CN112149123B - Safety inspection system and method for application program - Google Patents

Abstract

The invention provides a system and a method for security check of an application program, which relate to the technical field of network information security and comprise the following steps: the task receiving module is used for receiving an inspection task, and the inspection task comprises basic information of at least one application program to be inspected and at least one inspection item related to the application program to be inspected; the program import module imports the checked application program according to the basic information; the inspection knowledge base stores the corresponding relation between each inspection item configured in advance and the corresponding inspection standard; the safety inspection module is used for obtaining a corresponding inspection standard according to the matching of each inspection item in the inspection task and carrying out safety inspection on the application program to be inspected according to the inspection standard; and the record generating module is used for generating the check record corresponding to each check item according to the safety check result corresponding to each check item. The method has the advantages of realizing electronization of the safety inspection process of the application program, reducing the difficulty of law enforcement operation, ensuring the authenticity of inspection records and effectively improving the working efficiency and standardization level of law enforcement.

Description

System and method for security check of application program

technical field

The invention relates to the technical field of network information security, in particular to an application program security inspection system and method.

Background technique

Today, with the rapid development of science and technology, mobile terminals have become necessary tools in people's work and life, and various mobile application APP (Application, application program) software are more and more widely used. Due to the collection and use of user information and other data during the use of mobile application software, the security issues of mobile application software have also entered people's perspectives, and the security inspection of mobile application software is urgent.

The traditional security inspection method requires law enforcement personnel to fill in paper inspection documents and inspection records, etc., which has problems such as low efficiency of security inspection, inability to guarantee the authenticity of inspection records, and difficulty in the management of subsequent inspection records.

Contents of the invention

Aiming at the problems existing in the prior art, the present invention provides a security check system for application programs, including: a security check tool, the security check tool includes:

A task receiving module, configured to receive an inspection task, the inspection task including basic information of at least one application to be inspected and at least one inspection item associated with the application to be inspected;

A program import module, connected to the task receiving module, for importing the checked application according to the basic information of the checked application;

An inspection knowledge base, configured to store the correspondence between the pre-configured inspection items and corresponding inspection standards;

A security inspection module, connected to the task receiving module, the program import module, and the inspection knowledge base, for matching each inspection item in the inspection task to obtain the corresponding inspection standard, and according to the Perform a security check on the checked application program according to the check standard;

A record generation module, connected to the safety inspection module, for generating inspection records corresponding to each inspection item according to the safety inspection results corresponding to each inspection item.

Preferably, the safety inspection tool further includes a task establishment module connected to the task reception module for law enforcement personnel to establish the inspection task and send the inspection task to the task reception module.

Preferably, it also includes a system management platform, connected to the safety inspection tool, for law enforcement personnel to create the inspection task and send the inspection task to the safety inspection tool.

Preferably, the system management platform includes a notification generation module, configured to generate an inspection notification according to the inspection task to notify the inspected unit to which the inspected application program belongs.

Preferably, the system management platform includes a data processing module, configured to obtain the inspection records corresponding to each of the inspection items, and generate an inspection report of the inspected application program according to each of the inspection records.

Preferably, the inspection standard includes several inspection item rule bases;

Then the safety check module includes:

A key function checking unit, configured to match and obtain a corresponding key function rule base as the check item rule base when the check item is a key function check item, and perform a check on the checked application according to the key function rule base Conduct focused function checks; and/or

A malicious program checking unit, configured to match the corresponding malicious program rule base as the check item rule base when the check item is a malicious program check item, and check the checked application program according to the malicious program rule base conduct malware checks; and/or

A third-party software development tool check unit, configured to match the corresponding third-party software development tool rule base as the check item rule base when the check item is a third-party software development tool check item, and according to the third-party A software development tool rule base performs a third-party software development tool check on said checked application; and/or

A program vulnerability checking unit, configured to match the corresponding program vulnerability rule base as the check item rule base when the check item is a program vulnerability check item, and check the checked application program according to the program vulnerability rule base. conduct program vulnerability checks; and/or

The illegal content inspection unit is configured to match the corresponding illegal content rule library as the inspection item rule library when the inspection item is an illegal content inspection item, and perform a check on the checked application program according to the illegal content rule library. Check for illegal content.

