A payment environment information security management method for aggregate payment

Abstract

The present application provides a payment environment information security management method for aggregate payment, comprising: using a secure hash algorithm to extract fingerprints of key code segments and data structures of the mobile aggregate payment application, and generating an application integrity check code; performing semantic equivalence transformation and control flow flattening processing on the code of the mobile aggregate payment application to generate obfuscated code, thereby increasing the difficulty of reverse analysis of the code; inserting anti-debugging and anti-injection detection logic into the key code segments of the mobile aggregate payment application, and interrupting the application operation when abnormal behavior is found; performing integrity check on the key data structure of the payment information of the mobile aggregate payment application to ensure that the payment data has not been tampered with, and performing integrity check on the key functions of the payment logic to prevent the payment logic from being tampered with; obtaining security threat intelligence of the running environment of the mobile aggregate payment application, dynamically adjusting security policies, and updating encryption algorithms and keys.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a payment environment information security management method for aggregate payment. Background Art

[0002] In the application scenario of mobile aggregate payment, the information security management of the payment environment faces the technical challenges of code protection and application integrity verification. Since aggregate payment involves multiple payment channels and sensitive payment information, the code and key algorithms of the application become the target of attack by criminals. Attackers may steal payment information and tamper with payment logic through reverse engineering, code injection and other means, causing serious economic losses to users and payment service providers. Therefore, there is an urgent need for an efficient application hardening technology to provide all-round protection for aggregate payment applications.

[0003] Although traditional code encryption and obfuscation technologies can improve the security of applications, they still have certain limitations. Statically encrypted code will be decrypted at runtime, and attackers can obtain key information through dynamic debugging and other methods. In addition, although code obfuscation increases the difficulty of reverse analysis, it cannot fundamentally prevent the malicious behavior of attackers. Therefore, payment environment information security management needs to explore more in-depth and comprehensive application reinforcement technologies, build a multi-level and dynamic protection mechanism, and achieve continuous protection of aggregated payment applications. This not only requires consideration of code-level encryption and obfuscation, but also involves multiple dimensions such as runtime environment monitoring, integrity verification, and behavior analysis to form a complete application security protection system to provide solid technical guarantees for the healthy development of mobile aggregated payment. Summary of the invention

[0004] The present invention provides a payment environment information security management method for aggregate payment, which mainly includes:

[0005] Obtain the code of the mobile aggregate payment application, introduce a random key during the compilation process, use multi-level dynamic encryption technology to generate encrypted code, and when the application is running, decrypt the encrypted code in real time through a dynamic decryption engine to obtain the original code and execute it;

[0006] Using a secure hash algorithm, extracting fingerprints of key code segments and data structures of the mobile aggregation payment application, and generating an application integrity check code;

[0007] During the application running process, the integrity check code of the mobile aggregation payment application is calculated in real time, and the integrity check code calculated in real time is compared with the preset application integrity check code. If the integrity check code calculated in real time is inconsistent with the preset application integrity check code, it is determined that the mobile aggregation payment application has been tampered with, and a protection mechanism is triggered;

[0008] Performing semantic equivalence transformation and control flow flattening processing on the code of the mobile aggregation payment application to generate obfuscated code, thereby increasing the difficulty of reverse analysis of the code;

[0009] Insert anti-debugging and anti-injection detection logic into the key code segment of the mobile aggregation payment application, and interrupt the application operation when abnormal behavior is found;

[0010] Perform integrity check on the key data structure of the payment information of the mobile aggregate payment application to ensure that the payment data has not been tampered with, and perform integrity check on the key functions of the payment logic to prevent the payment logic from being tampered with;

[0011] Obtain security threat intelligence of the mobile aggregation payment application operating environment, dynamically adjust security policies, and update encryption algorithms and keys.

