application, on the basis of the test system shown in fig. 3, an implementation manner of constructing a security asset library is provided in the present application. This method of constructing a secure asset library may be applied to the test system shown in fig. 3. The security test method may be performed by the server 220 shown in fig. 3, for example. As shown in fig. 4, fig. 4 is a flow chart of a method for constructing a secure asset library provided in the present application, where the method for constructing a secure asset library includes the following steps:

s410, the server 220 obtains the security specification and the security test guidance.

The safety specifications comprise guide and specification files of various large manufacturers and enterprises for safety test, namely, the safety specifications can be multiple. Specifically, it may include which tests need to be performed, specific steps of the tests, test environments, theoretical basis of the test process, and the like.

Considering that the formats of the security specifications of different manufacturers are different, the server 220 is inconvenient to identify, and the security test guidance can be uploaded to the server 220 together after the security test guidance is obtained by the testers to the security specifications of each manufacturer according to the agreed format. The security test guidelines may include a directory and a body. The catalog may be a multi-level catalog, wherein a first level catalog is used to indicate which test items are included. Illustratively, the first level directory may include: 1 test item: mybatis framework SQL injection, 2 test items: hibernate framework SQL injection, etc. The second level directory further classifies the first level directory, wherein classifying may include: basic knowledge, test sub-items, problem grading, typical problems, solutions, etc. Wherein, the specific testing steps for testing the test item are recorded in the test sub item. It should be noted that the foregoing list is merely an example, and the security test guidance may include more test items than the foregoing examples, and each test item may include more or less classifications, which are not limited herein.

It can be seen that by means of the security test guidance, the server can determine which test items are included in the security test guidance, and the corresponding test steps.

After receiving the security test guidance, the server 220 may assign a file ID to each security test guidance, so as to facilitate subsequent queries.

S420, the server 220 associates the security specification with the security test guidance.

That is, the server 220 can establish an association relationship for the security specification and the security test guidance corresponding thereto, so that when the tester can use the security test guidance, the tester can find the corresponding security specification through the association relationship, thereby facilitating tracing.

S430, the server 220 analyzes the security test guidance and generates a security test guidance table.

The security test guidance table records each directory entry and the attribution relationship between the directory entries. In the embodiment of the present application, the server 220 may record the chapter coordinates of each directory entry in the directory, and represent the attribution relationship between the directory entries with the chapter coordinates of each directory entry. Illustratively, the security test guidance table may be as shown in table 1:

TABLE 1

As shown in table 1, test item 1: mybatis framework SQL injection includes 1.1 base knowledge, 1.2 test sub-items, 1.3 problem grading, 1.4 typical problems, and 1.5 solutions. The basic knowledge of 1.1 includes 1.1.1SQL injection introduction, 1.1.2SQLMybatis framework, 1.1.3SQL injection type, 1.1.34QL injection hazard, and the test sub-item of 1.2 includes 1.2.1Mybatis framework SQL injection test.

Optionally, the security test guidance table may also record source information for each test item, the source information being used to indicate from which security test guidance the test item is to be derived. Illustratively, the source information may include a file ID of the security test guidance to which the directory entry belongs. For example, in the security test guidance of "SQL injection of Web application security test", the "test item" is recorded: the Mybatis framework SQL injection "related content, the" test item "can be determined: the source information of Mybatis framework SQL injection is the file ID of security test guidance, namely 'SQL injection of Web application security test'.

Optionally, the server 220 may also visualize the security test guidance table. The visual safety test guiding table can be understood as an interface (such as a first interface) drawn based on the safety test guiding table and an interface created, so that a user can conveniently and intuitively inquire the safety test guiding table.

Optionally, before the server 220 parses the security test guidance, it may be checked whether the directory of security test guidance is in a preset format; if the catalog format of the security test guidance is the preset format, the verification is successful, and the server 220 continues to analyze the security test guidance; if the directory format of the security test instruction is not the preset format, the server 220 may directly generate the information of the parsing failure.

