## 6 Conclusions and Future Work  
Secure implementation of security protocols is a hot issue in the security protocol and code security fields. In this paper, firstly, we presented the MCSPI method to construct client valid request messages. Then, we proposed the SAS scheme to generate a server-side abstract model of security protocols. Next, we introduced a security analysis method to evaluate the security of security protocol implementations through combining constructed client request messages generated with MCSPI, corresponding server-side response messages, and server-side an abstract model produced by SAS. Further, we implemented SPIA to evaluate the security of security protocol implementations. Finally,  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Systems** & **Client-Side Implementations** & **Server Abstract Model** & **Results** \\ \hline QQ mail & \(p\)\(\cdot\)\(>\) salt \(>\) 3 times MDS \(>\) snaencrypt \(\cdot\)\(>\)\(p^{\prime}\) & \(p\)\(\cdot\)\(>\) decrypt \(\cdot\)\(>\) verifyMDS & Less vulnerable \\ RSAAuth & Pwd \(\cdot\)\(>\) rsaencrypt \(\cdot\)\(>\) base6 encode \(\cdot\)\(>\) M & M \(\cdot\)\(>\) crypt \(\cdot\)\(>\) decode & Vulnerable \\ \hline \hline \end{tabular}
\end{table}
Table 2: Results for security analysis of Tencent QQ mail system version 2017 and RSAAuth.  
we tested Tencent QQ mail system version 2017 and RSAAuth and found that Tencent QQ mail system version 2017 is more secure because it holds some security restrictions when login attempts occur, such as user password security check, login time window limitation, and number of login attempts restrictions. However, RSAAuth is vulnerable because it only holds a user password security check, and this check does not make the system secure enough.  
Using our current methods, we can evaluate the security of security protocol implementations in security applications. Owing to the time limitation, we only present an analysis by comparing existing related works with our scheme, which are expressed in Section 5.3. However, in the future, we will make a quantitative analysis for computational costs. Still, there are several limitations to our current method. For example, the client-side implementation automatic extraction is not at a high level, and encrypted or obfuscated implementations cannot be done efficiently. Therefore, we will keep our focus on the following two issues in future works:  
1. Universal methods or tools to extract, at a high automatic level, the security protocol implementations from web applications are necessary. The precondition of security analysis is to obtain security protocol implementations. However, the work is currently mainly performed by hand. Although there are some automatic methods for extracting security protocol implementations, these methods are not suitable for all security systems. Therefore, universal methods or tools that can extract the implementations of security protocols from web applications at a high automatic level are important.
2. So far, many client-side implementations have been obfuscated or encrypted to enhance the security of web security applications. Hence, handling encrypted or obfuscated client-side implementations is our core work in the future.  
Methodology, J.L., D.W., and B.M.; Software, L.Y. and X.H.; Supervision, B.M.; Writing--original draft, J.L.; Writing--review & editing, J.L., C.H., and B.M.  
This work was supported in part by the Fundamental Research Funds for the Central Universities, South Central University for Nationalities Nos. CZZ18003 and QSZ17007, and in part by the natural science foundation of Hubei Province under the grants No. 2018 ADC150.  
The authors declare no conflict of interest.