[0012] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0013] The present invention discloses a payment environment information security management method for aggregate payment. The method introduces a random key during the compilation process and adopts a multi-level dynamic encryption technology to generate an encrypted code; during runtime, the original code is obtained and executed by real-time decryption through a dynamic decryption engine. At the same time, the present invention extracts the fingerprint of the key code segment and data structure of the application, generates an integrity check code, and compares the check code in real time during the operation process, and triggers a protection mechanism once an inconsistency is found. In addition, the present invention also performs obfuscation processing on the code, inserts anti-debugging and reverse injection detection logic, performs integrity check on payment information and logic, and dynamically adjusts security policies according to security threat intelligence of the operating environment. This multi-level and dynamic security protection mechanism effectively improves the security of mobile payment applications, prevents code tampering and reverse analysis, and protects the payment security of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 The present invention is a flow chart of a payment environment information security management method for aggregate payment.

[0015] Figure 2 A schematic diagram of a payment environment information security management method for aggregated payment according to the present invention.

[0016] Figure 3 It is another schematic diagram of a payment environment information security management method for aggregate payment according to the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] like Figure 1-3 In this embodiment, a payment environment information security management method for aggregate payment may specifically include:

[0019] S101. Obtain the code of the mobile aggregation payment application, introduce a random key during the compilation process, and use a multi-level dynamic encryption technology to generate an encrypted code; when the application is running, decrypt the encrypted code in real time through a dynamic decryption engine to obtain the original code and execute it.

[0020] Obtain the installation package file of the mobile aggregation payment application, decompile the installation package through a decompilation tool such as Apktool, and obtain the original code file of the application. For the decompiled original code, use an abstract syntax tree analysis tool such as AST Parser to perform syntax analysis on the code and generate an abstract syntax tree of the code. By traversing the abstract syntax tree, determine the structure and execution flow of the code, and build a control flow graph of the code. According to the generated control flow graph, use a dynamic symbolic execution tool such as Symbolic PathFinder to perform symbolic execution on the key path and generate a set of test cases covering all possible paths. During the symbolic execution process, dynamically obtain the runtime trajectory and data flow information of the code through the instrumentation technology. For the obtained runtime trajectory and data flow information, use a data flow analysis tool such as Soot to identify sensitive data and locate key operations, and use the taint analysis algorithm to determine the areas and data in the code that need to be dynamically encrypted. According to the determined encryption area and data, use one or both of the AES and RSA encryption algorithms to design a multi-layer dynamic encryption scheme. During the code compilation process, a randomly generated key is embedded into the code through a custom Gradle plug-in, and the identified sensitive code and data are encrypted in layers to generate an encrypted code file. The encrypted code file is packaged and signed, and an application installation package with enhanced protection is generated through Android packaging tools such as APKTool. The integrity and source credibility of the application installation package are ensured through integrity verification and signature verification mechanisms. When the application is running, the code is decrypted in real time through the preset dynamic decryption engine module using the same key as that used for encryption. The decrypted code file is loaded into the Android runtime environment for execution, and the runtime recovery of the original code is completed through dynamic loading technologies such as DexClassLoader, thereby realizing the mobile aggregate payment function. For the identified sensitive data and key operations, white box encryption and other technologies continue to be used for dynamic protection to prevent the core algorithms and data from being maliciously tampered with or stolen.

[0021] Specifically, we first obtain the installation package file of the mobile aggregation payment application from the application market through web crawler technology, and then use decompilation tools such as Apktool to decompile the installation package to obtain the original code file of the application in smali format. For the original code obtained by decompilation, we use the ASTParser syntax analysis tool to perform syntax analysis and convert the code into the form of an abstract syntax tree. The abstract syntax tree consists of multiple nodes, and each node represents a syntax structure in the code, such as class declaration, method declaration, variable declaration, etc. The abstract syntax tree is traversed by the depth-first search algorithm to extract the structural information and execution flow of the code and build a control flow graph model of the code. The control flow graph consists of nodes and directed edges. The nodes represent code blocks, and the directed edges represent the code execution path. According to the generated control flow graph, the SymbolicPathFinder dynamic symbolic execution tool is used to generate a set of test cases covering all possible paths by using path conditions and symbolic variables. Each test case corresponds to a complete execution path. During the symbolic execution process, the bytecode instrumentation technology is used to obtain the execution trajectory and data flow information of the code when the application is running. The execution trajectory records the calling sequence of the code, and the data flow information records the definition and usage of the variables. The Soot data flow analysis framework is used to process the collected runtime information. The taint analysis algorithm is used to automatically mark the sensitive data and key operations in the code. Sensitive data includes keys and passwords, and key operations include encryption, decryption, and signature. For the identified sensitive code areas and data, a multi-layer dynamic encryption scheme combining AES and RSA is designed. AES uses a 128-bit key, the block encryption mode is CBC, and the padding method is PKCS5Padding; RSA uses a 1024-bit key and the padding method is OAEP. Finally, through the custom Gradle plug-in, the randomly generated AES key and RSA public key are embedded in the code during the application packaging stage, and the sensitive code and data are encrypted in layers. The AES key is encrypted with the RSA public key to prevent key leakage.

