欢迎访问中国科学院大学学报,今天是
简报

一种密码测评工具自动化调度方法及实现

  • 张萌 ,
  • 王平建 ,
  • 陈天宇
展开
  • 中国科学院数据与通信保护研究教育中心, 北京 100093;中国科学院大学网络空间安全学院, 北京 100049;中国科学院信息工程研究所信息安全国家重点实验室, 北京 100093

收稿日期: 2021-10-26

  修回日期: 2022-04-21

  网络出版日期: 2022-04-21

基金资助

国家重点研发计划(2018YFB0804303)资助

An automatic scheduling method and implementation of cryptographic evaluation tools

  • ZHANG Meng ,
  • WANG Pingjian ,
  • CHEN Tianyu
Expand
  • CAS Data Assurance & Communications Security Center, Beijing 100093, China;School of Cyberspace Security, University of Chinese Academy of Sciences, Beijing 100049, China;State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China

Received date: 2021-10-26

  Revised date: 2022-04-21

  Online published: 2022-04-21

摘要

提出一种密码测评工具自动化调度平台方案,该方案能够依据测评工具之间的依赖关系进行自动化装配,调度测评任务有序开展,归集测评中间数据并调度实时数据流转,根据模板输出报告,并支持产品接入、新建系统、系统运行3种测评场景。测评人员只需上传测评对象的应用场景拓扑图,在图中标识检查点选择所要使用的测评工具,然后通过调度平台向测评工具发送调度指令即可完成测评任务。调度平台采用网络接口调度测评工具,具有可扩展性,现有的测评工具只需依据本文提出的测评工具统一接口模型进行适配调整即可集成到调度平台中接受调度。

本文引用格式

张萌 , 王平建 , 陈天宇 . 一种密码测评工具自动化调度方法及实现[J]. 中国科学院大学学报, 2023 , 40(6) : 843 -852 . DOI: 10.7523/j.ucas.2022.043

Abstract

In the process of cryptographic application evaluation, the evaluators complete the on-site evaluation and result analysis with the help of cryptographic evaluation tools. In practical application, the evaluators often need to use multiple evaluation tools in series. The output of one cryptographic evaluation tool needs to be used as the input of another tool to obtain further detection results. For example, when analyzing the SSL protocol, the digital certificate used for authentication should be extracted to complete the certificate format compliance verification. However, the existing evaluation tools are usually designed and developed independently for specific evaluation purposes, and they do not have the ability to work together with each other. The input and output data required by each tool still need evaluators to carry out manual collection, data conversion, import and export, which is time-consuming and labor-consuming, and it is easy to introduce manual errors in the process of processing data. This paper proposes a scheme of automatic scheduling platform for cryptographic evaluation tools. The scheme can automatically assemble according to the dependency between evaluation tools, schedule evaluation tasks in an orderly manner, collect evaluation intermediate data and schedule real-time data flow, output reports according to templates, and support three evaluation scenarios:product access, new system and system operation. Evaluators only need to upload the application scenario topology map of the evaluation object, identify checkpoints in the map, select the evaluation tool to be used, and then send scheduling instructions to the evaluation tool through the scheduling platform to complete the evaluation task. The scheduling platform adopts the network interface scheduling evaluation tool, which has scalability. The existing evaluation tools only need to be adapted and adjusted according to the unified interface model of evaluation tools proposed in this paper, and can be integrated into the scheduling platform to accept scheduling.

参考文献

[1] 霍炜,郭启全,马原.商用密码应用与安全性评估[M].北京:电子工业出版社, 2020.
[2] 邓福彪.数字证书格式合规性检测系统的设计与实现[J].福建电脑, 2020, 36(5):116-117. DOI:10.16707/j.cnki.fjpc.2020.05.041.
[3] 林雪燕,林璟锵,管乐,等.在桌面虚拟化系统中实施国产密码算法[J]. 中国科学院大学学报, 2015, 32(5):701-707. DOI:10.7523/j.issn.2095-6134.2015.05.018.
[4] 田敏求,傅大鹏,马原,等.面向等级保护的信息系统密码应用安全要求与测评实践[EB/OL]. (2018-09-29)[2022-03-25]. https://kns.cnki.net/KCMS/detail/detail.aspx?dbcode=CPFD&filename=HDJS201809001002.
[5] 苏昊欣.密码算法自动化测评系统[D]. 西安:西安电子科技大学, 2010. DOI:10.7666/d.d100194.
[6] 李凤华, 谢绒娜, 苏昊欣, 等. 基于组件的密码算法自动化测评系统[J]. 计算机工程, 2011, 37(11):138-140, 143. DOI:10.3969/j.issn.1000.3842.2011.11.047.
[7] 罗世雄,刘晓强,刘振宇.面向等保2.0标准的测评管理系统设计与实现[J].信息技术与标准化,2019(10):76-78. DOI:CNKI:SUN:DZBZ.0.2019-10-024.
[8] 李宇佳, 李立新, 狄方春, 等. 一种调度自动化主站系统软件测试方法及其平台:CN105677556B[P]. 2019-07-12.
[9] 朱玉倩, 王超, 张艳. 基于单因素方差分析的密码算法统计检验[J]. 电子技术应用, 2021, 47(9):43-45, 50. DOI:10.16157/j.issn.0258-7998.211329.
[10] 刘平.SEO必知小知识静态动态伪静态URL的特点[J].计算机与网络,2017,43(23):44. DOI:10.3969/j.issn.1008-1739.2017.23.052.
文章导航

/