A financial-grade database multidimensional security management and control system and method

Abstract

The application discloses a financial-grade database multidimensional security management and control system and method, relates to the technical field of financial data security management and control, and deploys a quantum encryption network and a backup key pool; initializes a data hierarchical management mechanism and a key management hub; transforms a database engine and builds a trusted audit hub, and deploys a security agent on a database node. Through the cooperation of the quantum encryption network and the post-quantum backup key pool, the high security of quantum encryption is utilized to resist traditional and quantum computing threats, and the encryption service is ensured not to be interrupted when the quantum network is abnormal, thereby meeting the continuity requirement of financial transactions; fine-grained data grading is combined with a differentiated security strategy, encryption algorithms, access permissions and retention periods are configured for high-sensitive, medium-sensitive and low-sensitive data respectively, precise protection is realized, and operation efficiency is taken into account; and a multi-role key cooperation mechanism avoids single-point key leakage, and the original key is destroyed after the key is generated, so that the key security is further improved.

Description

Technical Field

[0001] This invention relates to the field of financial data security management technology, and in particular to a financial-grade database multi-dimensional security management system and method. Background Technology

[0002] Databases in the financial industry are the core business support carriers, storing a large amount of highly sensitive data, including user account passwords, fund transfer records, and personal contact information. At the same time, they must ensure the continuous and stable operation of daily transactions and meet the strict requirements of financial regulatory agencies for data security, audit traceability, and retention periods.

[0003] Current financial database security control methods have many limitations:

[0004] First, traditional encryption mechanisms mostly rely on a single key system, which poses a single point of leakage risk during key storage and transmission. Moreover, with the development of quantum computing technology, the security of traditional encryption algorithms faces challenges.

[0005] Secondly, the data classification management is crude, and a uniform security strategy is mostly adopted. It is impossible to match differentiated protection measures according to the sensitivity of the data, resulting in insufficient protection for high-sensitivity data or excessive protection for low-sensitivity data, which affects efficiency.

[0006] Third, risk control relies mainly on static authorization, lacking real-time dynamic assessment of access behavior, often resulting in the inability to promptly block risks discovered during post-event audits.

[0007] Fourth, some security solutions are prone to interruption of encryption services when they encounter failures or attacks, affecting the continuity of financial transactions;

[0008] Fifth, existing audit systems often struggle to achieve real-time synchronization with regulatory agencies, and data self-destruction operations can conflict with legal retention requirements, making it difficult to simultaneously meet the needs of secure destruction and compliant storage.

[0009] These issues make traditional security management solutions ill-suited to the financial industry’s multidimensional needs for data security, business continuity, and regulatory compliance. Summary of the Invention

[0010] To address the aforementioned technical problems, this invention provides a financial-grade database multi-dimensional security management system and method. The technical solution adopted is as follows:

[0011] A multi-dimensional security control method for financial-grade databases includes the following steps:

[0012] Step 1: Deploy the quantum encryption network and backup key pool;

[0013] Step 2: Initialize the data hierarchical management mechanism and key management center;

[0014] Step 3: Modify the database engine and build a trusted audit center, and deploy a security agent on the database nodes;

[0015] Step 4: The security agent intercepts the write requests from the financial application, calls the data classification management mechanism to identify the sensitivity of the data to be written, determines its data level, and records the write context information;

[0016] Step 5: The security agent initiates a key request to the key management center. The key management center obtains the quantum key through the quantum encryption network, generates key fragments for the corresponding roles based on the multi-role key collaboration mechanism, and destroys the original quantum key after generation.

[0017] Step 6: Process the plaintext data using a hybrid encryption mechanism to obtain the final ciphertext packet;

[0018] Step 7: The security agent encapsulates a secure data storage unit containing a unique identifier, metadata, final ciphertext packet, and access control logic based on the data level security policy, writes it into the database, and distributes key fragments to the dedicated storage carriers of the corresponding roles.

[0019] Step 8: After the visitor authenticates using multi-factor authentication based on account password, hardware device, and biometrics, the security agent intercepts the query request, extracts the visitor's behavioral information, and synchronizes it to the risk assessment module.

[0020] Step 9: The risk assessment module extracts the risk characteristics of the access behavior, calculates the risk score according to the preset weight, and determines the low, medium and high risk levels based on the score, and performs direct decryption, secondary authorization decryption or request blocking accordingly.

[0021] Optionally, in step 1, the quantum encryption network includes a core financial transaction node, a disaster recovery node, and a regulatory docking node. A quantum transmission enhancement module is configured to control cross-node transmission latency. A backup key pool is pre-generated based on the post-quantum encryption algorithm to switch over when the quantum encryption network is in an anomaly.

[0022] Optionally, in step 2, the data classification management mechanism divides financial data into high-sensitivity data, medium-sensitivity data, and low-sensitivity data based on their sensitivity.

[0023] Highly sensitive data includes account passwords, bank card CVV codes, and transfer information for single transactions of 500,000 yuan or more;

[0024] High-sensitivity data is bound to quantum encryption and advanced encryption standard 256-bit encryption strategy, and access is limited to risk control roles in financial institutions, with a statutory retention period of 5 years or more;

[0025] Zhongmin Data includes transaction records for the past year and non-public contact information for clients. It is bound to a quantum encryption and AES-256 encryption strategy, and allows access by risk control and compliance roles. The statutory retention period is greater than or equal to 5 years.

[0026] Low-sensitivity data includes the customer's publicly disclosed name, the name of the branch where the account was opened, and the name of the financial product. After binding, it is encrypted with quantum encryption and AES-128 encryption strategies, allowing access to all authorized financial institution employees, and the statutory retention period is greater than or equal to one year.

[0027] The key management center integrates a multi-role key collaboration mechanism, configuring key fragment allocation rules for at least three roles.

[0028] Optionally, in step 3, the security agent supports encrypted communication with the key management center and memory protection for sensitive data, and the trusted audit center is built on a distributed consensus architecture to achieve real-time synchronization of audit information with financial regulatory agencies.