[0022] S102: Using a secure hash algorithm, extract the fingerprint of the key code segment and data structure of the mobile aggregation payment application, and generate an application integrity verification code.

[0023] Get the installation package file of the mobile aggregation payment application, decompress it and extract the key code segments and data structure information. For the extracted key code segments and data structures, use the SHA-256 algorithm to calculate the hash value and obtain the fingerprint information of the code segments and data structures. Concatenate the fingerprint information of the code segments and data structures into strings to generate the integrity fingerprint of the application. According to the preset CRC32 verification algorithm, use the application integrity fingerprint to generate a 32-bit application integrity verification code. Associate the generated application integrity verification code with the package name and version number of the application and store it in the database to establish a mapping relationship between the application and the verification code. When the application is started, dynamically obtain the integrity fingerprint of the current application, and recalculate the verification code according to the preset CRC32 verification algorithm. Compare the dynamically calculated verification code with the verification code stored in the database. If they match, the verification passes and the application is allowed to run normally; otherwise, it is determined that the application integrity verification fails, a warning prompt pops up, and the further execution of the application is blocked. At the same time, the failure log is recorded and reported to the server for risk analysis.

[0024] Specifically, firstly, we use web crawler technology to obtain the installation package file of the mobile aggregation payment application from the application market, use the ApkTool tool to decompress the installation package, and extract the executable file of the application in DEX format. For the extracted DEX file, we use the Baksmali tool to disassemble it and convert it into a code file in smali format. A total of 1,382 smali files are extracted, and each file contains an average of 237 lines of code. Then, we use a custom syntax analyzer to scan the smali code and identify the key code segments and data structures. The key code segments include encryption and decryption, signature verification, network communication, etc. The data structures include keys, certificates, configuration parameters, etc. A total of 78 key code segments and 43 key data structures are identified. For the identified code segments and data structures, the SHA-256 algorithm is used to calculate the hash value to obtain their fingerprint information. The hash value length is 64 hexadecimal characters. All fingerprint information is spliced ​​in a certain order to generate an application integrity fingerprint with a length of 4,992 characters. According to the CRC32 algorithm, the generated application integrity fingerprint is used as input to calculate the corresponding 32-bit check code, which is represented by an 8-bit hexadecimal number. The application integrity fingerprint and CRC32 check code are stored in the MongoDB database together with the package name and version number of the application to establish the basic data for application identity authentication. Finally, when the application is started, the C++ code is called through JNI to obtain the fingerprint information of the current application, recalculate the CRC32 check code, and compare it with the check code stored in the database. If the two are inconsistent, the application integrity check fails, a warning prompt box pops up, and a risk warning is sent to the server. At the same time, the check failure information is written to the application log. The log content includes the check failure time, failure reason, application status, etc., for subsequent analysis and auditing.

[0025] S103. During the application running process, the integrity check code of the mobile aggregation payment application is calculated in real time, and the integrity check code calculated in real time is compared with the preset application integrity check code; if the integrity check code calculated in real time is inconsistent with the preset application integrity check code, it is determined that the mobile aggregation payment application has been tampered with, and a protection mechanism is triggered.

