CN116260643A - Security testing method, device and equipment for web service of Internet of things - Google Patents

Abstract

The application discloses a security test method, device and equipment for web services of the Internet of things, wherein the method comprises the following steps: the method comprises the steps that safety test equipment obtains first data, wherein the first data are requests or responses of web services of the Internet of things; performing mutation on the first data to obtain first test data; the first test data are sent to the Internet of things equipment; and receiving a first monitoring result sent by the Internet of things equipment, wherein the first monitoring result comprises one or more of a first abnormal condition, first error information and first program coverage rate, and judging whether the web service of the Internet of things has a vulnerability or not according to the first monitoring result. In the process, the security test equipment introduces the fuzzy test technology into the security test of the web service of the Internet of things, generates test data according to the first rule applicable to the web service of the Internet of things, and can perform comprehensive automatic detection on the web service under the condition of unknown web program source codes of the Internet of things, thereby improving the security test efficiency.

Description

A security testing method, device, and equipment for web services of the Internet of Things

technical field

The present application relates to the technical field of network security, and in particular to a security testing method, device and equipment for Internet of Things web services.

Background technique

IoT devices refer to embedded devices connected to the network, which are widely used in many fields such as transportation, industry, and home life. Among them, the web services provided by IoT devices are high-incidence areas for vulnerabilities. Attackers can attack IoT devices based on web service vulnerabilities. Internet-connected devices, therefore, IoT web services security issues are becoming increasingly prominent.

Currently, the security testing method used for general web services simulates the behavior of attacking the system through script files, records and analyzes the response results, and determines web service vulnerabilities. IoT devices have particularities. For example, the development of web services for IoT devices based on C/C++ language is different from existing web services based on scripting languages such as JAVA, PHP, and python, and the functions of IoT web interface are also different from existing interface and so on. Therefore, when the above-mentioned traditional web security testing methods are applied to IoT devices, there are problems such as being unable to perform security testing on all functions of the IoT web services, resulting in low security testing efficiency and poor effect.

Contents of the invention

The embodiment of the present application provides a security testing method, device, and equipment for Internet of Things web services. By introducing fuzzy testing into security testing for Internet of Things web services, test data is generated according to rules applicable to Internet of Things web services, and according to monitoring results To determine potential vulnerabilities, a comprehensive automated test can be performed on the Internet of Things web service without knowing the source code of the Internet of Things web program, which improves the efficiency and effect of security testing.

In a first aspect, the present application provides a security testing method for an Internet of Things web service, and the method is applied to a security testing device. The method includes: the security testing equipment acquires first data, wherein the first data is a request or response of an Internet of Things web service acquired by the security testing equipment; the first data is mutated to obtain the first test data; the first test data is Sending to the IoT device, wherein the IoT device is used to provide the IoT web service; receiving the first monitoring result sent by the IoT device, the first monitoring result includes the first abnormal situation, the first error message or the first program coverage One or more of them, and judge whether there is a loophole in the Internet of Things web service according to the first monitoring result.

In the above process, the safety testing equipment introduces the fuzzing technology into the safety detection method of the web service of the Internet of Things. The security testing device mutates on the basis of the first data according to the first rule applicable to the web service of the Internet of Things, sends the first test data to the Internet of Things device, and receives the first monitoring data generated by the Internet of Things device according to the first test data. As a result, vulnerabilities exist in IoT web services are identified. By generating multiple unexpected test data, the security test equipment can increase program coverage to a greater extent, conduct a comprehensive test on the Internet of Things web service, and reduce the application of the existing security test technology that is not suitable for the Internet of Things web service Scenarios and situations where unique problems cannot be detected, thereby improving the effectiveness of security testing. The security testing equipment determines the possible loopholes in the IoT web service through abnormal conditions and error messages in the monitoring results. Compared with the existing technology, it does not need to analyze the loopholes based on the response results, the process is simpler, and the efficiency of security testing can be improved.

In a possible implementation manner, after acquiring the first data, the security testing device further identifies a first parameter in the first data, where the first parameter affects the operation of the IoT device. By identifying the first parameter, the security testing equipment can determine the data that is mutated in the subsequent first data mutation process, and the first rule used by the mutation, so as to affect the operation of the Internet of Things web service as much as possible, and can improve the efficiency of security testing. Maximize the program coverage of IoT web services.

In a possible implementation manner, the safety testing device mutates the first data according to a first rule to obtain the first test data, wherein the first rule is determined by the safety testing device according to the first parameter. The security testing device determines the first rule according to the first parameter, which can ensure that the first rule is applicable to the security test of the Internet of Things web service, thereby ensuring that the first test data obtained according to the variation of the first rule can comprehensively test the functions of the Internet of Things web service detection to improve the effectiveness of security testing.