[0029] Optionally, in step 5, the multi-role key collaboration mechanism uses an improved Shamir secret sharing algorithm to generate key fragments, specifically including the following sub-steps:

[0030] Step 51: Construct a polynomial based on the finite field GF(p). The polynomial uses the quantum key as a constant term and is supplemented with three randomly generated secret coefficients. These coefficients are multiplied by the first, second, and third powers of the key fragment index, respectively. The result is then modulo the large prime number p, which is not less than 2 to the power of 256. The index values ​​are 1 to 4, corresponding to the four roles of operation and maintenance, risk control, compliance, and supervision.

[0031] Step 52: Substitute the index values ​​of the four roles into the polynomial to calculate four sets of key fragments, encrypt them respectively, and store them in the USBKey dedicated storage medium of the corresponding role.

[0032] Step 53: After the key fragment is generated, immediately delete the original quantum key and three secret coefficients stored in the key management center.

[0033] Optionally, the process of mixing encryption mechanisms in step 6 includes the following sub-steps:

[0034] Step 61: Using AES-256 Galois with the data encryption key as the encryption key and the plaintext data as the encryption object, a 12-bit random initialization vector and additional authentication data containing data field identifiers and write times are introduced to obtain the first ciphertext after encryption.

[0035] Step 62: Using the AES-256 electronic codebook mode, with the quantum key as the encryption key and the data encryption key as the encryption object, the second ciphertext is obtained by taking the modulo of the result.

[0036] Step 63: Using the elliptic curve digital signature algorithm secp256r1 curve, with the authorized key registered with the financial regulatory agency as the signature key, calculate the SHA-256 hash value of the content concatenated from the first ciphertext and the second ciphertext, and then sign the hash value to obtain the digital signature.

[0037] Step 64: Concatenate the first ciphertext, the second ciphertext, the digital signature, the initialization vector, and the additional authentication data in a fixed order, and distinguish each part by field separators to form the final ciphertext package.

[0038] Optionally, the risk score calculation process in step 9 is as follows:

[0039] First, calculate the location deviation characteristic value A, time deviation characteristic value B, data volume deviation characteristic value C, access control deviation characteristic value D, and frequency deviation characteristic value E respectively; then calculate the risk score S according to the weights, using the following formula:

[0040] ;

[0041] in and The weights are respectively the positional deviation feature value A, time deviation feature value B, data volume deviation feature value C, permission deviation feature value D, and frequency deviation feature value E.

[0042] Optionally, the location deviation feature can be calculated by dividing the geographical distance between the access IP and the historically frequently used IP by 1000;

[0043] If the access time is not within the 9:00-18:00 financial working hours, take 1; otherwise, take 0 to obtain the time deviation feature.

[0044] The data volume deviation characteristic is obtained by subtracting the historical average number of queries from the current query count and then dividing by the historical average number of queries in the past hour. If the result is negative, it is taken as 0.

[0045] The permission deviation feature is obtained by setting 1 when the visitor does not have the corresponding data level permission and 0 otherwise.

[0046] The frequency deviation characteristic is obtained by subtracting the historical average number of queries from the number of queries in one hour and then dividing by the historical average number of queries in one hour. When the result is negative, it is taken as 0.

[0047] Optionally, if S < 0.2, it is judged as low risk; if 0.2 ≤ S < 0.5, it is judged as medium risk; and if S ≥ 0.5, it is judged as high risk.

[0048] A financial-grade database multi-dimensional security management system is used to implement a financial-grade database multi-dimensional security management method. The system includes a quantum encryption network component, a data hierarchical management component, a multi-factor key management hub, a database security proxy component, and a multi-dimensional risk control engine component.

[0049] The quantum encryption network component is used to build a quantum key transmission system between core financial transaction nodes, local disaster recovery nodes, remote disaster recovery nodes and regulatory docking nodes, and is configured with quantum relay and fault tolerance modules and a post-quantum backup key pool.

[0050] The data classification management component establishes a data connection with the database security agent component to classify data according to its sensitivity and bind differentiated security policies to different levels of data. The security policies include encryption algorithm standards, access role permission scope, and statutory retention periods required by financial regulatory requirements.

[0051] The multi-factor key management center establishes encrypted communication connections with the quantum encryption network component and the database security agent component respectively, and integrates a multi-role key splitting module and a key recovery module;

[0052] The database security proxy component is deployed on the financial database engine side and establishes signal transmission connections with the data classification management component, the multi-factor key management hub, and the multi-dimensional risk control engine component, respectively. It is used to intercept database read and write requests, call the data classification management component to determine the data level, perform data encryption and decryption operations, and implement memory security control for highly sensitive plaintext data.

[0053] The multi-dimensional risk control engine component establishes a real-time communication connection with the database security agent component to collect visitor behavioral characteristics, calculate risk scores and determine risk levels based on the visitor's historical behavior baseline, and output differentiated authorization instructions to the database security agent component.

[0054] In summary, the present invention has at least one of the following beneficial technical effects:

[0055] This invention provides a multi-dimensional security management system and method for financial-grade databases. Through the collaboration of a quantum encryption network and a post-quantum backup key pool, it not only utilizes the high security of quantum encryption to resist threats from both traditional and quantum computing, but also ensures that encryption services are not interrupted when the quantum network malfunctions, thus meeting the requirements for continuity of financial transactions.

[0056] Fine-grained data classification combined with differentiated security strategies allows for the configuration of encryption algorithms, access permissions, and retention periods for high-sensitivity, medium-sensitivity, and low-sensitivity data, achieving precise protection while maintaining operational efficiency.

[0057] The multi-role key collaboration mechanism avoids single-point key leakage, and the design of destroying the original key after key generation further enhances key security.

[0058] The real-time dynamic risk control engine calculates risk scores based on multi-dimensional behavioral characteristics, enabling proactive risk identification and differentiated authorization, shifting from passive protection to proactive prevention and control;

[0059] The trusted audit center supports real-time synchronization of audit information with regulatory agencies to meet regulatory traceability requirements, while the compliance self-destruction and archiving mechanisms take into account both data security destruction and legal retention requirements;

[0060] The database security agent implements memory security controls on highly sensitive data in plaintext to prevent data leakage during use. The overall solution constructs a security control system covering the entire data lifecycle, effectively balancing financial data security, business continuity, and regulatory compliance requirements. Attached Figure Description

[0061] Figure 1 This is a flowchart illustrating a multi-dimensional security management method for financial-grade databases according to the present invention. Detailed Implementation

[0062] The present invention will be further described in detail below with reference to the accompanying drawings.