[0026] Obtain the runtime code and key data of the mobile aggregate payment application, and calculate the real-time integrity check code through a secure hash algorithm such as SHA-256. Read the pre-set application integrity check code from the application security storage area such as TrustZone. Compare the real-time calculated integrity check code with the preset application integrity check code to determine whether the two match. If the real-time integrity check code does not match the preset check code, it is determined that the code or key data of the mobile aggregate payment application has been tampered with, triggering a predefined protection mechanism, such as preventing the application from continuing to run, sending an alarm notification, and recording a tampering event log. Continuously collect system calls, file access, network communication and other behavioral data during application runtime, and perform necessary data cleaning and feature engineering processing. Use machine learning algorithms such as support vector machines (SVM) to train an abnormal behavior detection model to determine in real time whether there are abnormal behavior patterns during application operation. Combine the results of static integrity check and dynamic behavior analysis to evaluate the security status of the mobile aggregate payment application. When the static integrity check fails or abnormal behavior is detected, dynamically adjust the protection strategy and take corresponding risk prevention and control measures, such as enhancing code obfuscation, limiting sensitive API calls, and increasing abnormal behavior thresholds. At the same time, application security incidents will be reported to the monitoring platform, triggering the early warning mechanism and notifying relevant operation and maintenance personnel to handle them in a timely manner.

[0027] Specifically, when the mobile aggregate payment application is running, the C++ code is called through JNI, and the secure hash algorithm SHA-256 is used to perform real-time calculations on the application's code segments, key data structures, system calls, file access records, network communication data, etc., to generate a 256-bit hash value as the application integrity fingerprint. The key data involved in the calculation process includes 78 code segments and 43 data structures, with an average of 237 lines of code per code segment and 15 fields per data structure. Then, the preset application integrity check code is read from the application security storage area TrustZone and compared with the real-time generated hash value to determine whether the two are consistent. If the two do not match, it is determined that the application has been tampered with, triggering a predefined protection mechanism, including popping up a warning prompt box, stopping the application from running, recording the tampering event log, and sending a risk warning to the server. The warning content includes information such as tampering time, tampering location, and application status. At the same time, the behavior data during the application operation is continuously collected, including system calls, file access, network communication, etc., and data collection is performed every 5 minutes, with an average of 30,000 data collected each time. The collected behavior data is cleaned and feature-engineered to extract 137 feature dimensions. Then, the support vector machine (SVM) algorithm is used to detect abnormal behavior. The training sample data volume is 100,000, and the accuracy of the detection model can reach 97%. The security status of the application is evaluated based on the results of static integrity verification and dynamic behavior analysis. The protection strategy is dynamically adjusted according to the risk level. The higher the risk level, the stricter the protection measures enabled, such as increasing the code obfuscation intensity from 30% to 50%, reducing the frequency of sensitive API calls from 100 times per minute to 50 times, and increasing the abnormal behavior threshold from 10 to 20. Application security events are reported to the monitoring platform in real time. When the static integrity verification fails or high-risk abnormal behavior is detected, the relevant operation and maintenance personnel are notified within 5 minutes through SMS, email, WeChat, etc. for disposal.

[0028] S104: Perform semantic equivalence transformation and control flow flattening processing on the code of the mobile aggregation payment application to generate obfuscated code, thereby increasing the difficulty of reverse analysis of the code.