In a possible implementation manner, after sending the first test data to the IoT device, the security testing device also receives the first response sent by the IoT device in addition to receiving the first monitoring result.

In a possible implementation manner, the security testing device sends the first response to the IoT device when the program coverage rate in the first monitoring result is increased. The increase in program coverage in the first monitoring result indicates that the first test data corresponding to the first monitoring result has covered an unknown part of the web program of the IoT device. The security test equipment sends the first response to the IoT device, which can increase the types of test data, increase program coverage to a greater extent, detect unknown vulnerabilities in IoT web services, and improve security testing efficiency.

In a possible implementation manner, when all the mutations of the first test data have not been completed, the safety test device mutates the first test data to obtain the second test data; and sends the second test data to the IoT device. The security testing equipment continues to mutate on the basis of the first test data, and the obtained second test data can detect different web service vulnerabilities, improve program coverage, and obtain better security test results.

In a second aspect, the present application provides a security testing device, which is applied to security testing equipment, and the security testing device includes an acquisition module, a variation module, a sending module, and a receiving module. Wherein, the obtaining module is used to obtain the first data, wherein the first data is the request or response of the Internet of Things web service obtained by the obtaining module; the mutation module is used to mutate the first data to obtain the first test data; send The module is used to send the first test data to the IoT device, wherein the IoT device is used to provide the IoT web service; the receiving module is used to receive the first monitoring result sent by the IoT device, the first monitoring result includes the first One or more of an abnormal situation, the first error message or the first program coverage, and judge whether there is a loophole in the Internet of Things web service according to the first monitoring result.

In a third aspect, the present application provides a cluster of computing devices, the cluster of computing devices includes at least one computing device, each computing device includes a processor and a memory; the processor of the at least one computing device is used to perform storage in the memory of the at least one computing device instructions, so that the computing device cluster executes the method provided in the first aspect.

In a fourth aspect, the present application provides a computer program product containing instructions, and when the instructions are executed by the computing device cluster, the computing device cluster executes the method of the first aspect.

In a fifth aspect, the present application provides a computer-readable storage medium, the computer-readable storage medium includes computer program instructions, and when the computer program instructions are executed by a cluster of computing devices, the cluster of computing devices executes the method provided in the first aspect.

On the basis of the implementation manners provided in the foregoing aspects, the present application may further be combined to provide more implementation manners.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the drawings that need to be used in the description of the embodiments.

Fig. 1 is a flow chart of a web service security testing method provided by the embodiment of the present application;

Fig. 2 is a schematic structural diagram of an Internet of Things web service security testing system provided by an embodiment of the present application;

Fig. 3 is the flow chart of a kind of Internet of Things web service security testing method provided by the embodiment of the present application;

Fig. 4 is a flow chart of a partial fuzz testing method provided by the embodiment of the present application;

Fig. 5 is a schematic structural diagram of a safety testing device provided in an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a computing device provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a computing device cluster provided by an embodiment of the present application;

Fig. 8 is a schematic structural diagram of one or more computing devices connected through a network according to an embodiment of the present application.

Detailed ways

As shown in Figure 1, Figure 1 is a flow chart of a web service security testing method provided by the embodiment of the present application, which is applied to the scanner in the system composed of the scanner 110 and the service device 120, wherein the scanner It is connected with the service device through the network, the service device is used for providing web services, and includes a monitoring module 121 for monitoring web service data. This method conducts security testing for web services built by common web frameworks (such as Spring, React, PHP, etc.) in the field of information and communications technology (ICT), where web services are implemented by JAVA, (hypertext preprocessor , PHP) etc. are developed as scripting languages. The method includes the following steps.

The scanner captures all initial business requests for web services. Afterwards, the scanner obtains the target features of the web service. The target features include writing language, web service framework, front-end and back-end status, middleware status, component version, interface parameters, etc., which are obtained by the scanner based on known web program source code. The scanner generates a preset rule base according to the target characteristics of the web service, wherein the preset rule base includes a variety of rules, and the scanner processes the initial business request according to a variety of rules, generates a new request, and uses it as a web service Serves test requests for security tests. Afterwards, the scanner sends the generated test request to the service device, and the service device runs the web application according to the test request, and the monitoring module starts to monitor the data related to the web service, generates monitoring data and sends it to the scanner, wherein the monitoring data can be web The response information of the service, or the business status of the web service, etc. The scanner judges whether the monitoring data matches the abnormal feature database. If the monitoring data matches the abnormal situation in the abnormal characteristic database, the scanner records the abnormal situation. The abnormal characteristics in the abnormal characteristic database are determined according to the source code of the web program of. The scanner determines whether there is a test request that has not been sent to the service device after recording the abnormal situation, or when there is no match between the monitoring data and the abnormal situation in the abnormal signature database. If there are test requests not sent to the service device, the scanner repeats the above steps until all test requests in the scanner are sent to the service device for security testing, and the test ends.