Preferably, the inspection standards include safety behavior standards, and the inspection items include safety behavior inspections;

Then the safety check module includes:

A violation behavior analysis unit, configured to conduct a safety behavior inspection on the collection and use of personal information of the inspected application program according to the safety behavior standards; and/or

A permission use checking unit, configured to check the security behavior of the permission obtained by the checked application program according to the security behavior standard; and/or

A sensitive behavior analysis unit, configured to check the security behavior of the sensitive behavior of the checked application program according to the security behavior standard.

Preferably, the inspection standard includes a compliance standard, and the inspection item includes a compliance inspection;

Then the safety check module also includes:

A filing information checking unit, configured to acquire the filing information of the checked application, and check the compliance of the filing information according to the compliance standard; and/or

an illegal response checking unit, configured to acquire illegal information discovery and response information of the checked application program, and perform a compliance check on the illegal information discovery and response information according to the compliance standard; and/or

a privacy policy checking unit, configured to obtain the privacy policy text of the checked application, and perform a compliance check on the content of the privacy policy text according to the compliance standard; and/or

The security management checking unit is configured to obtain the security management system of the checked unit to which the checked application program belongs, and check the compliance of the security management system according to the compliance standard.

Preferably, it also includes a first-level rule base, connected to the security inspection tool, for storing the latest inspection business rules, and the security inspection tool obtains the latest inspection business rules before executing the inspection task to synchronously update the Check item rule base.

A security check method for an application program, applied to the above-mentioned application program security check system, the security check method comprising:

Step S1, the security inspection tool receives an inspection task, and the inspection task includes basic information of at least one application to be inspected and at least one inspection item associated with the application to be inspected;

Step S2, the security check tool imports the checked application according to the basic information of the checked application;

Step S3, the safety inspection tool matches each of the inspection items in the inspection task with the pre-configured correspondence between each of the inspection items and the corresponding inspection standard to obtain the corresponding inspection standard, and according to the Perform a security check on the checked application program according to the check standard;

Step S4, the safety inspection tool generates an inspection record corresponding to each inspection item according to the safety inspection result corresponding to each inspection item.

The above technical solution has the following advantages or beneficial effects: realize the electronic security inspection process of the application program, facilitate the query management and data traceability of subsequent inspection records, reduce the difficulty of law enforcement operations, and effectively improve the efficiency and efficiency of law enforcement while ensuring the authenticity of inspection records. normalization level.

Description of drawings

FIG. 1 is a schematic structural diagram of a security check system for an application program in a preferred embodiment of the present invention;

Fig. 2 is a schematic structural view of a safety inspection tool in a preferred embodiment of the present invention;

Fig. 3 is a schematic flowchart of a method for security checking of an application program in a preferred embodiment of the present invention.

Detailed ways

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments. The present invention is not limited to this embodiment, and other embodiments may also belong to the scope of the present invention as long as they conform to the gist of the present invention.

In a preferred embodiment of the present invention, based on the above-mentioned problems existing in the prior art, a security check system for an application program is now provided, as shown in FIG. 1 , including: a security check tool 1, the security check tool 1 includes:

The task receiving module 11 is configured to receive an inspection task, the inspection task includes at least one basic information of the application to be inspected and at least one inspection item associated with the application to be inspected;

A program import module 12, connected to the task receiving module 11, is used to import the checked application program according to the basic information of the checked application program;

An inspection knowledge base 13, configured to save the pre-configured correspondence between each of the inspection items and corresponding inspection standards;

The security inspection module 14 is respectively connected to the task receiving module 11, the program import module 12 and the inspection knowledge base 13, and is used to obtain corresponding inspection standards according to the matching of each inspection item in the inspection task, and perform security inspection on the inspected application program according to the inspection standards. examine;

The record generation module 15 is connected to the safety inspection module 14 and is used to generate inspection records corresponding to each inspection item according to the safety inspection results corresponding to each inspection item.