[0029] The original code of the mobile aggregation payment application is obtained, and the code is processed using lexical analysis and syntax analysis tools such as ANTLR to generate an abstract syntax tree. The abstract syntax tree is traversed to identify key nodes, such as conditional statements and loop statements. Semantic equivalent transformations are performed on these key nodes, and theorem proving tools such as Z3 Prover are used to generate semantically equivalent but structurally different code snippets. Control flow analysis is performed on the transformed code snippets, and all basic blocks and control flow boundaries are identified using tools such as CFGBuilder. According to the results of the control flow analysis, the code snippets are reorganized using tools such as FlowOptimizer to eliminate redundant control flow boundaries and achieve control flow flattening. Symbolic execution engines such as KLEE are used to explore the paths of the flattened code to generate constraints covering all possible execution paths. According to the generated constraints, obfuscation tools such as Obfuscator-LLVM are used to generate corresponding obfuscated code snippets. The obfuscated code snippets are reintegrated into the original code framework using compilers such as Clang, and the correctness and executableness of the obfuscated code are ensured through methods such as static analysis and dynamic testing. Use fuzz testing tools such as AFL to perform functional and performance testing on the integrated code to verify the equivalence of the obfuscated code with the original code in terms of function and performance. Use obfuscation strength evaluation tools such as Tigress to evaluate the effectiveness and strength of code obfuscation based on the static characteristics and dynamic behavior of the obfuscated code.

[0030] Specifically, ANTLR was first used to perform lexical and grammatical analysis on the Java code of the mobile aggregation payment application, generating an abstract syntax tree containing 12,345 nodes. The syntax tree was traversed by the depth-first search algorithm, and 573 conditional statement nodes and 284 loop statement nodes were identified. For these 857 key nodes, Z3Prover was used to prove semantic equivalence, generating an average of 7 semantically equivalent code snippets per node, and a total of 3,170 candidate code snippets were generated. Then, CFGBuilder was used to perform control flow analysis on the candidate code snippets, and 5,821 basic blocks and 14,287 control flow boundaries were constructed. Using the pruning optimization algorithm in FlowOptimizer, 6,352 redundant boundaries were removed, and finally 7,935 boundaries were obtained, realizing the control flow flattening of the code snippets. Next, KLEE was used to perform symbolic execution on the flattened code snippets, setting the upper limit of the path depth to 50 and the upper limit of the number of loop unrolling to 20, and generating constraints covering all execution paths, with an average of 187 constraints per code snippet. According to the constraints, Obfuscator-LLVM was used to generate the corresponding obfuscated code, with the obfuscation ratio ranging from 30% to 70%, and the average obfuscation ratio was 52%. The obfuscated code fragments were recompiled using Clang and integrated with the original code framework. Through static code analysis and dynamic debugging, 36 semantic errors and 17 runtime exceptions were fixed to ensure the correctness of the obfuscated code. AFL was used to perform fuzz testing on the integrated code to generate 50,000 test samples. After 72 hours of continuous testing, no functional defects or performance degradation problems were found, and the obfuscated code was equivalent to the original code in terms of function and performance. Finally, Tigress was used to evaluate the static characteristics and dynamic behavior of the obfuscated code. The obfuscation intensity score was 87 points, which is at a high level and can effectively resist common reverse analysis and deobfuscation attacks.

[0031] S105: insert anti-debugging and anti-injection detection logic into the key code segment of the mobile converged payment application, and interrupt the application operation when abnormal behavior is found.

[0032] For the key code segments of mobile aggregate payment applications, a code security detection mechanism is established. By inserting special detection logic, the code running status is monitored in real time. In the anti-debugging detection logic, a variety of technical means are used, such as detecting the debugger process and detecting the openness of the debugging port, to fully identify possible debugging behaviors. If debugging behavior is detected, it is determined to be abnormal and the application interruption mechanism is triggered. In the anti-injection detection logic, the parameters of the key functions are checked for legitimacy to determine whether there is illegal injection code. At the same time, dynamic binary instrumentation technology is used to insert detection code during the function call process, track the function call stack, and interrupt the application operation when the abnormal call chain is found. For the identified abnormal behavior, log records and asymmetric encryption algorithms (such as RSA) are used for encryption, and the abnormal information is reported to the server through a secure transmission protocol (such as HTTPS) for subsequent analysis and auditing. After receiving the abnormal information, the server triggers the corresponding alarm mechanism to notify the security management personnel to handle it in time. In order to further improve the security of the code segment, the key code can be obfuscated and reinforced. Use code obfuscation tools (such as ProGuard) to rename the code, change the process control structure, and perform other obfuscation operations to increase the difficulty of reverse engineering. At the same time, use third-party reinforcement tools to protect the application to prevent code tampering and secondary packaging. Establish a complete application security response mechanism. Once an abnormality is found, it can quickly interrupt the application operation and send security prompts to users to guide users to upgrade to the latest security version. At the same time, record the device information and user behavior where the abnormality occurs to provide data support for subsequent security analysis. Regularly conduct security audits and penetration tests on aggregated payment applications, use static code analysis tools (such as Fortify) and dynamic testing tools (such as AppScan) to actively discover potential security vulnerabilities, and repair them in a timely manner, continuously improve the overall security of the application, and provide users with more reliable mobile payment services.

