TWI874230B - Security encryption algorithm identification method and system - Google Patents

Abstract

The present invention is a method and system for identifying a secure encryption algorithm. The method mainly comprises an electronic device for installing a software application, which comprises a storage unit for downloading and storing at least one dynamic link library, a scanning module loaded on the electronic device, which scans the dynamic link library to obtain a dynamic link library file name information, and a password dynamic link library list. The scanning module compares the dynamic link library file name information according to the password dynamic link library list to generate at least one secure encryption algorithm library file name information. The scanning module links a secure encryption algorithm library corresponding to the secure encryption algorithm library file name information and obtains the secure encryption algorithm library file name information. A secure encryption algorithm library version information in the secure encryption algorithm library metadata, a designated secure encryption algorithm library storage unit of a secure encryption algorithm library with at least one plug-in, the scanning module downloads a secure encryption algorithm library with a plug-in from the designated secure encryption algorithm library storage unit according to the secure encryption algorithm library file name information and the secure encryption algorithm library version information, and overwrites the secure encryption algorithm library in the electronic device, a designated storage unit set in the electronic device, which is used to store a record file generated when the current application calls the secure encryption algorithm library with a plug-in.

Description

Identification method and system of secure encryption algorithm

The present invention is a method for identifying and monitoring a secure encryption algorithm, and in particular, a method for identifying a secure encryption algorithm and a system thereof.

According to current software application developers, in order to ensure the confidentiality and integrity of system data, they need to use cryptographic technology to encrypt data before storing or transmitting it.

However, if the types of cryptographic algorithms and the cryptographic techniques used are not understood or used improperly during the development of software applications, security vulnerabilities will inevitably occur. Common types of errors include using cryptographic algorithms with security issues or insufficient security strength, using fixed values instead of random numbers as the initial vector of the encryption algorithm, and the cryptographic algorithm key is not random.

Therefore, in view of this, how to know the current password algorithm used by the system is particularly important in information security. The current practice is to install a monitoring program in the existing system (such as Android, iOS). The monitoring program runs and monitors the password algorithm in a high-permission mode, so it can affect the program operation (modify the system) without modifying the APK file (such as the Android system installation package file). The framework service can be used to create many powerful modules based on it, and they can operate simultaneously without conflicting functions, but it is relatively easy to cause information security risks.

Furthermore, the features that can be identified during the execution of the cryptographic algorithm are difficult to predict. Different system environments, programs or hardware architectures may generate different monitoring contents during execution, making it difficult to monitor.

Therefore, how to ensure system information security and accurately monitor password algorithms in real time has become an urgent problem to be solved.

The detailed features and advantages of the present invention are described in detail in the following implementation method. The content is sufficient for anyone familiar with the relevant technology to understand the technical content of the present invention and implement it accordingly. According to the content disclosed in this specification, the scope of the patent application and the drawings, anyone familiar with the relevant technology can easily understand the relevant purposes and advantages of the present invention.

The main purpose of the present invention is to more accurately determine the security encryption algorithm function or security encryption algorithm function selected by the software application through the stored log file (including the name of the software application that calls the security encryption algorithm library, the calling time, the name of the called library or the name of the function in the called library, etc.).

To achieve the above-mentioned purpose, the present invention is a method for identifying a secure encryption algorithm, the steps of which include: a. a scanning module scans at least one dynamic link library in an electronic device and obtains a dynamic link library file name information; b. the scanning module compares the dynamic link library file name information according to a password dynamic link library list to generate at least one secure encryption algorithm library file name information; c. the scanning module links to a secure encryption algorithm library and obtains a metadata of the secure encryption algorithm library, and obtains a secure encryption algorithm library version information in the metadata; d. the scanning module The scanning module is linked to a designated secure encryption algorithm library storage unit storing a secure encryption algorithm library with a plug-in, and the secure encryption algorithm library with the plug-in is downloaded according to the secure encryption algorithm library file name information and the secure encryption algorithm library version information, and the secure encryption algorithm library with the plug-in is used to cover the secure encryption algorithm library; and e. when a software application calls the secure encryption algorithm library with the plug-in, a log file corresponding to the secure encryption algorithm library with the plug-in is generated and stored in a designated storage unit of the electronic device.

According to one embodiment of the present invention, step f is further included, where a comparison analysis module compares a blacklist and the log file, and sends a notification or does not send a notification based on the comparison result.

According to one embodiment of the present invention, the log file includes the name of the software application that calls the secure encryption algorithm library with the plug-in, the calling time, the name of the called library or the name of the called function.