[0063] This invention discloses a financial-grade database multi-dimensional security management system and method.

[0064] Reference Figure 1 Example 1: A multi-dimensional security management method for financial-grade databases, comprising the following steps:

[0065] Step 1: Deploy the quantum encryption network and backup key pool;

[0066] Step 2: Initialize the data hierarchical management mechanism and key management center;

[0067] Step 3: Modify the database engine and build a trusted audit center, and deploy a security agent on the database nodes;

[0068] Step 4: The security agent intercepts the write requests from the financial application, calls the data classification management mechanism to identify the sensitivity of the data to be written, determines its data level, and records the write context information;

[0069] Step 5: The security agent initiates a key request to the key management center. The key management center obtains the quantum key through the quantum encryption network, generates key fragments for the corresponding roles based on the multi-role key collaboration mechanism, and destroys the original quantum key after generation.

[0070] Step 6: Process the plaintext data using a hybrid encryption mechanism to obtain the final ciphertext packet;

[0071] Step 7: The security agent encapsulates a secure data storage unit containing a unique identifier, metadata, final ciphertext packet, and access control logic based on the data level security policy, writes it into the database, and distributes key fragments to the dedicated storage carriers of the corresponding roles.

[0072] Step 8: After the visitor authenticates using multi-factor authentication based on account password, hardware device, and biometrics, the security agent intercepts the query request, extracts the visitor's behavioral information, and synchronizes it to the risk assessment module.

[0073] Step 9: The risk assessment module extracts the risk characteristics of the access behavior, calculates the risk score according to the preset weight, and determines the low, medium and high risk levels based on the score, and performs direct decryption, secondary authorization decryption or request blocking accordingly.

[0074] By adopting the above technical solutions, the quantum encryption network utilizes the properties of quantum physics to achieve absolute security in the key transmission process, avoiding the risk of eavesdropping in traditional key transmission. The configuration of a backup key pool is based on the requirement of uninterrupted business operations. When the quantum network is unable to transmit keys due to failure or interference, the backup key generated by the post-quantum encryption algorithm can be used to fill the gap in time, ensuring that the encryption service of financial transactions is uninterrupted, forming a dual key guarantee of quantum primary and post-quantum backup.

[0075] The system adapts protection strength based on sensitivity. Financial data varies greatly in sensitivity. By classifying data into high, medium, and low sensitivity levels and binding corresponding security policies, it avoids insufficient protection for high-sensitivity data and excessive protection for low-sensitivity data, which can affect efficiency. Multi-role checks and balances prevent leakage by splitting the key into multiple fragments and distributing them to different roles. Multiple roles must participate to recover the key, completely avoiding the single point of leakage risk caused by a single role holding the complete key.

[0076] Audit logs must be confirmed by multiple nodes before being stored to prevent traditional audit logs from being tampered with or deleted. They also support real-time synchronization with regulatory agencies to meet the traceability and verifiability requirements of financial regulation.

[0077] By intercepting all database read and write requests, pre-emptive control over data operations is achieved, preventing requests from bypassing security mechanisms to directly access the database.

[0078] By using pre-defined financial data characteristic rules, the sensitivity level of the data to be written is identified, providing a basis for subsequent differentiated encryption and control. At the same time, the writing context information is recorded to retain original evidence for subsequent auditing and traceability.

[0079] An improved algorithm is used to split the complete quantum key into multiple fragments and distribute them to different roles. The original key is destroyed immediately after the fragments are generated, ensuring that no single role or node can obtain the complete key, thus eliminating the risk of single-point key leakage from the source. The key fragments are distributed to a dedicated storage medium, further reducing the probability of the fragments being illegally obtained.

[0080] The data encryption key (DEK) directly encrypts plaintext data, while quantum key encryption of the DEK utilizes the high security of quantum keys to protect the core key (DEK), and avoids the efficiency loss caused by directly encrypting large amounts of data with quantum keys through the DEK.

[0081] The storage unit contains a unique identifier, metadata, encrypted packets, and access control logic, ensuring that data carries its own security control rules regardless of where it is stored, preventing data from being compromised once it leaves the control scope; at the same time, key fragments are stored separately from data, which complies with the security principle that keys should not be stored with data.

[0082] Single authentication methods (such as account and password only) are easily cracked or impersonated, while hardware devices (such as dedicated USB tokens) and biometrics (such as fingerprints) are unique and cannot be copied. Combining the three can significantly reduce the risk of identity forgery and ensure that visitors are legitimate authorized personnel.

[0083] Normal visitors exhibit regular behavior, such as fixed IP address, operation during working hours, and stable query volume. By extracting five types of features—location, time, data volume, permissions, and frequency—and comparing them with historical baselines to calculate deviations, a risk score is obtained by weighting these features together.

[0084] Low-risk (behavior conforms to baseline) access is decrypted directly to ensure efficiency; medium-risk (behavior has slight deviation) access requires secondary authorization to avoid unauthorized or abnormal access; high-risk access is blocked, achieving dynamic security control of reading behavior.

[0085] In Example 2, in step 1, the quantum encryption network includes a core financial transaction node, a disaster recovery node, and a regulatory docking node. A quantum transmission enhancement module is configured to control cross-node transmission latency. The backup key pool pre-generates backup keys based on the post-quantum encryption algorithm for switching when the quantum encryption network is abnormal.

[0086] By adopting the above technical solution, the core transaction node is the data processing core for daily fund transactions and account operations; the disaster recovery node undertakes the emergency recovery function in case of business interruption; and the regulatory docking node is responsible for synchronizing security audit information with regulatory agencies. These three are the core flow links of financial data from generation and backup to regulatory verification. Incorporating these three types of nodes into the quantum encryption network ensures that the keys required for financial data encryption are transmitted through quantum encryption throughout the entire chain of transaction-backup-regulation, avoiding the risks of eavesdropping and tampering that may occur in traditional key transmission, and ensuring data security from the source of the keys.