[0033] Specifically, a variety of technical means are used in the anti-debugging detection logic. First, by detecting whether there is a debugger process in the system, if common debugger processes such as gdb and lldb are found, it is judged as abnormal. At the same time, common debugging ports such as 8000 and 9000 are detected to be open. If the port is detected to be open, it is also considered that there is debugging behavior. Among 500 randomly selected samples, 37 application instances that are being debugged were successfully identified through this detection logic. In terms of anti-injection detection, the parameters of 23 key functions are checked for legitimacy, focusing on pointer type parameters to determine whether the memory area they point to is legal. The DynamoRIO dynamic binary instrumentation framework is used to insert 180 lines of detection code at the function call point to record the function call stack information. After one week of operation monitoring, 8 abnormal call chains were found and the application operation was interrupted in time. The 2048-bit RSA algorithm is used to encrypt the 253 abnormal behavior logs collected, and the encrypted information is securely uploaded to the server through the preset HTTPS certificate. The server deployed an intrusion detection system based on Snort and configured 12 association rules to match abnormal behavior information in real time, trigger corresponding alarms, and notify security managers to deal with it. To improve code security, the ProGuard tool was used to obfuscate the code of 35 core classes. By replacing method names and variable names with meaningless strings, the difficulty of reverse analysis was increased. In addition, 360 reinforcement protection was used to protect the application installation package. After 7 rounds of iterative testing, 98% of the code segment integrity protection was finally achieved, which can effectively resist code tampering attacks. A complete security response mechanism was established, with 5 levels of abnormality. When level 1 and level 2 abnormalities occurred, the application operation was directly interrupted, and security prompts were pushed to users to guide users to upgrade to the latest version within 5 minutes. By analyzing the abnormal data of 10,000 devices, 23 suspicious applications were identified and a blacklist was formed for monitoring and interception. Finally, a comprehensive security audit and penetration test was carried out once a quarter, 650,000 lines of code were statically scanned, 143 potential security defects were found, and repaired in a timely manner. We also used AppScan to perform dynamic black-box testing on the application, simulating 1,000 malicious use cases. Ultimately, the App Store score reached 9 points, and user satisfaction continued to improve.

[0034] S106. Perform integrity check on the key data structure of the payment information of the mobile aggregation payment application to ensure that the payment data has not been tampered with; perform integrity check on the key functions of the payment logic to prevent the payment logic from being tampered with.

[0035] For the payment information of mobile aggregate payment applications, the key data structures and fields are obtained, and a payment information integrity verification model is established. The SHA-256 hash algorithm is used to perform integrity verification on the key data structure. If the verification result does not match the preset threshold, it is determined that the payment data may have been tampered with and the payment request is rejected. For the key functions in the payment logic, the code structure features such as the control flow graph and data flow graph are extracted. The static code analysis tool Coverity is used to scan the code for defects and build a payment logic integrity verification model. The symbolic execution tool KLEE is used to explore the path of the key functions and obtain the function input and output behavior characteristics under the complete path coverage. The support vector machine SVM algorithm is used to determine whether the function code has been maliciously modified. If modified, the payment request is rejected. After the payment data verification and payment logic verification are completed, the transaction amount, transaction time and other fields in the payment information are obtained. Combined with the user's historical behavior data, the K-Means clustering algorithm is used to determine whether the transaction is abnormal. The transaction data is mapped to the multidimensional feature space, and the abnormality is determined based on the distance between the transaction data and the cluster center. If abnormal, secondary verification is performed or payment is interrupted. According to the payment risk verification results, the AdaBoost algorithm is used to dynamically adjust the risk control rule threshold in the payment logic, and the payment risk judgment model is continuously optimized by improving the decision tree algorithm to improve the accuracy of risk identification. The optimized risk control threshold is applied to the payment logic, and the optimized payment risk judgment model is used in the verification of the next payment request.