In the above process, the more comprehensive the rules in the preset rule base, or the richer the initial business requests, the greater the scope of web services that the test requests generated by the scanner based on the rules and initial business requests can cover, and the better the security testing effect. The higher the efficiency.

At present, IoT devices are widely used in many fields such as smart life, transportation, and industry. The web services of IoT devices are a high-risk area for vulnerabilities. In the case where the web service security testing method shown in Figure 1 is applied to the Internet of Things web service, since the web service of the Internet of Things device is developed using C/C++ language, which is different from the current web service developed by scripting languages such as JAVA and PHP, The above-mentioned security testing method cannot detect coding problems (for example, buffer overflow, integer overflow, etc.) of C/C++ language. In addition, the function of the web interface of the Internet of Things device is also different from the existing web service interface. The above-mentioned web service security testing method cannot perform security testing on all functions of the Internet of Things web service, resulting in the efficiency of security testing for the Internet of Things web service. Low, poor effect.

Therefore, the present application provides a security testing method for the Internet of Things web service, which identifies the application scenarios of the Internet of Things device and the type of key parameters through the security testing equipment, determines the mutation rule used when generating the Internet of Things web service test request, and according to the Monitor information obtained by networked devices, identify program vulnerabilities, and more. The above method introduces the fuzzy testing technology into the security test of the Internet of Things web service, and can automatically perform a comprehensive test on the Internet of Things web service without knowing the source code of the Internet of Things web service program, so as to improve the efficiency of security testing. Appropriate mutation rules It can improve program coverage and detect more unknown program vulnerabilities. The security testing method of the Internet of Things web service is applied to the security testing equipment in the system shown in FIG. 2 .

As shown in FIG. 2 , FIG. 2 is a schematic structural diagram of an Internet of Things web service security testing system provided by an embodiment of the present application. The system includes a safety testing device 210 and an Internet of Things device 220 , and the Internet of Things device and the safety testing device are connected through a network 230 .

In specific implementation, IoT devices can be routers, surveillance cameras, smart homes, smart speakers, and other non-standard computing devices that are connected to the network through wired or wireless means, have the ability to transmit data, can communicate and interact, and can also be used Remote monitoring and control. Different IoT devices provide different external web services in different application scenarios. For example, routers provide functions such as network configuration and management, while smart speakers provide relatively simple services.

In a possible implementation manner, the IoT device may be replaced with any device or chip that provides an external interface or provides a remote access function, which is not specifically limited in this application.

In a specific implementation, the security testing device can be a mobile phone, a tablet computer, a desktop computer, etc. installed with the security testing software of the Internet of Things web service, or a bare metal server (baremetal server, BMS) including the Internet of Things web service security testing application, Containers, virtual machines (virtual machine, VM), etc., which are not specifically limited in this application.

As shown in FIG. 3 , FIG. 3 is a flow chart of a security testing method for an Internet of Things web service provided by an embodiment of the present application. The method is applied to the security testing equipment in the Internet of Things web service security testing system shown in FIG. 2, and the Internet of Things web service security testing method includes the following steps.

Step S310: the security testing device acquires first data, wherein the first data is a request or a response of the Internet of Things web service acquired by the security testing device.

The security testing equipment crawls the request or response of the web service of the Internet of Things through a crawler program.

In a possible implementation, since the web service of the IoT device is relatively simple and has typical characteristics, for example, the homepage of the website requires an administrator password to log in, etc., the security testing device determines the crawler program according to the application scenario of the IoT device . The crawler program customized according to the application scenario of the IoT device can obtain the service interface of the IoT device more accurately and efficiently, thereby improving the efficiency of the first data acquisition. The safety testing equipment may also acquire the first data in other ways, which is not specifically limited in this application.

Step S320: the safety testing device mutates the first data to obtain the first test data, and sends the first test data to the IoT device.

After acquiring the first data, the security testing device identifies a first parameter included in the first data, wherein the first parameter affects the operation of the IoT device. The security testing device determines the first rule applicable to the security test of the IoT web service according to the first parameter, and mutates the first data according to the first rule to obtain the first test data, and sends the first test data to the IoT device.

In a possible implementation, the first parameter may be the request header part, hardware interface related parameters, numbers, character strings, IP addresses and other content that can be parsed and understood, parameters related to the interface function of the product, etc. This application does not make specific limitations. By identifying the first parameter, the security testing device can determine the mutated data in the subsequent first data mutation process, thereby affecting the operation of the Internet of Things web service, improving the program coverage of the Internet of Things web service to a greater extent, and triggering the Internet of Things web service. Service vulnerabilities, improve security testing efficiency.