[0087] Financial transactions have extremely high real-time requirements. For example, large transfers and payment settlements require millisecond-level responses. If the quantum key transmission latency is too high, it will directly affect the efficiency of business processing. The quantum transmission enhancement module controls the cross-node key transmission latency by optimizing the quantum signal transmission link, such as reducing signal attenuation, optimizing the processing logic of relay nodes, and improving the sensitivity of quantum signal reception. This ensures that the key transmission latency between the core transaction node and the local disaster recovery node and the remote disaster recovery node meets the time requirements of real-time financial transactions, avoiding the slowdown of business processes due to encryption, and achieving a balance between high security and high real-time performance.

[0088] Quantum encryption networks may experience transmission interruptions due to physical link failures, external electromagnetic interference, or other factors. If no backup key is available at this time, financial transactions cannot be encrypted, directly disrupting business operations. By pre-generating backup keys based on post-quantum encryption algorithms, leveraging the algorithm's resistance to future quantum computing attacks, the long-term security of backup keys is ensured. The pre-generation design avoids the time-consuming process of temporary key generation. When the quantum encryption network malfunctions, the backup key pool can immediately provide available keys to the database security agent and key management center, achieving seamless key supply switching and ensuring uninterrupted encryption services for financial transactions, meeting the continuity requirements of zero-interruption financial operations.

[0089] Example 3, in step 2, the data hierarchical management mechanism classifies financial data into high-sensitivity data, medium-sensitivity data, and low-sensitivity data according to their sensitivity.

[0090] Highly sensitive data includes account passwords, bank card CVV codes, and transfer information for single transactions of 500,000 yuan or more;

[0091] High-sensitivity data is bound to quantum encryption and advanced encryption standard 256-bit encryption strategy, and access is limited to risk control roles in financial institutions, with a statutory retention period of 5 years or more;

[0092] Zhongmin Data includes transaction records for the past year and non-public contact information for clients. It is bound to a quantum encryption and AES-256 encryption strategy, and allows access by risk control and compliance roles. The statutory retention period is greater than or equal to 5 years.

[0093] Low-sensitivity data includes the customer's publicly disclosed name, the name of the branch where the account was opened, and the name of the financial product. After binding, it is encrypted with quantum encryption and AES-128 encryption strategies, allowing access to all authorized financial institution employees, and the statutory retention period is greater than or equal to one year.

[0094] The key management center integrates a multi-role key collaboration mechanism, configuring key fragment allocation rules for at least three roles.

[0095] By adopting the above technical solution, the data classification management principle is as follows: based on the risk of financial data leakage and usage needs, data is divided into three categories: high, medium, and low sensitivity. High-sensitivity data carries the highest risk and is subject to the most stringent protection.

[0096] Quantum encryption and AES-256, access restricted to risk control only, long-term retention;

[0097] Medium-sensitivity data carries the next lowest risk and offers slightly more lenient protection; it shares the same encryption and retention as high-sensitivity data and allows access for both risk control and compliance purposes; low-sensitivity data carries the lowest risk and offers moderate protection.

[0098] Post-quantum encryption and AES-128, authorized employee access, and short-term retention achieve a balance between security and efficiency.

[0099] The multi-role collaboration mechanism breaks down the key into fragments and distributes them to at least three roles. Multiple roles must cooperate to use the key, which avoids leakage caused by a single role controlling the complete key and strengthens security from the key management level.

[0100] In Example 4, in step 3, the security agent supports encrypted communication with the key management center and memory protection of sensitive data. The trusted audit center is built on a distributed consensus architecture and achieves real-time synchronization of audit information with financial regulatory agencies.

[0101] By adopting the above technical solutions, the secure agent and the key management center communicate encrypted to prevent the key application and key information transmitted between the two from being eavesdropped on or tampered with, thus safeguarding the security of the key transfer link. Memory protection is implemented for sensitive data because sensitive data is in plaintext after decryption, and memory protection can prevent the plaintext from being illegally read or stored, ensuring that the data is not leaked during use.

[0102] Built on a distributed consensus architecture, the system ensures the validity of audit information by having multiple nodes jointly confirm it, preventing a single node from tampering with logs and guaranteeing the authenticity and immutability of audit information. Real-time synchronization of audit information with financial regulatory agencies is designed to meet the compliance requirements of financial regulators for traceable and verifiable data operations, allowing regulatory agencies to keep abreast of database operation dynamics and ensure that control complies with regulatory standards.

[0103] Example 5: In step 5, the multi-role key collaboration mechanism uses an improved Shamir secret sharing algorithm to generate key fragments, specifically including the following sub-steps:

[0104] Step 51: Construct a polynomial based on the finite field GF(p). The polynomial uses the quantum key as a constant term and is supplemented with three randomly generated secret coefficients. These coefficients are multiplied by the first, second, and third powers of the key fragment index, respectively. The result is then modulo the large prime number p, which is not less than 2 to the power of 256. The index values ​​are 1 to 4, corresponding to the four roles of operation and maintenance, risk control, compliance, and supervision.

[0105] Step 52: Substitute the index values ​​of the four roles into the polynomial to calculate four sets of key fragments, encrypt them respectively, and store them in the USBKey dedicated storage medium of the corresponding role.

[0106] Step 53: After the key fragment is generated, immediately delete the original quantum key and three secret coefficients stored in the key management center.

[0107] By adopting the above technical solution, the quantum key is split into mathematical polynomials based on finite fields. The quantum key is used as a constant term, and a polynomial is constructed by combining random coefficients and role indexes. The security of the split is ensured by modulo operation, so that the key cannot be recovered by relying on only partial fragments.

[0108] Substituting the four character indices into a polynomial yields the corresponding fragments, which are then encrypted and stored in a dedicated USB key for each character. This achieves physical isolation of the key fragments and binding them to the characters, avoiding the risks associated with centralized storage.

[0109] The original quantum key and random coefficients are deleted immediately after the fragment is generated to ensure that no complete key remains, thereby eliminating the possibility of single-point leakage from the root and strengthening the security of key management.