S440, server 220 generates test cases based on the security test guidance table.

Server 220 may generate test cases for each test item in the secure test guidance table. Specifically, the server 220 may obtain a security test instruction corresponding to the test item. Then, a test case is generated based on the test sub-items under the test item in the security test guidance. The test case may include: test steps, security specifications, security test guidelines, test items, test sub-items, case classifications, case categories, result classifications, case authors, URLs of case guidelines, recommended solutions, case online-offline status, case audit status, case creation time, case modification time, whether to delete, etc. In generating test cases, server 220 may also assign a user ID to each test case to facilitate querying and logging.

Optionally, the server 220 may also generate a test case table based on all test cases. The test case table can record the case ID of each test case, the test item, the test sub-item and the security test guidance corresponding to the test case. Illustratively, the test case table may be as shown in Table 2:

TABLE 2

As can be seen from Table 2, the test case with case ID 390 can be subjected to Mybatis framework SQL injection test, the security test guidance of which is "SQL injection for Web application security test".

Optionally, the server 220 may also visualize the test case table. The visual test case table can be understood as a drawing interface and a creation interface based on the test case table, so that a user can conveniently and intuitively inquire the test case.

S450, the server 220 associates the automation use case with a corresponding security test plug-in or a corresponding security scan rule.

That is, the server 220 may establish an association of an automation use case with its corresponding security test plug-in, or an association of an automation use case with its corresponding security scan rule.

Specifically, after the test cases are generated, the tester may record the case type of each test case and the associated security test plug-in or security scan specification. As shown in FIG. 5, the tester determines whether each test case is an automated case or a non-automated case. Specifically, the tester can judge whether the test can be automated or not through the test steps carried in each test case. The automatic use cases refer to use cases which can be automatically tested by using equipment, and the non-automatic use cases refer to use cases which need to be manually tested by a tester. After determining whether the test case is an automated case or a non-automated case, a tester can write a corresponding case type in the test case.

For an automation use case, the tester may also analyze the automation type of the use case. Among the automation types include static application security testing (static application security testing, SAST) and dynamic application security testing (dynamic application security testing, DAST). DAST refers to testing that needs to be performed during dynamic running of an application, and SAST refers to testing that directly scans the code of an application without running the application. If the test case is of the DAST type (which may also be referred to as a first type), server 220 may associate the test case with a corresponding security test plug-in, which may be a plug-in an existing plug-in that is capable of automatically performing a test step in the test case, or a security test plug-in that is configured by a tester based on the test step. If the test case is of the SAST type (also referred to as the second type), server 220 may associate the test case with corresponding security scan rules, which may be scan rules that the tester constructs according to the test steps in the test case. In addition, the server 220 may also write in the name of the security test plug-in or the name of the security scan rule required for performing the test in the test case, and record the corresponding relationship between each test case and the security test plug-in or the security scan rule, so that the server 220 searches for the corresponding security test plug-in or security scan rule according to the test case.

S460, the server 220 stores the security specification, the security test instruction, the test case, the security test plug-in, and the security scan rule in the database.

It should be noted that, the server 220 may update or add security specifications, security test instructions, test cases, security test plug-ins, and security scan rules included in the database (security asset library) according to the service requirements of the testers, so as to continuously perfect the security asset library.

In this way, the database (may also be referred to as a secure asset library) includes security specifications, security test instructions, test cases, security test plug-ins, and security scan rules, and the server 220 may extract test items from the secure asset library for a user to select in a test process, search for test cases based on the test items, query corresponding security test plug-ins or security scan rules based on the test cases, and so on.

In order to implement the security test method provided in the present application, on the basis of the test system shown in fig. 3, an implementation manner of the security test method is provided in the present application. The security test method can be applied to the test system shown in fig. 3. The security test method may be performed by the server 220 shown in fig. 3, for example. As shown in fig. 6, fig. 6 is a flow chart of a security testing method provided in the present application, and the security testing method includes the following steps:

S610, the server 220 receives the drawing instruction, and constructs a threat modeling analysis chart.