A secure encryption algorithm identification system is used to execute the secure encryption algorithm identification method as described in item 1 of the patent application scope, and the identification system includes: an electronic device for installing a software application, which includes a storage unit for downloading and storing at least one dynamic link library a scanning module loaded on the electronic device, for scanning the dynamic link library to obtain a dynamic link library file name information; a password dynamic link library list, the scanning module generates at least one secure encryption algorithm library file name information by comparing the dynamic link library file name information according to the password dynamic link library list, and the scanning module links a file name information with the secure encryption algorithm library file. The invention relates to a security encryption algorithm library corresponding to the name information, and obtains a metadata of the security encryption algorithm library, and obtains a security encryption algorithm library version information from the metadata; a designated security encryption algorithm library storage unit of a security encryption algorithm library with at least one plug-in, the scanning module downloads a security encryption algorithm library with a plug-in from the designated security encryption algorithm library storage unit according to the security encryption algorithm library file name information and the security encryption algorithm library version information, and overwrites the security encryption algorithm library in the electronic device; and a designated storage unit set in the electronic device, which is used to store a record file generated when the software application calls the security encryption algorithm library with the plug-in.

According to one embodiment of the present invention, it further includes a comparison analysis module and a blacklist, the comparison analysis module compares the blacklist information and the record file in the designated storage unit, and sends a notification or does not send a notification based on the comparison result.

According to one embodiment of the present invention, the log file includes the name of the software application that calls the secure encryption algorithm library with a plug-in, the calling time, the name of the called library or the name of the called function.

1: Electronic devices

10: Storage unit

100: Dynamically linked library

S1: Dynamically linked library file name information

12: Scanning module

M1: Security encryption algorithm library file name information

13: Password dynamic link library list

101:Secure encryption algorithm library

20: Secure encryption algorithm library with plug-ins

1011: Metadata

M2: Security encryption algorithm library version information

15: Specify storage unit

16: Comparison analysis module

17: Blacklist

2: Specify the secure encryption algorithm library storage unit

20: Secure encryption algorithm library with plug-ins

3: Software Applications

a~e: Steps of identifying the secure encryption algorithm

f: Methods and steps for comparing blacklists

Figure 1 is a schematic diagram of the steps of the identification method of the present invention.

Figure 2 is a schematic diagram of the step flow of adding step f in the present invention.

Figure 3 is a block diagram of the present invention for downloading the corresponding secure encryption algorithm library with a plug-in.

FIG4 is a block diagram showing the invention of covering a secure encryption algorithm library with a plug-in secure encryption algorithm library.

Figure 5 is a block diagram showing the unified format of the record file of the present invention.

The following is a specific example to illustrate the implementation of the present invention. People familiar with this technology can easily understand other advantages and effects of the present invention from the content disclosed in this manual.

The structures, proportions, sizes, etc. shown in the attached drawings of this manual are only used to match the contents disclosed in the manual for people familiar with this technology to understand and read. They are not used to limit the conditions under which the present invention can be implemented, so they have no substantial technical significance. Any modification of the structure, change of the proportion relationship, or adjustment of the size should still fall within the scope of the technical content disclosed by the present invention without affecting the effects and purposes that can be achieved by the present invention. At the same time, the terms such as "one", "two", "upper", etc. quoted in this manual are only for the convenience of description, and are not used to limit the scope of the present invention. The changes or adjustments in their relative relationships should also be regarded as the scope of the present invention without substantially changing the technical content.

Please refer to Figures 1 and 2, which are schematic diagrams of the step flow of the identification method of the present invention and the step flow diagram of adding step f. The present invention is a method for identifying a secure encryption algorithm, which mainly includes the following steps:

a. A scanning module scans at least one dynamic link library in the electronic device and obtains the file name information of the dynamic link library.

The scanning module can obtain file name information using a script or a software program that can obtain specific file name information. The scanning module scans all dynamic link library file name information in the electronic device according to the file extension, that is, the file names with file extensions such as .dll, .ocx, .drv or .so are filtered out. In addition, the file name includes a main file name and a file extension, such as libssl.so, where libssl is the main file name and .dll is the file extension. libssl is a library used for secure communication to avoid eavesdropping. To further explain, from step a., it can be known which dynamic link libraries the electronic device has.

b. The scanning module generates at least one secure encryption algorithm library file name information by comparing the dynamic link library file name information with a password dynamic link library list.