[0110] Example 6, the process of hybrid encryption mechanism in step 6 includes the following sub-steps:

[0111] Step 61: Using AES-256 Galois with the data encryption key as the encryption key and the plaintext data as the encryption object, a 12-bit random initialization vector and additional authentication data containing data field identifiers and write times are introduced to obtain the first ciphertext after encryption.

[0112] Step 62: Using the AES-256 electronic codebook mode, with the quantum key as the encryption key and the data encryption key as the encryption object, the second ciphertext is obtained by taking the modulo of the result.

[0113] Step 63: Using the elliptic curve digital signature algorithm secp256r1 curve, with the authorized key registered with the financial regulatory agency as the signature key, calculate the SHA-256 hash value of the content concatenated from the first ciphertext and the second ciphertext, and then sign the hash value to obtain the digital signature.

[0114] Step 64: Concatenate the first ciphertext, the second ciphertext, the digital signature, the initialization vector, and the additional authentication data in a fixed order, and distinguish each part by field separators to form the final ciphertext package.

[0115] By adopting the above technical solution, the plaintext is first encrypted with the data encryption key to obtain the first ciphertext, and an initialization vector is introduced to prevent replay and additional authentication data is added to ensure integrity; then the data encryption key is encrypted with the quantum key to obtain the second ciphertext, and the core key is protected by the high security of the quantum key, so as to achieve layered protection of "data encryption key protects data, and quantum key protects data encryption key", which takes into account both security and efficiency.

[0116] The encrypted content is signed using a regulatory-authorized key, and hash and signature verification are used to ensure that the encrypted content has not been tampered with and that its source is compliant. Finally, the parts are assembled and separated in a fixed order to provide a basis for accurately parsing each component during subsequent decryption, ensuring a smooth encryption and decryption process.

[0117] Example 7, the calculation process of the risk score in step 9 is as follows:

[0118] First, calculate the location deviation characteristic value A, time deviation characteristic value B, data volume deviation characteristic value C, access control deviation characteristic value D, and frequency deviation characteristic value E respectively; then calculate the risk score S according to the weights, using the following formula:

[0119] ;

[0120] in and The weights are respectively the positional deviation feature value A, time deviation feature value B, data volume deviation feature value C, permission deviation feature value D, and frequency deviation feature value E.

[0121] Example 8: The location deviation feature is calculated by dividing the geographical distance between the access IP and the historically frequently used IP by 1000;

[0122] If the access time is not within the 9:00-18:00 financial working hours, take 1; otherwise, take 0 to obtain the time deviation feature.

[0123] The data volume deviation characteristic is obtained by subtracting the historical average number of queries from the current query count and then dividing by the historical average number of queries in the past hour. If the result is negative, it is taken as 0.

[0124] The permission deviation feature is obtained by setting 1 when the visitor does not have the corresponding data level permission and 0 otherwise.

[0125] The frequency deviation characteristic is obtained by subtracting the historical average number of queries from the number of queries in one hour and then dividing by the historical average number of queries in one hour. When the result is negative, it is taken as 0.

[0126] Example 9: If S < 0.2, it is judged as low risk; if 0.2 ≤ S < 0.5, it is judged as medium risk; and if S ≥ 0.5, it is judged as high risk.

[0127] By adopting the above technical solutions, location deviation reflects whether the accessing IP deviates from the commonly used area, time deviation determines whether the operation is performed during non-working hours, data volume deviation measures whether the query volume exceeds the norm, permission deviation checks whether unauthorized access is performed, and frequency deviation monitors whether the query frequency is abnormal. Through specific calculations, behavioral differences are transformed into quantifiable feature values.

[0128] Weights are assigned based on the degree of impact of different features on risk. The total risk score is obtained by superimposing the five types of feature values ​​according to their weights. The weight design reflects the priority of features, so that features with high risk contribution (such as permission deviation and location deviation) have a greater impact on the score, thus accurately quantifying the overall risk level.

[0129] Clear scoring thresholds are set to classify low, medium, and high risks: low scores correspond to behaviors that are in line with the norm and are judged as low risk; medium scores indicate minor anomalies and are classified as medium risk; high scores mean a high degree of anomaly and are classified as high risk. Different control measures are matched to different levels to achieve dynamic protection of "the higher the risk, the stricter the control".

[0130] Example 10: A financial-grade database multi-dimensional security management system, used to implement a financial-grade database multi-dimensional security management method. The system includes a quantum encryption network component, a data hierarchical management component, a multi-factor key management hub, a database security proxy component, and a multi-dimensional risk control engine component.

[0131] The quantum encryption network component is used to build a quantum key transmission system between core financial transaction nodes, local disaster recovery nodes, remote disaster recovery nodes and regulatory docking nodes, and is configured with quantum relay and fault tolerance modules and a post-quantum backup key pool.

[0132] The data classification management component establishes a data connection with the database security agent component to classify data according to its sensitivity and bind differentiated security policies to different levels of data. The security policies include encryption algorithm standards, access role permission scope, and statutory retention periods required by financial regulatory requirements.

[0133] The multi-factor key management center establishes encrypted communication connections with the quantum encryption network component and the database security agent component respectively, and integrates a multi-role key splitting module and a key recovery module;

[0134] The database security proxy component is deployed on the financial database engine side and establishes signal transmission connections with the data classification management component, the multi-factor key management hub, and the multi-dimensional risk control engine component, respectively. It is used to intercept database read and write requests, call the data classification management component to determine the data level, perform data encryption and decryption operations, and implement memory security control for highly sensitive plaintext data.

[0135] The multi-dimensional risk control engine component establishes a real-time communication connection with the database security agent component to collect visitor behavioral characteristics, calculate risk scores and determine risk levels based on the visitor's historical behavior baseline, and output differentiated authorization instructions to the database security agent component.