The threat modeling analysis graph is used for reflecting the security threat risk of the first application. The threat modeling analysis graph includes a plurality of primitives, the types of which may include external interactors, data flows, processes, data stores, and trust boundaries, each of which may represent a security threat risk. External interacting parties refer to elements of a person or object that are capable of driving system traffic, but not under control of the system, typically representing input/output of a target system. The data stream is used to indicate the direction of movement of the data in the system. A process is a logical representation of a process when it performs a task. The data store represents a database, file, registry, memory, etc. Trust boundaries refer to boundaries between trusted and untrusted elements.

For example, the first application may be a shopping APP, and the first application needs to obtain product information, order information, and order from a mall, and the mall needs to call an interface of a bank server in the payment process to complete the payment operation. Based on this, the user may draw a threat modeling analysis graph for the first application. As shown in fig. 7, the threat modeling analysis graph of the first application may include 7 primitives, respectively: 2 external interactors (respectively, honor mall, bank server), 1 processing procedure (i.e. first application), 2 data streams (respectively, honor mall and first application data streams, honor mall and bank server data streams), and 2 trust boundaries (respectively, honor mall and first application boundaries, honor mall and bank server boundaries). That is, the first application presents a security threat risk in these 7 aspects.

The drawing instruction may be generated after the client 210 receives a drawing operation by a user. Illustratively, the client 210 may display the interface 810. As shown in fig. 8, the interface 810 includes a first region 811, a second region 812, and a third region 813. The first region 811 may also be referred to as a primitive selection region for providing a variety of primitives for selection by a user. The second region 812 is for the user to draw a threat modeling analysis graph. This second region 812 may also be referred to as a dataflow graph drawing region, threat modeling region, and the like, without specific limitation herein. The third area 813 includes a plurality of test items for user selection, which may be provided by a secure asset library, including, for example, all subdirectories under "unpublished account/interface", "content missing", all subdirectories under "command description is not consistent with reality", and so forth.

The drawing operation includes an operation that a user drags the primitive in the first region 811 to the second region 812, double-clicks the primitive (to modify the name of the primitive), and connects the primitives according to the data flow direction of the first application. The client 210 detects a drawing operation of the user in the second region 812, and may transmit the drawing instruction to the server 220. After server 220 builds the threat modeling analysis, the threat modeling analysis may also be sent to client 210 for display by client 210 in second area 812.

S620, the server 220 receives the selection instruction, and determines the first test item from the plurality of test items.

The selection instruction may include an ID of the first test item. As such, server 220 may determine a first test item from the plurality of test items based on the ID.

The selection instruction may be generated after the client 210 receives a selection operation of the user. Illustratively, as shown in FIG. 8, the third area 813 of the first interface 810 includes a plurality of test items. In response to a user selecting a first test item from the plurality of test items, the client 210 may send a selection instruction to the server 220, where the selection instruction carries an ID of the first test item. After the selection operation of the user is detected, the test item selected by the user is in a selected state.

It should be noted that, the user may right-key each primitive of the threat modeling analysis graph, and select one or more test items for each primitive. In this manner, the selection instruction may carry the ID of one or more test items. Correspondingly, the first test item determined by the server 220 may also be plural.

It will be appreciated that the plurality of test items comprises a majority of security risk items in the security test process, through which a more comprehensive test concept can be provided to the user, so that the testing of the first application is more comprehensive.

S630, the server 220 determines the first test case.

Specifically, the secure asset library stores the correspondence between a plurality of test items and a plurality of test cases, and the server 220 may determine the first test case based on the first test item and the correspondence.

The first test case carries a type of the case. The case type is used to indicate that the first test case is an automated case or a non-automated case.

S640, the server 220 determines whether the first test case is an automation case.

If the server 220 determines that the first test case is an automation case, the server 220 may execute S650; if the server 220 determines that the first test case is a non-automation case, the tester is reminded to manually test the first test item.

S650, the server 220 queries from the secure asset library for the first plugin based on the first test case.