The cryptographic dynamic link library list includes multiple sets of main file names of secure encryption algorithm libraries, such as libssl. The scanning module can compare the main file name of the secure encryption algorithm library included in the cryptographic dynamic link library list with the file name information of the dynamic link library. If they are consistent, at least one secure encryption algorithm library file name information is generated, such as: the main file name of the secure encryption algorithm library in the cryptographic dynamic link library list is l ibssl, when the dynamic link library file name information contains libssl, libssl is used as the secure encryption algorithm library file name information. On the contrary, if the dynamic link library file name does not contain libssl, the secure encryption algorithm library file name information is not generated. To further explain, from step b., the secure encryption algorithm libraries in the current dynamic link library can be known through the cryptographic dynamic link library list.

c. The scanning module is linked to a secure encryption algorithm library, and obtains metadata of the secure encryption algorithm library, and obtains version information of the secure encryption algorithm library from the metadata.

Among them, the scanning module links to the security encryption algorithm library corresponding to the security encryption algorithm library file name information in the electronic device, and obtains the version information in its metadata, such as: the security encryption algorithm library file name information is libssl, the scanning module links to libssl.dll, and obtains the version information in its metadata, such as: version 1.01. To further explain, the version of the security encryption algorithm library used by the current electronic device can be obtained from step c.

d. The scanning module is linked to a designated secure encryption algorithm library storage unit of a secure encryption algorithm library of a plug-in, and a secure encryption algorithm library of a plug-in is downloaded according to the secure encryption algorithm library file name information and the secure encryption algorithm library version information, and the secure encryption algorithm library of the plug-in is used to overwrite the secure encryption algorithm library.

To further explain, taking libssl as an example, after obtaining the file name information libssl and version information version 1.01, the scanning module links to the specified secure encryption algorithm library storage unit, and downloads a corresponding secure encryption algorithm library with a plug-in according to the file name information libssl and version information version 1.01, which is libssl.dll 1.01 in this example. In addition, the plug-in in the secure encryption algorithm library with a plug-in can be a function, and its purpose is to allow the secure encryption algorithm library with a plug-in to leave a log file when it is executed. After downloading, the libssl.dll 1.01 with a plug-in will overwrite the libssl.dll 1.01 in the original electronic device.

e. When a software application calls the secure encryption algorithm library with a plug-in, a log file corresponding to the secure encryption algorithm library with a plug-in is generated and stored in the designated storage unit of the electronic device.

The log file contains the name of the software application that calls the secure encryption algorithm library with plug-in, the call time, the name of the called library or the name of the called function.

It also includes step f, where a comparison analysis module compares a blacklist and the log file, and sends or does not send a notification based on the comparison result.

The comparison analysis module is connected to a blacklist and the designated storage unit, and compares the blacklist information with the record file in the designated storage unit, and sends a notification or does not send a notification according to the comparison result, wherein the blacklist can be a non-permitted list, including information of non-post-quantum cryptography encryption algorithms, such as the name and code of the non-post-quantum cryptography encryption algorithm, and the data integration program is used to collect the record file and send a notification according to the blacklist. The information in the comparison log file is compared with the library name or the function name called. If the library name or the function name called is the information of the non-post-quantum cryptography encryption algorithm in the blacklist, a notification is issued. Further explanation: the comparison analysis module mainly determines whether the electronic device uses an unsafe security encryption algorithm library through the blacklist, mainly encryption algorithms that are not applied quantum cryptography.

According to the steps of the security encryption algorithm identification method described above, with reference to FIG3, FIG4 and FIG5, the block diagram of the present invention downloading the corresponding secure encryption algorithm library with a plug-in, the block diagram of the secure encryption algorithm library with a plug-in covering the secure encryption algorithm library, and the block diagram of the comparison analysis module comparing the blacklist information and the log file information and sending a notification.

The security encryption algorithm identification system of the present invention is used to execute the security encryption algorithm identification method. In the system, an electronic device 1 is used to install a software application 3, and includes a storage unit 10 for downloading and storing at least one dynamic link library 100. A scanning module 12 loaded in the electronic device 1 is used to scan the dynamic link library 100 to obtain a dynamic link library file name information S1.

The scanning module 12 links the password dynamic link library list 13 with the storage unit 10, and the scanning module 12 compares the dynamic link library file name information S1 in the storage unit 10 according to the password dynamic link library list 13 to generate at least one secure encryption algorithm library file name information M1.

The scanning module 12 information links a secure encryption algorithm library 101, obtains a metadata 1011 of the secure encryption algorithm library 14, and obtains a secure encryption algorithm library version information M2 in the metadata 1011, wherein the scanning module 12 links the secure encryption algorithm library corresponding to the secure encryption algorithm library file name information M1 in the electronic device 1, and the secure encryption algorithm library 101 is one or more of the dynamically linked libraries 100.