In a possible implementation manner, after identifying the first parameter and the type of the first parameter in the first data, the safety testing device determines an appropriate first rule according to the first parameter and the type of the first parameter. The determination of the first rule may also be related to more or less content such as the application scenario of the IoT device, which is not specifically limited in this application. The safety testing equipment uses the first rule for the variation of the first data, which can realize a comprehensive test of the web service function of the Internet of Things and improve the safety detection efficiency.

In a possible implementation manner, the first rule includes a mutation rule based on coverage of a regular program, and a mutation rule based on a web service characteristic of an Internet of Things device. Among them, the mutation rules based on routine program coverage include: copying input multiple times, adding or subtracting digital data, or replacing original input according to the input type, etc., which are not specifically limited in this application. The mutation rules based on the web service characteristics of IoT devices include: triggering buffer overflow and command injection vulnerabilities, triggering integer overflow and integer flipping vulnerabilities; triggering serialization and deserialization vulnerabilities, etc. The first rule can also include more or less The content of this application is not specifically limited.

In a specific implementation, when the first data includes "Host: 192.168.128.30", the safety testing device identifies the first data, determines that the Host corresponds to an IP address, and determines the type of the first parameter . The safety testing equipment determines the first rule used according to the first parameter and the type of the first parameter, mutates the first data, and replaces the IP address "192.168.128.30" in the first data with "0.0.0.0", "11111.0 .0.0” or “3.300” to generate a series of first test data and send the first test data to the IoT device. In the above process, the safety test equipment identifies the first parameter and the type of the first parameter for the first data, thereby determining the appropriate first rule, which can greatly speed up the efficiency of generating the first test data and improve the trigger rate of the first test data. The probability of potential problems in networked web services enables comprehensive functional testing of IoT web services and improves the efficiency of security testing.

The above method for generating the first test data can solve the problem that the first data is limited and fixed due to the simple logic of the web service interface of the Internet of Things device and limited device functions. The security test device performs mutation processing on the first data according to the first rule , generating a plurality of different first test data can improve the program coverage rate of the web service of the Internet of Things, or increase the change of the response of the Internet of Things device, and improve the effect of the security test.

Step S330: The IoT device generates a first monitoring result and a first response according to the first test data, and sends the first monitoring result and the first response to the safety testing device.

After receiving the first test data, the IoT device runs the web service program and executes the monitoring function, generates the first monitoring result and the first response, and sends the first monitoring result and the first response to the safety testing device. Wherein, the first monitoring result is used to display the loopholes of the Internet of Things web service, including one or more of the first abnormal situation, the first error message or the first program coverage, and the difference between the first monitoring result and the first test data There is a one-to-one correspondence, and there is a one-to-one correspondence between the first response and the first test data.

In a possible implementation, the first abnormal situation in the first monitoring result refers to the situation that the function of the test target has an unexpected result, but the main function can still run normally; the first error message refers to the situation that the test target crashes , exit, restart, and other information that cannot run normally; the first program coverage rate refers to the proportion of functions that have been executed in the test object, and this application does not specifically limit the information included in the first monitoring result. The first monitoring results obtained by the above security testing equipment including the first abnormal situation, the first error information or the first program coverage rate can be used to evaluate the security test effect corresponding to the first test data, for example, the first program coverage The increase in the rate indicates that the security test is more sufficient, and the obtained response results can be used as new test data when the program coverage rate increases, enriching the type of test data, and improving the efficiency of security testing. The first monitoring results may include more or more Less content, this application is not specifically limited.

In a possible implementation, the Internet of Things device performs the monitoring function after the web service program is running, and can monitor the data related to the web service through firmware simulation, monitoring agent injection, debugging mode, etc., and obtain the corresponding data of the first test data. The first program coverage, the first exception and the first error message etc. Among them, the firmware simulation method simulates hardware behavior by writing software, so that the firmware package of the IoT device can run in a simulated environment other than the real device, and can also run and monitor the test target in a virtual environment. Monitoring agent injection writes a series of specific programs, implants the programs into the tested IoT devices, monitors and feeds back the monitoring results. The debugging mode is to turn on the debugging switch in some IoT devices to enter the debugging mode. In the debugging mode, the IoT devices can directly obtain relevant monitoring results. This application specifically implements the monitoring function of the IoT devices during the security test The method is not specifically limited.

In a possible implementation manner, in addition to monitoring program coverage, abnormal conditions, and error messages, the IoT device also judges whether there is an obvious change in the generated first response.

In the above process, after receiving the first test data, the IoT device obtains program coverage, abnormal conditions, error information and other data through firmware simulation, monitoring agent injection, debugging mode and other methods, which is helpful for the security test equipment to judge the test data The detected potential problems in the web service of the Internet of Things can improve the efficiency of security testing compared with the prior art that analyzes possible vulnerabilities according to the responses.

Step S340: The security testing device receives the first monitoring result and the first response, and judges whether there is a vulnerability in the Internet of Things web service according to the first monitoring result.