Specifically, in this embodiment, the above-mentioned security inspection tool is applied to the network security department to carry out application program security inspection, and the type of application program target inspection covers Android version and iOS version. The above-mentioned task receiving module 11 may be a human-computer interaction interface, through which law enforcement personnel receive inspection tasks, and then perform subsequent security inspection work. The inspection tasks may include basic information and inspection items of the application program to be inspected, or Including inspection content and inspection time, etc. The above inspection knowledge base 13 is preferably packaged with inspection standards for application security inspection work, which include but not limited to implementation experience, expert knowledge and analysis models of application program security inspection work, so that the inspection content and inspection records of security inspection tools can be Analyze according to the knowledge, models and rules built in 13 in the inspection knowledge base, and provide inspection methods, inspection result judgment basis, tool inspection result analysis, and risk reminders for non-conforming items for application security inspection. When performing a security check on the checked application, the corresponding check criteria in the check knowledge base 13 can be called to perform a security check according to the check items included in the check task, and a corresponding check record is generated after each check item is checked. The inspection record can include the name of the inspected unit to which the inspected application belongs, the inspection time, the inspection location, the signature information of the inspection police, the signature information of the personnel of the inspected unit, and the inspection result information of the inspection items, etc., to realize the electronic security inspection of the application program. to facilitate subsequent data query and data traceability. As a preferred embodiment, the detection record can also include taking photos and photographing evidence files, recording evidence audio, and storing evidence-related files; law enforcement personnel can manage evidence-related files through the security inspection tool 1, including Import, export, delete, upload, etc.; the security inspection tool 1 also provides law enforcement personnel with the function of confirming records and entering electronic signatures.

As a preferred embodiment, the above-mentioned safety inspection tool 1 can be deployed in a local portable device. As shown in FIG. 2 , the safety inspection tool 1 also provides a login interface 100. Receive inspection tasks, and perform security inspections on corresponding inspected applications according to the inspection tasks. The above-mentioned security inspection tools can also be deployed in the cloud, and law enforcement personnel can remotely access the security inspection tools in the cloud through the network, such as logging in through B/S, to obtain inspection tasks, and perform security inspections on the corresponding inspected applications according to the inspection tasks . As a preferred embodiment, the safety inspection tool 1 also provides an identity verification module, through which the login information of law enforcement officers is verified to identify the identity of the user, and protect the identification data from unauthorized access or modification, the above-mentioned The verification method can be two-factor authentication.

As a preferred implementation manner, the above-mentioned checked application programs can be manually imported individually or in batches, or can be automatically imported according to a pre-configured storage path of the checked application programs.

As a preferred embodiment, the safety inspection tool 1 can also provide a safety audit module 101, which is used to check the knowledge base and the upgrade operation of the safety inspection tool, the printing events of document materials such as on-site law enforcement inspection record results and feedback opinions, law enforcement personnel Events such as login and logout, data import and export, etc. generate audit records, and ensure that only authorized users can read and back up the above audit records.

As a preferred embodiment, the security inspection tool 1 encrypts and decrypts inspection data using a domestic commercial encryption algorithm approved by the State Office of Commercial Secrets. Domestic commercial encryption products should be portable and stored separately from the security check tool, and can only be connected with the security check tool when using the security check tool, and the following methods should be adopted to enhance data security: the program area and the data area are physically separated, and the program area The data cannot be read or written, and the data area is only allowed to be written by the tool system; the business data generated from the tool, including but not limited to inspection result data, reports, traffic data, log data, etc., should be encrypted with domestic commercial encryption algorithms and stored.