The secure asset library also includes an association of a plurality of test cases with a plurality of test plug-ins, the plurality of test plug-ins including a first plug-in. As such, the server 220 may determine the first plug-in based on the first test case and the association.

It should be noted that, if the first test case is a DAST type test case, the first test case further includes a card name of the first card, where the first card is a card capable of automatically executing the test step carried in the first test case. If the first test case is a test case of SAST type, the first plug-in is a code scanning plug-in, and can be used for scanning service codes.

S660, the server 220 obtains the first test data.

The first test data is a parameter required to be used in a first test (a test corresponding to a first test item) process of the first application.

Alternatively, the first test data may be input by the user through the client 210. As shown in fig. 9, the process of obtaining the first test data by the server 220 may include:

s661, the server 220 analyzes the configuration file of the first plug-in to obtain the task parameters.

Specifically, the configuration file of the first plugin may refer to a default. Json file of the first plugin, where task parameters required for running the first plugin are recorded in the default. Json file. Illustratively, the default. Json file of the first plug-in may include:

{

"host": "host IP |xxx|",

"type": "plug-in type |xxx|",

"user": "user name |xxx|",

"password": "password |xxx|"

"port": "port |xxx|",

"filepath": path |xxx| "

}

That is, 6 types of parameters, host (host), type (plug-in type), user (user name), password (password), port (port), and filepath (path), are included in the default. Json file of the first plug-in.

S662, the server 220 transmits the task parameters to the client 210.

After parsing the task parameters, the server 220 may send the task parameters to the client 210. After the client 210 receives the task parameters, a second interface 910 may be displayed. As shown in fig. 9, the second interface 910 includes a name of each task parameter and a corresponding input box, so that the user can input the host, the plug-in type, the user name, the password, the port and the path. In response to the user's input operation in each input box, the client 210 transmits first test data to the server 220. For example, the first test data includes specific values of 6 parameters of host, plug-in type, user name, password, port, and path.

S663, the server 220 receives the first test data sent by the client 210.

It should be noted that, when there are multiple first test cases, the server 220 may analyze the task parameters of each first plug-in, and remind the user to uniformly input the task parameters of all the test tasks, so that the test efficiency may be effectively improved without inputting the parameters to the plug-ins respectively.

S670, the server 220 performs testing based on the first test data and the first plug-in to obtain a first alarm result.

The process by which server 220 performs the test is different for different types of test cases. Next, a process of performing the test by the server 220, which may include steps S671 to S675 or S676 to S677, will be described in detail with reference to fig. 10.

Wherein, when the first test case is of a DAST type (which may also be referred to as a first type), the server 220 may perform S671 to S675.

The server 220 writes the first test data to the configuration file of the first card at S671.

The first test data is written into the first plugin, which can be understood as copying the first test data to the default. Illustratively, the default. Json file after writing the first test data may include:

{

"host": "host ip|10.20.02.20|",

"type": "plug-in type |OS|",

"user": "user name |root|",

"password |1359qwe | |"

"Port": "Port |22|",

"filepath"/home/1. Sql ")"

}

The host IP is 10.20.02.20, the plug-in type is OS, the user name is root, the password is 1359qwe, the port is 22, and the path is home/1.Sql.

S672, the server 220 generates a package of the first plug-in based on the configuration file after writing the first test data.

That is, the server 220 may repackage the executable file of the first plugin and the configuration file (i.e., default. Json file) after writing the first test data, to generate a plugin package of the first plugin.

S673, the server 220 sends the plug-in package of the first plug-in to the execution machine.

The plug-in package of the first plug-in comprises an executable file of the first plug-in and a configuration file after writing the first test data.

After receiving the plug-in package of the first plug-in, the executing machine can execute the executable script/executable program in the plug-in package to complete the test task.

S674, the server 220 establishes a remote connection with the execution machine and sends an operation instruction to the execution machine.

The running instruction is used for indicating the execution machine to run the first plug-in unit after the first test data are written.

