Method and device for achieving safety testing on protocol implementation

Abstract

The invention provides a method and a device for achieving safety testing on protocol implementation. The method includes: mopping protocol specifications into a first protocol state model; leading illegal state into the first protocol state model to form a second protocol state model; representing testing aims of the first protocol state model / the second protocol state model through assertions, and representing grammar rules of the messages input legally through grammar constrains; performing behavior mutation operations on the second protocol state model to generate a variant protocol state model and performing model detection, and using the obtained counter example mapping violating the assertions as a testing sequence; performing grammar mutation operations on the testing sequence to generate the testing sequence containing the variant testing messages, and using the testing sequence containing effective variant messages as a testing case; and using the testing case to perform muzzy testing on protocol implementation to detect the security holes in the protocol implementation. By means of an embodiment of the method and device for achieving safety testing on the protocol implementation, safety testing of the protocol can be achieved efficiently with low cost.

Description

technical field [0001] The invention relates to the technical field of information security (Information Security), in particular to a method and device for performing security testing on protocol implementation. Background technique [0002] Computer information security technology is a computer comprehensive application discipline composed of cryptography application technology, information security technology, data disaster and data recovery technology, operating system maintenance technology, etc. Among them, information security technology is mainly used to prevent system vulnerabilities, prevent external hackers from invading, defend against virus damage, and effectively control suspicious access. [0003] With the development of the Internet (Internet), it is urgent to strengthen its information security technology in various computer systems. Take the Information Communication Technology (ICT, Information Communication Technology) system as an example. As a service...

AI Technical Summary

Problems solved by technology

However, the implementation cost of black-box testing is very high, it is also very time-consuming, and it is difficult to optimize and improve

Images