As a preferred implementation manner, the security inspection tool 1 may also provide a trace removal module 102 for irreversibly clearing business data generated during the security inspection process.

As a preferred embodiment, the safety inspection tool 1 can also provide a state recovery module 103 for restoring the safety inspection tool to the factory state.

In a preferred embodiment of the present invention, the safety inspection tool 1 further includes a task establishment module 16 connected to the task reception module 11 for law enforcement personnel to establish inspection tasks and send the inspection tasks to the task reception module 11 .

Specifically, in this embodiment, law enforcement personnel can create inspection tasks by themselves according to inspection requirements through the task creation module 16 set in the security inspection tool 1 . As a preferred embodiment, a pre-generated check item set is stored in the security check tool 1, which includes a plurality of check items, and law enforcement personnel can extract check items from the check item set according to check requirements to generate Check tasks. As a preferred implementation, the above-mentioned task establishment module 16 can also be connected to the inspection knowledge base 13, so that law enforcement personnel can call the inspection standards in the inspection knowledge base 13 to customize the inspection and evaluation content, so as to complete the rapid integration of the inspection content of special inspection tasks.

In a preferred embodiment of the present invention, a system management platform 2 is also included, which is connected to the safety inspection tool 1 and is used for law enforcement personnel to establish inspection tasks and send the inspection tasks to the safety inspection tool 1 .

Specifically, in this embodiment, the law enforcement personnel can realize the remote establishment and distribution of inspection tasks through the system management platform 2. Further specifically, the system management platform 2 can allow law enforcement personnel to formulate inspection plans, and the inspection plan content package can include the The name of the inspection application, the name of the inspection plan, the content of the inspection object, the start and end time of the inspection plan, etc. After the inspection plan is formulated, law enforcement personnel can also perform operations such as querying and modifying the inspection plan through the system management platform 2 . After the inspection plan is determined, the system management platform 2 can generate corresponding inspection tasks according to the inspection plan and send them to the safety inspection tool 1 . The safety inspection tool 1 also provides a login interface through which law enforcement personnel can obtain inspection tasks issued by the system management platform 2 after logging in to the safety inspection tool 1 .

In a preferred embodiment of the present invention, the system management platform 2 includes a notification generation module 21, which is used to generate an inspection notification according to the inspection task to notify the inspected unit to which the inspected application program belongs.

Specifically, in this embodiment, the system management platform 2 can also generate a corresponding inspection notice and notify the inspected unit while issuing the inspection task, so as to realize the electronic transmission of the inspection notice.

In a preferred embodiment of the present invention, the system management platform 2 includes a data processing module 22 for obtaining inspection records corresponding to each inspection item, and generating an inspection report of the checked application program according to each inspection record.

Specifically, in this embodiment, the system management platform 2 generates an overall inspection report by summarizing the inspection records of each inspection item. As a preferred embodiment, the inspection report can use domestic commercial encryption products approved by the State Commercial Secret Office Encryption is performed to ensure the confidentiality of inspection data in inspection reports. As a preferred implementation, when the inspection report indicates that the inspected application program has serious problems and needs to be punished, the law enforcement personnel can issue a penalty ticket to the inspected unit to which the inspected application program belongs through the system management platform 2 . As a preferred implementation, the data transmission between the security inspection tool and the system management platform is encrypted using a cryptographic algorithm approved by the State Office of Commercial Secrets.