The safety testing device judges whether there is a first abnormality and the first error message in the received first monitoring result, and judges whether there is a loophole in the IoT web service according to the first abnormality and the first error message.

In a possible implementation, in the case of the first abnormal situation and the first error information, the security testing device records the first abnormal situation and the first error information, and determines the Internet of Things web service detected by the first test data Compared with the method of analyzing whether there is a loophole in the web service according to the first response in the prior art, it is more convenient and accurate, and can improve the effect of the security test.

In another possible implementation manner, in the absence of the first abnormal situation and the first error message, the security testing device determines that the first test data does not detect a loophole in the Internet of Things web service, and then the security testing device Determine whether there is test data not sent to the IoT device in the test data queue. If there is unsent test data, the safety test device repeats step S340. If there is no unsent test data, the safety test device ends This round of security testing.

In addition to judging whether there is a loophole in the Internet of Things web service according to the first monitoring result, the security testing device also judges whether new test data can be obtained according to the first monitoring result and the first test data.

In a possible implementation manner, when the coverage of the first program in the first monitoring result increases, the security testing device sends the first response to the test data queue, and sends it to the IoT device as test data. Security test equipment uses the first response as test data, which can enrich the types of test data sent to IoT devices, improve program coverage to a greater extent, and improve security test efficiency.

In a possible implementation manner, after the safety testing device receives the first monitoring result and the first response, if the first test data has not completed all mutations, the safety testing device performs Mutation to obtain the second test data. The security test equipment generates the second test data, which can increase program coverage to a greater extent, and improve the efficiency and effect of security testing.

In a possible implementation manner, after obtaining the first monitoring result and the first response, the security testing equipment needs to judge the first program coverage in the first monitoring result and whether all mutations of the first test data have been completed, according to Judgment results get new test data.

As shown in FIG. 4, FIG. 4 is a flow chart of a partial fuzzing testing method provided by the embodiment of the present application, and the security testing equipment performs the following steps.

Step S410: the safety testing device judges whether the coverage of the first program in the first monitoring result is improved.

In the case that the coverage rate of the first program in the first monitoring result is increased, the security testing device executes step S420; in the case that the coverage rate of the first program in the first monitoring result does not increase, executes step S430.

Step S420: the security testing device sends the first response to the test data queue.

In the case that the coverage of the first program in the first monitoring result is increased, the security testing device determines that the first test data corresponding to the first monitoring result has covered the unknown part of the web program of the Internet of Things device, and therefore, the first test The first response corresponding to the data is sent to the test data queue to be sent to the IoT device for subsequent security testing, which can increase the types of test data sent to the IoT device, improve program coverage to a greater extent, and improve security Test efficiency.

Step S430: The safety testing device judges whether all mutations of the first test data are completed.

When the program coverage rate in the monitoring result is not improved, or after the security testing device sends the first response corresponding to the first test data to the test data queue, the security testing device determines whether all mutations of the first test data are completed.

In the case that all the mutations of the first test data have not been completed, the safety test equipment executes step S440.

In the case that all the mutations of the first test data are completed, the security testing equipment executes step S450.

Step S440: the safety testing device mutates the first test data to obtain second test data.

In a possible implementation manner, the security testing equipment uses the first rule to mutate the first test data to obtain the second testing data, and sends the second testing data to the test data queue, the specific process of which is the same as that of the security testing equipment according to The process of mutating the first data and obtaining the first test data is the same. The security test equipment obtains the second test data according to the first test data. By generating the test data, the coverage rate of the program can be improved, unknown loopholes in the Internet of Things web service can be triggered, better security test results can be obtained, and the efficiency of the security test can be improved.

Step S450: the safety testing device judges whether the test data queue is empty.

In a possible implementation manner, when the test data queue is not empty, the security test device continues to send the first test data, the first response or the second test data included in the test data queue to the Internet of Things device, and the receiving object For the monitoring result and response sent by the networked device, step S340 and the steps in FIG. 4 are executed until the security test device sends all the test data in the test data queue to the IoT device. The above process can enable the security testing equipment to send test data to the IoT device as much as possible, and conduct a comprehensive test on the function of the IoT web service, so as to improve the effect of the security testing.

In another possible implementation manner, in the case that the test data queue is empty, the security testing device executes step S460.

Step S460: the security testing device ends the current round of security testing.

In a possible implementation manner, when the current round of security testing ends, the security testing device generates the first round of monitoring results corresponding to the plurality of first test data and the plurality of second test data obtained in the current round of security testing. Two rules. During a new round of Internet of Things web service security testing process, the security testing equipment mutates the newly acquired first data according to the second rule to obtain new first test data, which is not specifically limited in this application.