In one embodiment, server 220 may establish a remote connection with an execution machine through paramiko. After establishing a remote connection with the execution machine, server 220 may send an execution instruction to the execution machine. After receiving the operation instruction, the execution machine can decompress the plug-in package of the first plug-in, and then execute the executable file in the plug-in package to complete the test task. After the test is completed, the execution machine may generate a first alert result and send the first alert result to the server 220. The first alarm result is used for reflecting the loopholes existing in the first application.

Optionally, the executing machine may generate the alert result according to the agreed alert format. The alarm format may be:

s675, the server 220 receives the first alert result sent by the executor.

When the first test case is of the SAST type (which may also be referred to as a second type), the server 220 may perform S676-S677.

At S676, the server 220 obtains the service code according to the first test data.

Specifically, considering that the content of the code is more, the first test data may be a URL address of the service code of the first application. In this way, the server 220 may query the service code of the first application based on the URL address and download it.

Alternatively, the first test data may be a service code of the first application. Still alternatively, the first test data may be a file including a service code of the first application.

S677, the server 220 scans the service codes based on the scanning rules carried by the first test case by using the first plug-in, and obtains a first alarm result.

The scanning rule is constructed according to the testing steps carried by the first test case. In this way, the server 220 scans the service code of the first application according to the test step carried by the first test case, that is, scans the service code of the first application according to the process described in the test step, so as to determine whether a vulnerability exists in the service code of the first application.

It should be noted that, the server 220 may also generate the first alarm result according to the agreed alarm format.

S680, the server 220 generates a security test report based on the first test item, the first test case and the first alarm result.

That is, the server 220 may automatically generate a security test report after the test is completed, without requiring manual processing by the user, thereby saving the user operation and improving the test efficiency.

It should be noted that, if the first test case includes a manual execution case, the tester may perform the test based on the manual execution case and obtain the alarm result. The server 220 may also write the alert results and alert status of the manually executed use case into the security test report.

Optionally, before generating the security test report, the server 220 may further analyze the first test case and the first alarm result to generate a security test conclusion. The safety test conclusion indicates whether the safety test is passed or not, the high and low conditions of the safety risk, and the like. In addition, the server 220 may invoke the docxtpl library to automatically output a security test report.

Optionally, the server 220 may also confirm the alarm state of the first alarm result before generating the security test report. The alarm state is used for indicating whether the loophole indicated in the first alarm result is false alarm or not.

After determining the alarm state of the first alarm result, the server 220 may also generate a security test report based on the first test item, the first test case, the first alarm result, and the alarm state of the first alarm result. In this way, the content of the security test report is more complete and referenced.

As shown in fig. 11, the process of determining the alarm state of the first alarm result for the server 220 may include the following steps S710 and S720.

S710, the server 220 judges whether the history alarm result includes a second alarm result matched with the first alarm result.

If the history alert result includes a second alert result that matches the first alert result, the server 220 executes S720; if the history alarm result does not include the second alarm result matched with the first alarm result, the tester can manually mark the alarm state of the first alarm result after analyzing the first alarm result.

The historical alert results include alert results from all or part of the testing performed by server 220 prior to the current testing. The second alarm result is an alarm result obtained by the server 220 running based on the second test data by using the second plug-in. If the first test case is of the DAST type, when the second alarm result is the same as the first alarm result, the second plug-in is the same as the first plug-in, and the first test data is the same as the second test data, it can be determined that the first alarm result is matched with the second alarm result.

If the first test case is of the SAST type, when the second alarm result is the same as the first alarm result, the second plug-in is the same as the first plug-in, the first test data is the same as the second test data, and the service code indicated by the first test data is the same as the service code indicated by the second test data, the first alarm result and the second alarm result can be determined to be matched.

S720, the server 220 determines the alarm state of the first alarm result according to the alarm state of the second alarm result.

Wherein the alarm state of the first alarm result is consistent with the alarm state of the second alarm result. That is, the first alarm result may inherit the alarm state of the second alarm result.