In a preferred embodiment of the present invention, the inspection standard includes a number of inspection item rule bases;

Then the security check module 14 includes:

The key function checking unit 141a is used to match and obtain the corresponding key function rule base as the check item rule base when the check item is a key function check item, and perform a key function check on the checked application program according to the key function rule base; and/ or

The malicious program inspection unit 142a is configured to match the corresponding malicious program rule base as the check item rule base when the check item is a malicious program check item, and perform malicious program check on the checked application program according to the malicious program rule base; and/ or

The third-party software development tool check unit 143a is used to match the corresponding third-party software development tool rule base as the check item rule base when the check item is a third-party software development tool check item, and according to the third-party software development tool rule base Conduct third-party software development tool checks on checked applications; and/or

The program vulnerability inspection unit 144a is configured to match the corresponding program vulnerability rule base as the check item rule base when the check item is a program vulnerability check item, and perform program vulnerability check on the checked application program according to the program vulnerability rule base; and/ or

The illegal content inspection unit 145a is configured to match the corresponding illegal content rule library as the inspection item rule library when the inspection item is an illegal content inspection item, and perform illegal content inspection on the checked application program according to the illegal content rule library.

Specifically, in this embodiment, the check item rule base includes, but is not limited to, key function rule bases, malicious program rule bases, third-party software development tool rule bases, program vulnerability rule bases, and illegal content rule bases.

Among them, the inspection objects of the above-mentioned key function inspection include but are not limited to short video, instant messaging, online payment, webcast, financial lending, online games, VPN and other key functions.

The inspection objects of the above-mentioned malicious program inspection include but are not limited to malicious deduction, privacy theft, remote control, malicious transmission, tariff consumption, system destruction, deception and fraud, rogue behavior and other malicious behaviors.

The above inspection of third-party software development tools includes the analysis and judgment of third-party software development kit plug-ins and software development kit behaviors, and the objects of inspection include but not limited to third-party software development tool information, including software development tool names, Version number, provider of software development tools, and detailed introduction information or link addresses of software development tools; identify suspicious software development tools based on malware development tool libraries; conduct behavior analysis on software development tools other than malware development tool libraries, Including: sending personal information to third parties, sending personal information to overseas servers, personal information collection and collection frequency, existence of security holes or Trojan horse programs; list of relevant permissions that can be used to collect personal information applied for by software development tools.

The inspection objects of the above-mentioned program vulnerability inspection include but are not limited to: 1) Program file security: hardened shell identification, risk of Java code decompilation, risk of tampering and secondary packaging, Janus signature mechanism vulnerability, risk of unverified application signature, and unobfuscated code Risks, risks of publishing applications using debug certificates, risks of using only Java codes, risks of starting hidden services, risks of insecure application signature algorithms, etc.; Digital certificate risk, database injection vulnerability, SA encryption algorithm insecure use vulnerability, key hardcoding vulnerability, dynamic debugging attack risk, Webview remote debugging risk, application data arbitrary backup risk, FFmpeg file reading vulnerability, debugging log function call risk, AES/DES encryption method insecure use vulnerability, RSA encryption algorithm insecure use vulnerability, Java layer dynamic debugging risk, etc.; 3) communication data transmission security: clear text transmission data risk, HTTPS unverified server certificate vulnerability, HTTPS unverified Host name vulnerability, HTTPS allows any host name vulnerability, etc.; 4) Identity authentication security: risk of interface hijacking, input monitoring risk, screen capture attack risk, etc.; 5) Internal data interaction security: ContentProvider data leakage vulnerability, Intent Scheme URL attack vulnerability, Fragment Injection attack vulnerability, Activity component export risk, Service component export risk, Broadcast Receiver component export risk, ContentProvider component export risk, local port open unauthorized vulnerability, Intent component implicit call risk, etc.; 6) Malicious attack prevention capability: dynamic injection attack risk , Webview remote code execution vulnerability, unremoved risky Webview system hidden interface vulnerability, zip file decompression directory traversal vulnerability, WebSQL injection vulnerability, InnerHTML XSS attack vulnerability, download arbitrary apk vulnerability, etc.

The inspection objects of the above-mentioned illegal content inspection include but are not limited to identifying violations related to pornography, drugs, gambling, violence, and politics; for illegal content, it should have the function of automatically saving fixed evidence such as screenshots or analysis results.