In a possible implementation, the security testing method of the Internet of Things web service provided by this application can be applied to more different application scenarios besides being applied to the Internet of Things devices, for example, various methods of sending and receiving wireless data Chips, or various devices controlled by infrared, etc., are not specifically limited in this application. That is to say, the security testing method provided in this application is applicable to any device or chip that provides an external interface or provides any remote access function. In the case that there are access thresholds and protocol analysis for the equipment that needs to be tested, the security testing method provided by this application can be accessed and performed security testing after professionals handle it.

In a specific implementation manner, the first data example is as follows:

POST /check.cgi? data=check_aio HTTP/1.1

Host: 192.168.128.30

Connection: keep-alive

Content-Length: 209

submit_flag=ntp_debug&conflict_wanlan=&ntpserver1=time.test1.com

&ntpserver2=a.test.com&ntpadjust=0&hidden_ntpserver=GMT8&h

The safety testing device identifies the first parameter included in the first data and the type of the first parameter when the first data is acquired. For example, the security test equipment recognizes that "check_aio" corresponding to data is a character string; "192.168.128.30" corresponding to Host is an IP address, which is a dotted structure of numbers; "209" corresponding to Content-Length is an integer; ntpserver2 corresponds to The "a.test.com" is the same as the IP address, which is composed of dotted structure.

The security testing device selects the first rule for constructing and triggering buffer overflow and command injection vulnerabilities according to the character string "check_aio", mutates the first data according to the first rule, and mutates "check_aio" into 1000 a The character string "a"*1000, or replaced by more character strings of different lengths, to obtain a plurality of first test data, and send the first test data to the IoT device. Afterwards, the security testing device obtains the first monitoring result and the first response corresponding to the first test data, records the abnormal situation and error information generated by the Internet of Things web service, and records all mutations of the first test data if the first test data has not completed all mutations. Further mutations are performed on the first test data. According to the integer "209" in the first test data, the security testing equipment selects the first rule to construct and trigger integer overflow, and mutates "209" into data such as "0", "-1", "100000000", and obtains multiple second test data, and send the second test data to the IoT device. The security testing equipment repeats the above process until there is no test data in the test data queue, and the current round of security testing ends, and the loopholes in the IoT web service can be determined according to the recorded abnormalities and error messages.

At present, there is no security testing method for the web service of the Internet of Things, but the existing security testing method of the web service in the field of information and communication technology is applied to the security testing of the web service of the Internet of Things. In the security testing method provided in this application, the security testing equipment mutates the first data to obtain the first test data, and on the basis of the first test data, mutates the first test data to obtain the second test data, and the second The first test data and the second test data are sent to the IoT device. Among them, the first rule is determined according to the first data, and is applicable to the mutation rule of the Internet of Things web service security test, and the first test data and the second test data generated according to the first rule can more comprehensively detect the Internet of Things web service Functions, improve program coverage, detect potential loopholes in IoT web services to a greater extent, improve security testing results, and improve security testing efficiency. The security testing equipment can determine the potential loopholes of the IoT web service according to the monitoring results sent by the IoT device based on the first test data or the second test data, which is more convenient and improves the efficiency of security testing.

To sum up, in the embodiment of this application, the security testing equipment automatically generates a series of unconventional test data according to special mutation rules by introducing fuzzy testing technology into the security testing of Internet of Things web services, and sends them to the tested Device, according to the monitoring results generated by the device under test, the inspection of abnormal conditions, error messages and program coverage of the program under test can be realized. In the case of unknown source code of the web service program, potential loopholes can be determined according to the monitoring results to improve the security test effect .

As shown in FIG. 5 , FIG. 5 is a schematic structural diagram of a security testing device provided in an embodiment of the present application. The security testing device is applied to the security testing equipment in a security testing system for Internet of Things web services shown in FIG. 2 , It is applied to a security testing method of an Internet of Things web service as shown in FIG. 3 . The security testing device 500 includes: an acquisition module 510 , a mutation module 520 , a sending module 530 and a receiving module 540 . Wherein, the obtaining module is used to obtain the first data, wherein the first data is the request or response of the Internet of Things web service obtained by the obtaining module; the mutation module is used to mutate the first data to obtain the first test data; send The module is used to send the first test data to the IoT device, wherein the IoT device is used to provide the IoT web service; the receiving module is used to receive the first monitoring result sent by the IoT device, the first monitoring result includes the first One or more of an abnormal situation, the first error message or the first program coverage, and judge whether there is a loophole in the Internet of Things web service according to the first monitoring result.

The above acquisition module, mutation module, sending module and receiving module can all be realized by software, or can be realized by hardware. Exemplarily, the mutation module is used as an example to introduce the implementation of the mutation module. Similarly, the implementation of the acquisition module, sending module and receiving module can refer to the implementation of the mutation module.