[0136] By adopting the above technical solutions, the quantum encryption network component uses quantum key distribution technology to construct cross-node key transmission links, covering financial core transaction nodes, local disaster recovery nodes, remote disaster recovery nodes, and regulatory docking nodes. The quantum relay module uses phase modulation quantum relay technology, supporting single-hop transmission distances of ≥50 kilometers and relay forwarding latency of ≤5 milliseconds. It can be cascaded to achieve cross-regional key transmission of ≥1000 kilometers. The fault-tolerance module integrates quantum error detection and correction algorithms to monitor quantum state disturbances during key transmission in real time, automatically triggering a retransmission mechanism when the error rate exceeds 0.1%. The post-quantum backup key pool pre-generates ≥100,000 sets of 256-bit keys based on the CRYSTALS-Kyber algorithm, adopts a distributed storage architecture, and the primary and backup nodes are updated synchronously. In the event of a quantum network interruption, a preset trigger mechanism can be used to switch to the backup key supply within 300 milliseconds.

[0137] The data tiering management component incorporates a financial data feature recognition engine, automatically tiering data through field name rules and data content pattern matching. High-sensitivity data recognition rules include fields containing password identifiers, bank card CVV fields, and single transaction amounts with values ​​≥ 500,000 RMB; medium-sensitivity data recognition rules include transaction record timestamps within the last 365 days containing non-publicly identified contact information fields; low-sensitivity data recognition rules include publicly identified name, branch name, and product name fields. Security policy storage utilizes an encrypted database, binding encryption algorithm parameters to access role lists and retention period thresholds according to tier. It supports importing policy templates and custom adjustments; policy changes require approval from compliance roles and synchronization with the audit center.

[0138] The multi-factor key management hub is deployed in a cluster, with primary and backup nodes synchronizing data via the Raft protocol, achieving a switchover latency of ≤100 milliseconds. The multi-role key splitting module, based on an improved Shamir secret sharing algorithm, constructs a cubic polynomial in the finite field GF(p) (p = 2^256 + 2^33) to split the quantum key into four fragments, each corresponding to an operational, risk control, compliance, or regulatory role. The key recovery module collects at least three fragments and restores the key using the Lagrange interpolation algorithm. The entire recovery process is completed in memory, and temporary data is immediately cleared upon completion. Communication with other components uses the SSL-TLS 1.3 protocol, and key negotiation employs the ECDHE-ECDSA-AES256-GCM-SHA384 suite to ensure encrypted and tamper-proof transmitted content.

[0139] The database security proxy component is embedded in the database engine kernel as a plug-in, supporting mainstream relational and distributed databases. The interception layer is deployed during the SQL parsing phase, capturing all DMLDQL operations. The encryption / decryption module integrates AES-256-GCMAES-256-ECB algorithms, supports hardware acceleration, and achieves an encryption throughput of ≥100MB / s. High-sensitivity data memory protection employs Intel SGX technology, processing plaintext in a trusted execution environment and clearing it via memory erase commands after the session ends, preventing memory dump leaks. Signal transmission with other components uses a dedicated communication protocol; data includes checksums and timestamps, automatically retransmitting if there is no response after timeout, and triggering an alarm after three failed retransmissions.

[0140] The multi-dimensional risk control engine component collects access behavior characteristics in real time, with a sampling frequency of once per second. These characteristics include access IP address, latitude and longitude, terminal hardware fingerprint, operation timestamp, query statement hash value, etc. A historical behavior baseline is constructed using a sliding window algorithm with a window size of 7 days, and baseline parameters are dynamically updated. The risk scoring model employs a weighted summation algorithm, with a weight of 0.3 for location deviation, 0.2 for time deviation, 0.2 for data volume deviation, 0.2 for permission deviation, and 0.1 for frequency deviation. Offline training and weight adjustment are supported. After risk level determination, an authorization command is generated, using binary encoding and transmitted to the security agent via an encrypted channel. The command validity period is ≤30 seconds, automatically expiring upon timeout.

[0141] The following specific embodiments illustrate the implementation principle of the present invention:

[0142] The bank deploys core financial transaction nodes in its head office data center, disaster recovery nodes in another location within the same city, and remote disaster recovery nodes in branches in other locations. It also establishes a regulatory interface node connecting to the State Financial Regulatory Commission system. The quantum encryption network employs phase-modulated quantum relay technology. The single-hop transmission distance between the core node and the disaster recovery node within the same city is 45 kilometers, with a relay latency of 4 milliseconds. With the remote disaster recovery node, a three-level relay cascade extends the total transmission distance to 1200 kilometers, with a latency of 18 milliseconds. The fault-tolerance module monitors the quantum state in real time and automatically retransmits when the bit error rate exceeds 0.1%. The backup key pool pre-generates 150,000 sets of 256-bit keys based on the CRYSTALS-Kyber algorithm, using a primary and backup dual-node storage system that is synchronously updated. In the event of a quantum network outage, the key pool switches over within 300 milliseconds.

[0143] The data classification and key management center initializes the data classification management component with built-in feature recognition rules: transfer records containing the "CVV" field and with a single amount ≥ 500,000 yuan are marked as high-sensitivity data; transaction records from the past 365 days and data containing the "non-public mobile phone number" field are marked as medium-sensitivity data; data containing fields such as "public name", "XX branch", and "wealth management product A" are marked as low-sensitivity data.

[0144] The security policy is as follows: High-sensitivity data uses quantum encryption + AES-256, accessible only to employees of the risk control department, and will be retained for 5 years; Medium-sensitivity data uses quantum encryption and AES-256, accessible to the risk control and compliance department, and will be retained for 5 years; Low-sensitivity data uses post-quantum encryption and AES-128, accessible to all authorized employees, and will be retained for 1 year.

[0145] The key management hub uses a 3-node cluster (primary + backup + disaster recovery), synchronizing data via the Raft protocol with a switchover latency of 80 milliseconds. Key fragmentation allocation rules are configured for four roles: operations and maintenance, risk control, compliance, and supervision, using a finite-domain GF(2) key distribution method. 256 Construct a cubic polynomial (+233).

[0146] The database transformation and audit center construction involved modifying the bank's core Oracle database engine and embedding a security agent plugin to intercept all DML and DQL operations.

[0147] The security agent integrates AES-256-GCM and AES-256-ECB algorithms, achieving an encryption throughput of 120MB / s. It uses IntelSGX technology to protect highly sensitive plaintext data, and the memory is automatically cleared after the session ends.