Therefore, the number of times of manually marking the alarm result by the user can be reduced, and the test efficiency is improved.

Embodiments of the present application also provide a chip system, as shown in fig. 12, that includes at least one processor 1201 and at least one interface circuit 1202. The processor 1201 and the interface circuit 1202 may be interconnected by wires. For example, interface circuit 1202 may be used to receive signals from other devices (e.g., memory of a server). For another example, interface circuit 1202 may be used to send signals to other devices (e.g., processor 1201).

For example, the interface circuit 1202 may read instructions stored in a memory in the electronic device and send the instructions to the processor 1201. The instructions, when executed by the processor 1201, may cause an electronic device (e.g., the server 120 of fig. 2, etc.) to perform the various steps of the embodiments described above.

Of course, the chip system may also include other discrete devices, which are not specifically limited in this embodiment of the present application.

Embodiments of the present application also provide a computer-readable storage medium that includes computer instructions that, when executed on an electronic device (e.g., server 120 in fig. 2, etc.), cause the electronic device to perform the functions or steps performed by the electronic device in the above-described method embodiments.

Embodiments of the present application also provide a computer program product that, when run on an electronic device, causes the electronic device to perform the functions or steps performed by the electronic device in the method embodiments described above.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the modules or units is merely a logical functional division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another apparatus, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and the parts displayed as units may be one physical unit or a plurality of physical units, may be located in one place, or may be distributed in a plurality of different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a readable storage medium. Based on such understanding, the technical solution of the embodiments of the present application may be essentially or a part contributing to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, including several instructions for causing a device (may be a single-chip microcomputer, a chip or the like) or a processor (processor) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read Only Memory (ROM), a random access memory (random access memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely a specific embodiment of the present application, but the scope of the present application is not limited thereto, and any changes or substitutions within the technical scope of the present disclosure should be covered in the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A security test method, the method comprising:

receiving a drawing instruction, and generating a threat modeling analysis chart, wherein the threat modeling analysis chart is used for indicating the security threat risk of the first application and comprises a plurality of primitives;

receiving a selection instruction, and selecting a first test item from a plurality of test items provided by a secure asset library for a plurality of primitives;

inquiring from the secure asset library based on the first test item to obtain a first test case, wherein the first test case comprises a case type, the secure asset library further comprises a plurality of test cases and corresponding relations between the plurality of test cases and the plurality of test items, and the plurality of test cases comprise the first test case;

if the use case type indicates that the first test case is an automatic use case, inquiring from the secure asset library based on the first test case to obtain a first plug-in, wherein the secure asset library further comprises association relations between the plurality of test cases and a plurality of test plug-ins, and the plurality of test plug-ins comprise the first plug-in;

Acquiring first test data;

testing based on the first test data and the first plug-in unit to obtain a first alarm result;

and generating a security test report based on the first test item, the first test case and the first alarm result.

2. The method of claim 1, wherein the acquiring the first test data comprises:

analyzing the configuration file of the first plug-in to obtain task parameters, wherein the task parameters are parameters required by running the first plug-in;

sending the task parameters to a client;

and receiving the first test data sent by the client.

3. The method of claim 2, wherein the first test case is a first type of test case, the first test data includes parameters required for running the first plug-in, and the performing the test based on the first test data and the first plug-in, and obtaining a first alarm result includes:

writing the first test data into a configuration file of the first plug-in;

and operating the first plug-in after the first test data are written to obtain the first alarm result.

4. The method of claim 3, wherein the running the first plug-in written with the first test data to obtain the first alert result comprises:

Generating a plug-in package of the first plug-in based on the configuration file written with the first test data;

sending a plug-in package of the first plug-in to an executive machine;

establishing remote connection with the execution machine and sending an operation instruction to the execution machine;

and receiving the first alarm result sent by the executing machine.

5. The method of claim 2, wherein if the first test case is a second type of test case, the first test data includes a code address of the first application, and the performing the test based on the first test data and the first plug-in unit, obtaining a first alarm result includes:

acquiring a service code of the first application according to the first test data;

and scanning the service codes of the first application by using the first plug-in based on the scanning rule carried by the first test case to obtain the first alarm result.