A module is an example of a software functional unit, and a variant module may include codes that run on computing instances. Wherein, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above computing instances may be one or more. For example, a mutation module can include code that runs on multiple hosts/VMs/containers. It should be noted that multiple hosts/virtual machines/containers used to run the code can be distributed in the same region (region), or in different regions. Furthermore, multiple hosts/virtual machines/containers used to run the code can be distributed in the same availability zone (availability zone, AZ), or in different AZs, and each AZ includes one data center or multiple geographically close data centers. Among them, usually a region can include multiple AZs.

Likewise, multiple hosts/virtual machines/containers for running the code can be distributed in the same virtual private cloud (virtual private cloud, VPC), or in multiple VPCs. Among them, usually a VPC is set in a region, and cross-region communication between two VPCs in the same region and between VPCs in different regions needs to set up a communication gateway in each VPC, and realize the interconnection between VPCs through the communication gateway. .

A module is an example of a hardware functional unit, and a variant module may include at least one computing device, such as a server. Alternatively, the variation module may also be a device implemented by an application-specific integrated circuit (application-specific integrated circuit, ASIC) or a programmable logic device (programmable logic device, PLD). Wherein, the above-mentioned PLD may be realized by complex programmable logic device (complex programmable logical device, CPLD), field-programmable gate array (field-programmable gate array, FPGA), general array logic (generic array logic, GAL) or any combination thereof.

Multiple computing devices included in the mutation module may be distributed in the same region or in different regions. Multiple computing devices included in the mutation module may be distributed in the same AZ or in different AZs. Multiple computing devices included in the mutation module can be distributed in the same VPC, or can be distributed in multiple VPCs. The aforementioned multiple computing devices may be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

Wherein, the obtaining module executes step S310 in FIG. 3 , the mutation module executes step S320 in FIG. 3 , the sending module executes step S320 in FIG. 3 , and the receiving module executes step S340 in FIG. 3 . It should be noted that, in other embodiments, the acquiring module, the mutation module, the sending module and the receiving module can each be used to execute any step in the federated learning running method shown in FIG. 2, the acquiring module, the mutation module, the sending module and The steps that the receiving module is responsible for implementing can be specified as required, and the different steps in the Internet of Things web service security testing method shown in Figure 3 are respectively implemented by the acquiring module, the mutation module, the sending module and the receiving module to realize all functions of the security testing device.

As shown in FIG. 6, FIG. 6 is a schematic structural diagram of a computing device provided by an embodiment of the present invention. The computing device 600 may be the security testing device in FIG. 2, and is applied to an Internet of Things web service shown in FIG. in the security testing method. The computing device 600 includes: a processor 610 , a memory 620 , a communication interface 630 and a bus 640 . Wherein, the processor, the memory, and the communication interface can communicate through the bus. Computing device 600 may be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 600 .

The processor 610 may be composed of at least one general-purpose processor, such as a central processing unit (central processing unit, CPU), or a combination of a CPU and a hardware chip. The aforementioned hardware chip may be an application-specific integrated circuit (application-specific integrated circuit, ASIC), a programmable logic device (programmable logic device, PLD), or a combination thereof. The aforementioned PLD may be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof. The processor 610 is used to execute various types of digital storage instructions, and perform respective steps to realize corresponding functions.

The memory 620 may be a volatile memory (volatile memory), such as random access memory (random access memory, RAM), dynamic random access memory (dynamic RAM, DRAM), static random access memory (static RAM, SRAM), synchronous dynamic random access memory (synchronous dynamic RAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate RAM, DDR), high-speed cache (cache), etc., and the memory may also include a combination of the above types. The memory 620 includes executable program code, and the processor 610 can realize the functions of the acquisition module 510, the mutation module 520 and the sending module 530 by executing the program code, thereby realizing the security testing method of the Internet of Things web service in FIG. 3 . That is, the memory 620 stores instructions for executing the security testing method for the Internet of Things web service in FIG. 3 .

The communication interface 630 uses transceiver modules such as but not limited to network interface cards and transceivers to realize communication between the computing device 600 and other devices or communication networks, and can be used to receive response results and monitoring results sent by IoT devices. etc., which are not specifically limited in this application.

The bus 640 may be a peripheral component interconnect standard (peripheral component interconnect, PCI) bus, an extended industry standard architecture (extended industry standard architecture, EISA) bus, or the like. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one line is used in FIG. 6 , but it does not mean that there is only one bus or one type of bus. Bus 640 may include pathways for communicating information between various components of computing device 600 (eg, processor 610, memory 620, communication interface 630).

It should be noted that FIG. 6 is only a possible implementation manner of the embodiment of the present application. In practical applications, the network device may include more or fewer components, which is not limited here.

The embodiment of the present application also provides a computing device cluster. The cluster of computing devices includes at least one computing device. The computing device may be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device may also be a terminal device such as a desktop computer, a notebook computer, or a smart phone.