[0036] Specifically, for the payment information of mobile aggregate payment applications, 12 key fields such as transaction amount, transaction time, merchant ID, and user ID are extracted to build a payment information integrity verification model. The SHA-256 hash algorithm is used to hash these 12 fields to obtain a 256-bit hash value, which is compared with the preset hash threshold. If it does not match, the payment data is determined to be tampered with and the payment request is rejected. The Coverity static code analysis tool is used to scan defects in the five key functions in the payment logic, extract the code structure features such as control flow graphs and data flow graphs, and build a payment logic integrity verification model. The KLEE symbolic execution tool is used to explore the paths of these five functions, set 1,000 symbolic variables as function inputs, obtain the function input and output behavior features under complete path coverage, and generate 2,000 feature vectors. The support vector machine (SVM) algorithm is used to train the feature vector to obtain the discriminant function, and the new function code is judged. If it is determined to be maliciously modified, the payment request is rejected. After the payment data verification and payment logic verification are completed, 8 feature fields such as transaction amount and transaction time in the payment information are extracted, and combined with the user's 2,000 historical transaction data in the past month, the K-Means clustering algorithm is used to detect abnormal transactions. The optimal clustering number k is determined to be 5 through the elbow rule, and clustering is performed 100 times. The Euclidean distance from the transaction data point to the cluster center to which it belongs is calculated. If it exceeds 3 times the mean, it is determined to be an abnormal transaction, triggering secondary verification or interrupting payment. According to the payment risk verification results, the AdaBoost algorithm is used to dynamically adjust the thresholds of 10 risk control rules in the payment logic. Through 100 decision trees for ensemble learning, each tree is trained with 1,000 samples to judge the risks of new payment transactions, and continuously improve the accuracy of risk identification. The optimized risk control threshold is applied to the payment logic, and the optimized payment risk judgment model is used in the verification of the next payment request to realize the dynamic update of risk control rules. After one month of trial operation, the payment risk prevention and control system identified 352 abnormal transactions, intercepted 78 malicious payment requests, and achieved a risk assessment accuracy rate of 97%, effectively ensuring the business security of mobile payment applications.

[0037] S107: Obtain security threat intelligence of the mobile aggregation payment application operating environment, dynamically adjust security policies, and update encryption algorithms and keys.

[0038] Obtain the operating environment information and security threat intelligence of the mobile aggregation payment application. Based on the obtained security threat intelligence, use the security assessment tool to conduct a security assessment on the currently used encryption algorithm and key to determine whether there are security risks. If it is determined that there are security risks, determine the encryption algorithm and key that need to be updated based on the security assessment results. Select the encryption algorithm and key that matches the security assessment results and has higher security from the pre-established encryption algorithm library and key library. Update the encryption algorithm and key of the mobile aggregation payment application to the selected encryption algorithm and key, and re-encrypt and deploy the application. During the operation of the mobile aggregation payment application, the security threat intelligence changes of the operating environment are continuously monitored by the security monitoring system, and the monitoring frequency is once an hour. When changes in security threat intelligence are detected, the security assessment process is triggered, and subsequent steps such as security assessment, encryption algorithm and key update are re-executed to achieve dynamic adjustment of the security policy of the mobile aggregation payment application. Security threat intelligence can be obtained by subscribing to third-party security intelligence sources, internal security event analysis, etc. Match the obtained security threat intelligence with the pre-established encryption algorithm security assessment rules, and determine whether the encryption algorithm needs to be updated based on the matching results. At the same time, the encryption algorithm library and key library are updated and maintained regularly to ensure that the encryption algorithms and keys therein meet the latest security standards and requirements.