In a preferred embodiment of the present invention, the inspection standard includes safety behavior standards, and the inspection items include safety behavior inspection;

Then the security check module 14 includes:

Violation behavior analysis unit 141b, configured to conduct safety behavior inspection on the collection and use of personal information of the inspected application program according to the safety behavior standard; and/or

The permission use checking unit 142b is configured to check the security behavior of the permission obtained by the checked application program according to the security behavior standard; and/or

The sensitive behavior analysis unit 143b is configured to check the security behavior of the sensitive behavior of the checked application program according to the security behavior standard.

Specifically, in this embodiment, the above-mentioned violation analysis unit 141b conducts a security behavior inspection on the collection and use of personal information by the checked application program. The violation inspection content includes but is not limited to the collection of personal information without the user's consent; According to the minimum collection of personal information, the type of personal information collected or the permission to collect personal information opened has nothing to do with existing business functions; the actual collection of personal information or the permission to collect personal information is inconsistent with the scope described in the privacy policy; the actual collection The personal information or the open permission to collect personal information exceeds the scope of user authorization; when the application is installed, the user is forced to authorize, and it cannot be installed if the application is not agreed; the application is forced to ask for permission. The frequency of the information (should be the minimum frequency necessary to realize the business functions of the product or service); when the user is not using the relevant function or service, apply in advance to enable the system permission; without the consent of the user or anonymization, the application Provide personal information directly to third parties (including through third-party codes embedded in the client, plug-ins, etc.).

The above-mentioned permission use checking unit 142b checks the security behavior of the permission obtained by the checked application program, including but not limited to that the permission item declared by the application program exceeds the minimum range required by its business; the permission item in the actual running of the application program exceeds its minimum scope The scope of permissions declared; permission has been opened without the user's consent; forcing the user to agree to open multiple permissions that can collect personal information at one time; changing the permission status of its settings without the user's consent; the frequency of requesting permission.

The above-mentioned sensitive behavior analysis unit 143b checks the security behavior of the sensitive behavior of the checked application, including but not limited to, the application continues to collect and use personal information and frequency of use when the application exits or runs in the background; Statement documents; Obtaining installed application list, IP information, MAC address and other device information without the user's consent; Overseas server information accessed during the running of the application (including IP address, port and other information); Send personal information; clear text transmission of personal information during the running of the application.

In a preferred embodiment of the present invention, the inspection standard includes a compliance standard, and the inspection item also includes a compliance inspection;

Then the security check module 14 also includes:

The filing information checking unit 141c is configured to obtain the filing information of the checked application program, and perform a compliance check on the filing information according to compliance standards; and/or

An illegal response checking unit 142c, configured to acquire illegal information discovery and response information of the checked application program, and perform a compliance check on the illegal information discovery and response information according to compliance standards; and/or

The privacy policy checking unit 143c is configured to obtain the privacy policy text of the checked application, and perform a compliance check on the content of the privacy policy text according to compliance standards; and/or

The security management checking unit 144c is configured to obtain the security management system of the checked unit to which the checked application program belongs, and check the compliance of the security management system according to the compliance standard.

Specifically, in this embodiment, the above-mentioned filing information inspection unit 141c checks the compliance of the filing information according to the compliance standard. The content of the inspection includes the filing status of the application program and specific filing information, and the filing information includes the basic information of the enterprise ( Unit nature, organization code, unit name, unified social credit code, registered address, etc.), legal person information (legal person name, ID number, mobile phone number, email, etc.), contact information (contact name, ID number, mobile phone number, etc.) account number, email address, etc.), it should be ensured that the filing information is consistent with the actual situation. As a preferred implementation manner, the compliance standard corresponding to the compliance check of the filing information may be provided by a pre-configured application filing information library.

The above-mentioned illegal response inspection unit 142c checks the compliance inspection of illegal information discovery and response information, including but not limited to whether it has the ability to check illegal keywords for text information published or transmitted by users; The ability to check illegal content of picture information, audio and video information; whether it has the ability to block or block the content of illegal information released or transmitted by users; whether the response time of the application operator is less than 5 minutes after discovery or receipt of the notification .