As shown in FIG. 7 , FIG. 7 is a schematic structural diagram of a computing device cluster provided by an embodiment of the present application, and the computing device cluster includes at least one computing device 600 . The memory 620 of one or more computing devices 600 in the computing device cluster may store the same instructions for executing a security testing method for an Internet of Things web service provided by the embodiment of the present application.

In some possible implementation manners, the memories 620 of one or more computing devices 600 in the computing device cluster may respectively store some instructions for executing the above-mentioned Internet of Things web service security testing method. In other words, a combination of one or more computing devices 600 can collectively execute instructions for executing the method for security testing of Internet of Things web services.

It should be noted that the memory 620 in different computing devices 600 in the computing device cluster can store different instructions, and the instructions stored in the memories 620 in different computing devices 600 can implement the acquiring module, mutation module, sending module and receiving module Functions of one or more modules in .

In some possible implementations, one or more computing devices in a cluster of computing devices may be connected through a network. Wherein, the network may be a wide area network or a local area network or the like. As shown in FIG. 8 , FIG. 8 is a schematic structural diagram of one or more computing devices connected through a network according to an embodiment of the present application. The two computing devices 600A and 600B are connected through a network. The computing device 600A includes a processor 610A, a memory 620A, a communication interface 630A, and a bus 640A. The computing device 600B includes a processor 610B, a memory 620B, a communication interface 630B, and a bus 640B. Specifically, it is connected to the network through a communication interface in each computing device. In this type of possible implementation, the memory 620A in the computing device 600A stores instructions to perform the functions of the acquisition module. Meanwhile, the memory 620B in the computing device 600B stores instructions for executing the functions of the mutation module and the sending module. It should be understood that the functions of the computing device 600A shown in FIG. 8 may also be performed by multiple computing devices 600 . Likewise, the functions of computing device 600B may also be performed by multiple computing devices 600 .

The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product containing instructions, executable on a computing device or stored on any available medium. When the computer program product runs on at least one computing device, at least one computing device is made to execute the Internet of Things web service security testing method shown in FIG. 3 .

The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium may be any available medium that a computing device can store, or a data storage device such as a data center that includes one or more available media. The available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, solid state hard disk), etc. The computer-readable storage medium includes instructions, and the instructions instruct a computing device to execute a security testing method for Internet of Things web services shown in FIG. 3 .

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. A security testing method for web services of the internet of things, which is applied to security testing equipment, the method comprising:

acquiring first data, wherein the first data is a request or a response of the Internet of things web service acquired by the security test equipment;

performing mutation on the first data to obtain first test data;

the first test data are sent to Internet of things equipment, wherein the Internet of things equipment is used for providing the Internet of things web service;

and receiving a first monitoring result sent by the Internet of things equipment, wherein the first monitoring result comprises one or more of a first abnormal condition, first error information and first program coverage rate, and judging whether the Internet of things web service has a vulnerability or not according to the first monitoring result.

2. The method of claim 1, wherein after the acquiring the first data, the method further comprises:

and identifying a first parameter in the first data, wherein the first parameter affects the operation of the Internet of things device.

3. The method of claim 2, wherein mutating the first data to obtain first test data comprises:

And mutating the first data according to a first rule to obtain first test data, wherein the first rule is determined by the safety test equipment according to the first parameter.

4. A method according to any one of claims 1 to 3, wherein after transmitting the first test data to an internet of things device, the method further comprises:

and receiving a first response sent by the Internet of things equipment.

5. The method of claim 4, wherein after the receiving the first monitoring result sent by the internet of things device, the method further comprises:

and under the condition that the coverage rate of the first program is improved, sending the first response to the Internet of things equipment.

6. The method of claim 5, wherein the method further comprises:

under the condition that all variations of the first test data are not completed, the first test data are subjected to variation to obtain second test data;

and sending the second test data to the Internet of things equipment.

7. The safety testing device is applied to safety testing equipment and is characterized by comprising an acquisition module, a mutation module, a sending module and a receiving module:

The acquisition module is used for acquiring first data, wherein the first data is a request or a response of the Internet of things web service acquired by the acquisition module;

the mutation module is used for mutating the first data to obtain first test data;

the sending module is configured to send the first test data to the internet of things device, where the internet of things device is configured to provide the internet of things web service;

the receiving module is configured to receive a first monitoring result sent by the internet of things device, where the first monitoring result includes one or more of a first abnormal condition, a first error message, and a first program coverage rate, and determine whether a vulnerability exists in the internet of things web service according to the first monitoring result.

8. A cluster of computing devices, comprising at least one computing device, each computing device comprising a processor and a memory;

the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method of claim 1.

9. A computer program product containing instructions that, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the method of claim 1.

10. A computer readable storage medium comprising computer program instructions which, when executed by a cluster of computing devices, perform the method of claim 1.

Images