[0148] The Trusted Audit Hub is a consortium blockchain built on the PBFT consensus architecture. The nodes include the head office core node, the same-city disaster recovery node, the off-site disaster recovery node, and the State Financial Supervision and Administration Bureau node. Audit logs need to be confirmed by the three nodes before they are stored and are synchronized to the State Financial Supervision and Administration Bureau system in real time through a dedicated encrypted link.

[0149] Data classification and key application:

[0150] A customer initiated a 600,000 yuan transfer via mobile banking. The financial application sent a write request to the database. The security agent intercepted the request and invoked the data hierarchical management component to identify it as high-sensitivity data containing the fields "single transaction amount 600,000 yuan" and "bank card CVV code." The write context was recorded (time 10:05, initiating IP is the customer's frequently used mobile IP, and the operator is the system's automated transaction). The security agent initiated a key request to the key management center. The center obtained the quantum key from the core node through a quantum encryption network and generated four sets of key fragments based on an improved Shamir algorithm. The quantum key was used as a constant term, and a polynomial was constructed by combining it with three random secret coefficients. Substituting indices 1 (Operations and Maintenance), 2 (Risk Control), 3 (Compliance), and 4 (Regulation), four sets of fragments were calculated. After encryption, these fragments were stored in the Operations and Maintenance Department's dedicated USBKey, the Risk Control Department's encryption server, the Compliance Department's hardware encryption machine, and the State Financial Supervision and Administration Bureau's regulatory equipment, respectively. The original quantum key and secret coefficients were then deleted.

[0151] Hybrid encryption and storage security agent initiate hybrid encryption: First, the plaintext transfer is encrypted using a randomly generated data encryption key (DEK) in AES-256-GCM mode, incorporating a 12-bit initialization vector (0x1a3b5c7d9e0f) and additional authentication data (field identifier "transfer record", write time "XXXX-XX-XXXX:XX") to obtain the first ciphertext; then, the DEK is encrypted using a quantum key in AES-256-ECB mode, and the modulo operation yields the second ciphertext; next, the SHA-256 hash value of the concatenated content of the two ciphertexts is calculated using the authorized key registered with the State Financial Supervision and Administration Bureau (based on the secp256r1 curve), and a digital signature is obtained. Finally, the ciphertext is concatenated into a ciphertext package in the format "first ciphertext|second ciphertext|digital signature|initialization vector|additional authentication data", and encapsulated with a unique identifier (transfer serial number), metadata (high sensitivity level), and access control logic (decryptable only by risk control roles) into a secure data storage unit, which is then written to the database.

[0152] Multi-factor authentication and behavior data collection:

[0153] Risk control department employee XX needs to query the 600,000 yuan transfer record. First, multi-factor authentication is completed by using the account password ("wang001 + password"), inserting a dedicated U-shield (hardware device), and recording fingerprint (biometric feature).

[0154] The security agent intercepted the query request and extracted the following behavioral information: the access IP was the head office network IP (which is the same as XX's commonly used IP), the time was 14:30 (within the working hours of 9:00-18:00), the number of queries was 1, the permissions matched (risk control role), and the number of queries within 1 hour was 2.

[0155] The risk assessment and authorization risk assessment module calculates the following characteristic values: location deviation A=0 (IP consistent), time deviation B=0 (working hours), data volume deviation C=(1-1) / 1=0 (an average of 1 query per hour in history), permission deviation D=0 (permission granted), and frequency deviation E=(2-1) / 1=1 (an average of 1 query per hour in history). The risk score S=0×0.3+0×0.2+0×0.2+0×0.2+1×0.1=0.1 is calculated using weights (A:0.3, B:0.2, C:0.2, D:0.2, E:0.1). This score is determined to be low risk, and a direct decryption command is output.

[0156] The security agent calls the multi-factor key management center to collect key fragments from the operation and maintenance, risk control, and compliance roles (fragments for the regulatory role are not enabled), recovers the quantum key through the Lagrange interpolation algorithm, decrypts it to obtain the DEK, and then uses the DEK to decrypt the first ciphertext. After verifying the digital signature, the plaintext is returned to XX, and the plaintext data in memory is cleared immediately after the session ends.

[0157] Throughout the process, the trusted audit center records all written and queried operation logs in real time, stores them after consensus among the consortium blockchain nodes, and synchronizes them with the State Financial Regulatory Commission, achieving end-to-end security and controllability as well as regulatory compliance.

[0158] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A multi-dimensional security control method for financial-grade databases, characterized in that: The method comprises the following steps: Step 1: deploying a quantum encryption network and a backup key pool; Step 2: initializing a data classification management mechanism and a key management hub; Step 3: modifying a database engine and building a trusted audit hub, and deploying a security agent on a database node; Step 4: the security agent intercepts a write request of a financial application, calls the data classification management mechanism to identify the sensitivity of the to-be-written data, determines the data level and records the write context information; Step 5: the security agent initiates a key application to the key management hub, the key management hub obtains a quantum key through the quantum encryption network, generates key fragments corresponding to the roles based on a multi-role key cooperation mechanism, and destroys the original quantum key after generation; Step 6: the plaintext data is processed by using a hybrid encryption mechanism to obtain a final ciphertext package; Step 7: the security agent encapsulates a secure data storage unit containing a unique identifier, metadata, a final ciphertext package and access control logic based on the security policy of the data level, and writes it into the database, and distributes the key fragments to the corresponding role-specific storage carriers; Step 8: after the visitor is authenticated through multi-factor authentication of an account password, a hardware device and a biological feature, the security agent intercepts a query request, extracts the visitor behavior information and synchronizes it to a risk assessment module; Step 9: the risk assessment module extracts the risk features of the access behavior, calculates a risk score according to a preset weight, determines the low, medium and high risk levels according to the score, and performs direct decryption, secondary authorization decryption or request blocking accordingly; The multi-role key cooperation mechanism in step 5 generates key fragments by using an improved Shamir secret sharing algorithm, which comprises the following sub-steps: Step 51: a polynomial is constructed based on a finite field GF(p), the polynomial takes the quantum key as a constant term, is supplemented by three randomly generated secret coefficients, is multiplied by the first power, the second power and the third power of the index of the key fragment respectively, and is then taken modulo a large prime number p which is not less than 2 to the power of 256, the index value is 1 to 4, and the four roles correspond to operation and maintenance, risk control, compliance and supervision; Step 52: the index values of the four roles are substituted into the polynomial to calculate four groups of key fragments, which are encrypted and stored in the USBKey special storage carriers of the corresponding roles; Step 53: after the key fragments are generated, the original quantum key and the three secret coefficients stored in the key management hub are immediately deleted.