The above-mentioned privacy policy inspection unit 143c checks the compliance of the content of the privacy policy text, including but not limited to whether there is a privacy policy in the application program, whether the privacy policy includes the rules for collecting and using personal information; whether the purpose of collecting and using personal information is clearly stated , method and scope; whether to list the purpose, method and scope, etc., of collecting and using personal information by applications (including entrusted third parties or embedded third-party codes and plug-ins); whether to explain the purpose, method and scope of collecting and using personal information When changes occur, how to notify users; whether to publish personal information security complaints and reporting channels; whether to clearly indicate the business functions that collect and use personal information; whether to clearly indicate the types of personal information collected by various business functions; whether to clearly identify sensitive personal information type; whether to expressly indicate all system permissions that can collect personal information applied by the application; whether the personal information involves exiting the country; whether to provide a way and method to withdraw consent to collect personal information.

The safety management inspection unit 144c checks the compliance of the safety management system, including but not limited to the application program development safety management system; data security management system; user complaint and reporting system; illegal and harmful information prevention and disposal system; computer room management system; Operating procedures for computer room equipment; security responsible person system; emergency management system; law enforcement assistance system; work plan during major network security periods.

As a preferred implementation, after the security inspection tool conducts compliance assessment according to the above-mentioned compliance standards, it also provides a law enforcement inspection template, which includes the application's law enforcement inspection focus, inspection methods and non-conformance items According to the terms in the corresponding laws and regulations, an application security analysis and assessment report is generated according to the law enforcement inspection template, so as to record the compliance inspection results through the law enforcement inspection template.

In a preferred embodiment of the present invention, it also includes a first-level rule base 3, which is connected to the security inspection tool 1, and is used to save the latest inspection business rules, and the security inspection tool 1 obtains the latest inspection business rules to update synchronously before performing the inspection task Check item rule base.

A security check method for an application program, applied to the above security check system for an application program, as shown in Figure 3, the security check method includes:

Step S1, the security inspection tool receives an inspection task, and the inspection task includes basic information of at least one application to be inspected and at least one inspection item associated with the application to be inspected;

Step S2, the security check tool imports the checked application program according to the basic information of the checked application program;

Step S3, the security inspection tool matches each inspection item in the inspection task with the pre-configured correspondence between each inspection item and the corresponding inspection standard to obtain the corresponding inspection standard, and performs a security inspection on the inspected application program according to the inspection standard;

Step S4, the safety inspection tool generates inspection records corresponding to each inspection item according to the safety inspection results corresponding to each inspection item.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the implementation and protection scope of the present invention. For those skilled in the art, they should be able to realize that all equivalent replacements made by using this specification and the contents of the illustrations The solutions obtained with obvious changes shall all be included in the protection scope of the present invention.

Claims (9)

1. A security check system for an application, comprising: a security inspection tool, the security inspection tool comprising:

the task receiving module is used for receiving an inspection task, wherein the inspection task comprises basic information of at least one inspected application program and at least one inspection item related to the inspected application program;

the program import module is connected with the task receiving module and used for importing the application program to be checked according to the basic information of the application program to be checked;

the inspection knowledge base is used for storing the corresponding relation between each inspection item and the corresponding inspection standard which are configured in advance;

the safety inspection module is respectively connected with the task receiving module, the program importing module and the inspection knowledge base and is used for obtaining the corresponding inspection standard according to the matching of each inspection item in the inspection task and carrying out safety inspection on the inspected application program according to the inspection standard;

the record generating module is connected with the safety inspection module and used for generating the inspection record corresponding to each inspection item according to the safety inspection result corresponding to each inspection item;

the checking standard comprises a plurality of checking item rule bases;

the security check module comprises:

the key function checking unit is used for matching to obtain a corresponding key function rule base as the checking item rule base when the checking item is a key function checking item, and performing key function checking on the application program to be checked according to the key function rule base; and/or