Then, the scanning module 12 is connected to the designated secure encryption algorithm library storage unit 2, which has at least one secure encryption algorithm library 20 with a plug-in, and downloads the secure encryption algorithm library 20 with a plug-in according to the secure encryption algorithm library file name information M1 and the secure encryption algorithm library version information M2, and the secure encryption algorithm library 20 with a plug-in covers the secure encryption algorithm library 101.

When the software application 3 calls the secure encryption algorithm library 20 with a plug-in, a log file corresponding to the secure encryption algorithm library 20 with a plug-in is generated and stored in the designated storage unit 15 of the electronic device. The log file includes the name of the software application that calls the secure encryption algorithm library with a plug-in, the calling time, the called library name or the called function name. In addition, a comparison analysis module 16 links a blacklist 17 with the designated storage unit 15. The comparison analysis module 16 compares the blacklist 17 information with the log file in the designated storage unit 15, and sends a notification or does not send a notification based on the comparison result.

From the above, we can see that through the stored log files (including the name of the software application that calls the secure encryption algorithm library with plug-in, the call time, the name of the called library or the name of the called function), it is possible to more accurately judge the secure encryption algorithm library or secure encryption algorithm function selected by the software application, and issue a notification for the use of insecure secure encryption algorithms. 1

The above embodiments are only for illustrative purposes to illustrate the principle and efficacy of the present invention, and are not intended to limit the present invention. Anyone familiar with this technology may modify the above embodiments without violating the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be as listed in the scope of the patent application described below.

a~e: Steps of identifying the secure encryption algorithm

Claims (6)

A method for identifying a secure encryption algorithm, the steps of which include: a. Using a scanning module to scan at least one dynamic link library in an electronic device and obtain a dynamic link library file name information; b. The scanning module generates at least one secure encryption algorithm library file name information by comparing the dynamic link library file name information with a password dynamic link library list; c. The scanning module is linked to a secure encryption algorithm library, and obtains metadata of the secure encryption algorithm library, and obtains version information of the secure encryption algorithm library from the metadata; d. The scanning module is linked to a designated secure encryption algorithm library storage unit storing a secure encryption algorithm library with a plug-in, and the secure encryption algorithm library with the plug-in is downloaded according to the secure encryption algorithm library file name information and the secure encryption algorithm library version information, and the secure encryption algorithm library with the plug-in is overwritten by the secure encryption algorithm library; and e. When a software application calls the secure encryption algorithm library with the plug-in, a log file corresponding to the secure encryption algorithm library with the plug-in is generated and stored in a designated storage unit of the electronic device. The method for identifying a secure encryption algorithm as described in claim 1 further includes step f, comparing a blacklist and the log file by a comparison analysis module, and sending or not sending a notification based on the comparison result. The method for identifying a secure encryption algorithm as described in claim 1, wherein the log file includes the name of the software application that calls the secure encryption algorithm library with the plug-in, the calling time, the name of the called library, or the name of the called function. A secure encryption algorithm identification system is used to execute the secure encryption algorithm identification method described in item 1 of the patent application scope, and the identification system includes: An electronic device for installing a software application, comprising a storage unit for downloading and storing at least one dynamically linked library; A scanning module loaded on the electronic device, which is used to scan the dynamic link library to obtain a dynamic link library file name information; A cryptographic dynamically linked library list, wherein the scanning module generates at least one secure encryption algorithm library file name information by comparing the dynamically linked library file name information with the cryptographic dynamically linked library list, and the scanning module links a secure encryption algorithm library corresponding to the secure encryption algorithm library file name information, and obtains a metadata of the secure encryption algorithm library, and obtains a secure encryption algorithm library version information from the metadata; A designated secure encryption algorithm library storage unit having at least one secure encryption algorithm library of a plug-in, the scanning module downloads a secure encryption algorithm library of a plug-in from the designated secure encryption algorithm library storage unit according to the secure encryption algorithm library file name information and the secure encryption algorithm library version information, and overwrites the secure encryption algorithm library in the electronic device; and A designated storage unit located in the electronic device is used to store a log file generated when the software application calls the secure encryption algorithm library with the plug-in. The identification system of the secure encryption algorithm as described in claim 4 further includes a comparison analysis module and a blacklist, the comparison analysis module compares the blacklist information and the record file in the designated storage unit, and sends a notification or does not send a notification based on the comparison result. A secure encryption algorithm identification system as described in claim 4, wherein the log file includes the name of the software application that calls the secure encryption algorithm library with a plug-in, the call time, the name of the called library, or the name of the called function.

Images