2. The financial-grade database multi-dimensional security management method of claim 1, wherein: In step 1, the quantum encryption network includes financial core transaction nodes, backup nodes and supervision interface nodes, a quantum transmission enhancement module is configured to control the transmission delay between nodes, and a backup key pool is pre-generated based on a post-quantum encryption algorithm to be used for switching when the quantum encryption network is abnormal.

3. The financial-grade database multi-dimensional security management method of claim 2, wherein: In step 2, the data classification management mechanism divides the financial data into high-sensitivity data, medium-sensitivity data and low-sensitivity data according to the sensitivity of the financial data; The high-sensitivity data includes account passwords, bank card CVV codes and transfer information with a single amount greater than or equal to 500,000 yuan; The high-sensitivity data is bound to quantum encryption and AES 256 encryption strategy, and is only accessible to financial institution risk control roles, and the legal retention period is greater than or equal to 5 years; The medium-sensitive data includes transaction records in the past year, customer non-public contact information, encryption strategy binding quantum encryption and AES-256, allows risk control roles and compliance roles to access, and the legal retention period is greater than or equal to 5 years; The low-sensitive data includes customer public name, opening bank name, financial product name, encryption strategy binding quantum encryption and AES-128, allows all authorized financial institution employees to access, and the legal retention period is greater than or equal to 1 year; The key management hub integrates a multi-role key coordination mechanism, and configures key fragment allocation rules of at least three roles.

4. The financial-grade database multi-dimensional security management and control method of claim 3, wherein: In step 3, the security agent supports encrypted communication with the key management hub and sensitive data memory protection, and the trusted audit hub is built based on a distributed consensus architecture, and realizes real-time synchronization of audit information with the financial regulatory authority.

5. The financial-grade database multi-dimensional security management and control method of claim 4, wherein: The process of the hybrid encryption mechanism in step 6 includes the following sub-steps: In step 61, AES-256 Galois is used as the encryption key, plaintext data is used as the encryption object, a 12-bit random initialization vector and additional authentication data containing data field identification and writing time are introduced, and the first ciphertext is obtained after encryption; In step 62, AES-256 electronic cipher block mode is used, quantum key is used as the encryption key, and data encryption key is used as the encryption object, and the second ciphertext is obtained by taking the modulus of the result; In step 63, the elliptic curve digital signature algorithm secp256r1 curve is used, and the authorized key recorded by the financial regulatory authority is used as the signature key, the SHA-256 hash value of the content obtained by splicing the first ciphertext and the second ciphertext is calculated, and the digital signature is obtained by signing the hash value; In step 64, the first ciphertext, the second ciphertext, the digital signature, the initialization vector and the additional authentication data are spliced in a fixed order, and the final ciphertext package is formed by distinguishing each part through the field separator.

6. The financial-grade database multi-dimensional security management and control method of claim 5, wherein: The calculation process of the risk score in step 9 is as follows: First, calculate the position deviation characteristic value A, the time deviation characteristic value B, the data volume deviation characteristic value C, the permission deviation characteristic value D and the frequency deviation characteristic value E respectively; calculate the risk score S according to the weight, and the calculation formula is: ； wherein and are weights of the positional deviation characteristic value A, the temporal deviation characteristic value B, the data amount deviation characteristic value C, the authority deviation characteristic value D, and the frequency deviation characteristic value E, respectively.

7. The financial-grade database multi-dimensional security management method of claim 6, wherein: The position deviation characteristic is calculated by dividing the geographical distance between the access IP and the historical commonly used IP by 1000; If the access time is not in the financial working hours of 9:00-18:00, take 1, otherwise take 0 to get the time deviation characteristic; The data volume deviation characteristic is obtained by subtracting the historical 1-hour average query number from the current query number and dividing by the historical 1-hour average query number, and taking 0 when the result is negative; The permission deviation characteristic is obtained by taking 1 when the visitor has no corresponding data level permission, otherwise taking 0; The frequency deviation characteristic is obtained by subtracting the historical 1-hour average query number from the query number in 1 hour and dividing by the historical 1-hour average query number, and taking 0 when the result is negative.

8. The financial-grade database multi-dimensional security management method of claim 7, wherein: If S<0.2, it is determined as low risk, 0.2≤S<0.5 is determined as medium risk, and S≥0.5 is determined as high risk.

9. A financial-grade database multidimensional security management and control system, characterized in that: A financial-level database multi-dimensional security management method is used to realize the claim 8, and the system includes a quantum encryption network component, a data hierarchical management component, a multi-factor key management hub, a database security agent component and a multi-dimensional risk control engine component; The quantum encryption network component is used to build a quantum key transmission system among a financial core transaction node, a city disaster recovery node, a remote disaster recovery node, and a regulatory interface node, and is configured with a quantum relay and a fault tolerance module and a post-quantum backup key pool. The data hierarchical management component and the database security agent component establish a data connection, which is used to divide according to the sensitivity of financial data and bind different security strategies for different levels of data, including encryption algorithm standards, access role permission ranges, and legal retention periods required by financial regulations. The multi-factor key management hub establishes an encrypted communication connection with the quantum encryption network component and the database security agent component, and integrates a multi-role key splitting module and a key recovery module. The database security agent component is deployed on the financial database engine side and establishes a signal transmission connection with the data hierarchical management component, the multi-factor key management hub, and the multi-dimensional risk control engine component. It is used to intercept read and write requests of the database, determine the data level by calling the data hierarchical management component, perform data encryption and decryption operations, and implement in-memory security control for high-sensitive data in plaintext. The multi-dimensional risk control engine component establishes a real-time communication connection with the database security agent component, which is used to collect the behavior characteristics of visitors, calculate risk scores based on the historical behavior baseline of visitors, determine risk levels, and output differentiated authorization instructions to the database security agent component.

Images