The malicious program checking unit is used for matching to obtain a corresponding malicious program rule base as the check item rule base when the check item is a malicious program check item, and checking the malicious program of the application program to be checked according to the malicious program rule base; and/or

The third-party software development tool checking unit is used for matching to obtain a corresponding third-party software development tool rule base as the checking item rule base when the checking item is the third-party software development tool checking item, and checking the checked application program by the third-party software development tool rule base; and/or

The program vulnerability checking unit is used for matching to obtain a corresponding program vulnerability rule base as the checking item rule base when the checking item is a program vulnerability checking item, and performing program vulnerability checking on the application program to be checked according to the program vulnerability rule base; and/or

And the illegal content checking unit is used for matching to obtain a corresponding illegal content rule base as the checking item rule base when the checking item is an illegal content checking item, and checking illegal content of the application program to be checked according to the illegal content rule base.

2. The system of claim 1, wherein the security inspection tool further comprises a task setup module, coupled to the task receiving module, for enabling law enforcement personnel to set up the inspection task and send the inspection task to the task receiving module.

3. The system for security inspection of an application according to claim 1, further comprising a system management platform connected to the security inspection tool for law enforcement personnel to establish the inspection task and issue the inspection task to the security inspection tool.

4. The system for security inspection of an application program according to claim 3, wherein the system management platform comprises a notification generation module, configured to generate an inspection notification according to the inspection task to notify the inspected unit to which the inspected application program belongs.

5. The system for security inspection of an application program according to claim 3, wherein the system management platform comprises a data processing module, configured to obtain the inspection records corresponding to the inspection items, and generate the inspection report of the inspected application program according to the inspection records.

6. The system of claim 1, wherein the inspection criteria comprises security behavior criteria, and the inspection items comprise security behavior checks;

the security check module comprises:

the violation behavior analysis unit is used for carrying out safety behavior inspection on the behaviors of the inspected application program which collect and use personal information according to the safety behavior standard; and/or

The permission use checking unit is used for checking the safety behavior of the permission acquired by the checked application program according to the safety behavior standard; and/or

And the sensitive behavior analysis unit is used for carrying out security behavior inspection on the sensitive behavior of the inspected application program according to the security behavior standard.

7. The application security check system of claim 1, wherein the check criteria comprises compliance criteria, and the check terms comprise compliance checks;

the security check module further comprises:

the record information checking unit is used for acquiring record information of the application program to be checked and carrying out compliance check on the record information according to the compliance standard; and/or

The illegal response checking unit is used for acquiring illegal information discovery and response information of the application program to be checked and carrying out compliance check on the illegal information discovery and response information according to the compliance standard; and/or

The privacy policy checking unit is used for acquiring a privacy policy text of the application program to be checked and checking the compliance of the content of the privacy policy text according to the compliance standard; and/or

And the safety management checking unit is used for acquiring the safety management system of the checked unit of the checked application program and performing compliance check on the safety management system according to the compliance standard.

8. The application security inspection system of claim 1, further comprising a component rule base coupled to the security inspection tool for storing latest inspection business rules, wherein the security inspection tool obtains the latest inspection business rules before executing the inspection task to synchronously update the inspection item rule base.

9. A security inspection method for an application program, applied to the security inspection system for the application program according to any one of claims 1 to 8, the security inspection method comprising:

step S1, the safety inspection tool receives an inspection task, wherein the inspection task comprises basic information of at least one inspected application program and at least one inspection item related to the inspected application program;

step S2, the safety inspection tool imports the application program to be inspected according to the basic information of the application program to be inspected;

s3, the safety inspection tool matches each inspection item in the inspection task with a corresponding relationship between each inspection item and a corresponding inspection standard, and performs safety inspection on the application program to be inspected according to the inspection standard;

and S4, the safety inspection tool generates the inspection record corresponding to each inspection item according to the safety inspection result corresponding to each inspection item.

Images