Welcome to Journal of University of Chinese Academy of Sciences,Today is
Brief Reports

An automatic scheduling method and implementation of cryptographic evaluation tools

  • ZHANG Meng ,
  • WANG Pingjian ,
  • CHEN Tianyu
Expand
  • CAS Data Assurance & Communications Security Center, Beijing 100093, China;School of Cyberspace Security, University of Chinese Academy of Sciences, Beijing 100049, China;State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China

Received date: 2021-10-26

  Revised date: 2022-04-21

  Online published: 2022-04-21

Abstract

In the process of cryptographic application evaluation, the evaluators complete the on-site evaluation and result analysis with the help of cryptographic evaluation tools. In practical application, the evaluators often need to use multiple evaluation tools in series. The output of one cryptographic evaluation tool needs to be used as the input of another tool to obtain further detection results. For example, when analyzing the SSL protocol, the digital certificate used for authentication should be extracted to complete the certificate format compliance verification. However, the existing evaluation tools are usually designed and developed independently for specific evaluation purposes, and they do not have the ability to work together with each other. The input and output data required by each tool still need evaluators to carry out manual collection, data conversion, import and export, which is time-consuming and labor-consuming, and it is easy to introduce manual errors in the process of processing data. This paper proposes a scheme of automatic scheduling platform for cryptographic evaluation tools. The scheme can automatically assemble according to the dependency between evaluation tools, schedule evaluation tasks in an orderly manner, collect evaluation intermediate data and schedule real-time data flow, output reports according to templates, and support three evaluation scenarios:product access, new system and system operation. Evaluators only need to upload the application scenario topology map of the evaluation object, identify checkpoints in the map, select the evaluation tool to be used, and then send scheduling instructions to the evaluation tool through the scheduling platform to complete the evaluation task. The scheduling platform adopts the network interface scheduling evaluation tool, which has scalability. The existing evaluation tools only need to be adapted and adjusted according to the unified interface model of evaluation tools proposed in this paper, and can be integrated into the scheduling platform to accept scheduling.

Cite this article

ZHANG Meng , WANG Pingjian , CHEN Tianyu . An automatic scheduling method and implementation of cryptographic evaluation tools[J]. Journal of University of Chinese Academy of Sciences, 2023 , 40(6) : 843 -852 . DOI: 10.7523/j.ucas.2022.043

References

[1] 霍炜,郭启全,马原.商用密码应用与安全性评估[M].北京:电子工业出版社, 2020.
[2] 邓福彪.数字证书格式合规性检测系统的设计与实现[J].福建电脑, 2020, 36(5):116-117. DOI:10.16707/j.cnki.fjpc.2020.05.041.
[3] 林雪燕,林璟锵,管乐,等.在桌面虚拟化系统中实施国产密码算法[J]. 中国科学院大学学报, 2015, 32(5):701-707. DOI:10.7523/j.issn.2095-6134.2015.05.018.
[4] 田敏求,傅大鹏,马原,等.面向等级保护的信息系统密码应用安全要求与测评实践[EB/OL]. (2018-09-29)[2022-03-25]. https://kns.cnki.net/KCMS/detail/detail.aspx?dbcode=CPFD&filename=HDJS201809001002.
[5] 苏昊欣.密码算法自动化测评系统[D]. 西安:西安电子科技大学, 2010. DOI:10.7666/d.d100194.
[6] 李凤华, 谢绒娜, 苏昊欣, 等. 基于组件的密码算法自动化测评系统[J]. 计算机工程, 2011, 37(11):138-140, 143. DOI:10.3969/j.issn.1000.3842.2011.11.047.
[7] 罗世雄,刘晓强,刘振宇.面向等保2.0标准的测评管理系统设计与实现[J].信息技术与标准化,2019(10):76-78. DOI:CNKI:SUN:DZBZ.0.2019-10-024.
[8] 李宇佳, 李立新, 狄方春, 等. 一种调度自动化主站系统软件测试方法及其平台:CN105677556B[P]. 2019-07-12.
[9] 朱玉倩, 王超, 张艳. 基于单因素方差分析的密码算法统计检验[J]. 电子技术应用, 2021, 47(9):43-45, 50. DOI:10.16157/j.issn.0258-7998.211329.
[10] 刘平.SEO必知小知识静态动态伪静态URL的特点[J].计算机与网络,2017,43(23):44. DOI:10.3969/j.issn.1008-1739.2017.23.052.
Outlines

/