6. The method according to any one of claims 1-5, further comprising:

determining an alarm state of the first alarm result, wherein the alarm state is used for indicating whether the first alarm result needs to be declared;

generating a security test report based on the first test item, the first test case, and the first alert result includes:

And generating the security test report based on the first test item, the first test case, the first alarm result and the alarm state of the first alarm result.

7. The method of claim 6, wherein the determining the alert status of the first alert result comprises:

judging whether a second alarm result matched with the first alarm result is included in the historical alarm result;

and if the historical alarm result comprises a second alarm result matched with the first alarm result, determining the alarm state of the first alarm result according to the alarm state of the second alarm result, wherein the alarm state of the first alarm result is consistent with the alarm state of the second alarm result.

8. The method of claim 7, wherein the second alert result is an alert result based on second test data run using a second plugin;

and if the first test case is a first type test case, the second alarm result is the same as the first alarm result, the second plug-in is the same as the first plug-in, the first test data is the same as the second test data, and the first alarm result is matched with the second alarm result.

9. The method of claim 7, wherein the second alert result is an alert result obtained by the second plug-in based on second test data;

and if the first test case is a second type test case, the second alarm result is the same as the first alarm result, the second plug-in is the same as the first plug-in, the first test data is the same as the second test data, the service code indicated by the first test data is the same as the service code indicated by the second test data, and the first alarm result is matched with the second alarm result.

10. A security testing method, applied to a testing system, the testing system including a client and a server, the method comprising:

the client displays a first interface, wherein the first interface comprises a plurality of test items provided by a secure asset library, and the secure asset library further comprises a plurality of test cases and corresponding relations between the plurality of test cases and the plurality of test items;

responding to the drawing operation of a user on the first interface, and sending a drawing instruction to the server by the client;

The server receives the drawing instruction and generates a threat modeling analysis chart, wherein the threat modeling analysis chart is used for indicating the security threat risk of the first application and comprises a plurality of primitives;

the server sends the threat modeling analysis graph to the client;

the client receives the threat modeling analysis graph and displays the threat modeling analysis graph on the first interface;

responding to the selection operation of a user, and sending a selection instruction to the server by the client;

the server receives the selection instruction and selects a first test item from the plurality of test items for the plurality of primitives;

the server obtains a first test case from the secure asset library based on the first test item, wherein the first test case comprises a case type, the secure asset library further comprises a plurality of test cases and corresponding relations between the plurality of test cases and the plurality of test items, and the plurality of test cases comprise the first test case;

if the case type indicates that the first test case is an automatic case, the server queries from the secure asset library based on the first test case to obtain a first plug-in, the secure asset library further comprises association relations between the plurality of test cases and a plurality of test plug-ins, and the plurality of test plug-ins comprise the first plug-in;

The server acquires first test data;

the server tests based on the first test data and the first plug-in to obtain a first alarm result;

and the server generates a security test report based on the first test item, the first test case and the first alarm result.

11. The method of claim 10, wherein the server obtaining the first test data comprises:

the server analyzes the configuration file of the first plug-in to obtain task parameters, wherein the task parameters are parameters required by running the first plug-in;

the server sends the task parameters to the client;

the client receives the task parameters and displays a second interface, wherein the second interface comprises an input box for prompting a user to input the task parameters;

responding to input operation of a user in the input box, and sending first test data to the server by the client;

the server receives the first test data.

12. An electronic device comprising a processor coupled to a memory, the memory storing program instructions that, when executed by the processor, cause the electronic device to implement the method of any of claims 1-9 or the method performed by the server of any of claims 10-11.

13. A computer-readable storage medium comprising computer instructions;

when the computer instructions are run on a server, cause the server to perform the method of any one of claims 1-11;

alternatively, the computer instructions, when run on a client, cause the client to perform the method of any of claims 10-11.