[0039] Specifically, by subscribing to five well-known security intelligence sources such as FireEye and Symantec, we obtain about 1,000 pieces of the latest security threat intelligence every day, including newly discovered vulnerabilities, malware, APT organizations and other information. We use natural language processing technology to extract and classify the unstructured threat intelligence obtained, and build a structured threat intelligence knowledge base. We use the RSA encryption algorithm to generate a 2048-bit key pair to encrypt and store and transmit threat intelligence. For the AES-128 encryption algorithm currently used in mobile payment applications, we evaluate its security strength through the NIST SP800-57 standard, calculate the key length, block length, number of encryption rounds and other parameters of the encryption algorithm, and compare them with the recommended values ​​in the standard. The evaluation results show that the security strength of the AES-128 algorithm is insufficient and there are potential security risks. According to the evaluation results, the AES-256 algorithm is selected from the pre-established encryption algorithm library as an alternative. Compared with AES-128, the key length and number of encryption rounds are improved, and the security strength is higher. The PBKDF2 algorithm is used to generate a 256-bit key, which is iterated 1000 times and a 128-bit random salt value is added to improve the randomness and unpredictability of the key. After the application is re-encrypted and deployed, the abnormal behavior in the network traffic is monitored in real time by deploying traffic mirroring and network intrusion detection systems. Using the Suricata-based intrusion detection engine, 500 custom intrusion detection rules are deployed to cover threat scenarios such as known vulnerability exploits and malware communications. When the intrusion detection system detects suspected APT attack behavior, it automatically triggers the emergency response process to re-evaluate the relevant encryption algorithms and keys. By dynamically calling the cryptographic security assessment tool, the security of the AES-256 algorithm is quickly assessed. If the assessment result is lower than the preset threshold, it automatically switches to the ChaCha20 algorithm to generate a 256-bit key for encryption to ensure the security of encrypted communications.

[0040] What is disclosed above is only a preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. A person skilled in the art can understand that all or part of the processes of the above embodiments and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A payment environment information security management method for aggregate payment, characterized in that: The method comprises: Obtain the code of the mobile aggregate payment application, introduce a random key during the compilation process, use multi-level dynamic encryption technology to generate encrypted code, and when the application is running, decrypt the encrypted code in real time through a dynamic decryption engine to obtain the original code and execute it; Using a secure hash algorithm, extracting fingerprints of key code segments and data structures of the mobile aggregation payment application, and generating an application integrity check code; During the application running process, the integrity check code of the mobile aggregation payment application is calculated in real time, and the integrity check code calculated in real time is compared with the preset application integrity check code. If the integrity check code calculated in real time is inconsistent with the preset application integrity check code, it is determined that the mobile aggregation payment application has been tampered with, and a protection mechanism is triggered; Performing semantic equivalence transformation and control flow flattening processing on the code of the mobile aggregation payment application to generate obfuscated code, thereby increasing the difficulty of reverse analysis of the code; Insert anti-debugging and anti-injection detection logic into the key code segment of the mobile aggregation payment application, and interrupt the application operation when abnormal behavior is found; Perform integrity check on the key data structure of the payment information of the mobile aggregate payment application to ensure that the payment data has not been tampered with, and perform integrity check on the key functions of the payment logic to prevent the payment logic from being tampered with; Obtain security threat intelligence about the operating environment of the mobile aggregate payment application, dynamically adjust security policies, and update encryption algorithms and keys; The code of the mobile aggregation payment application is subjected to semantic equivalence transformation and control flow flattening processing to generate obfuscated code, thereby increasing the difficulty of reverse analysis of the code, including: obtaining the original code of the mobile aggregation payment application, processing the code using ANTLR lexical analysis and syntax analysis tools, and generating an abstract syntax tree; Traverse the abstract syntax tree and identify key nodes, including conditional statements and loop statements. Perform semantic equivalence transformation on these key nodes and use the Z3Prover theorem proving tool to generate semantically equivalent but structurally different code snippets. Perform control flow analysis on the transformed code snippet and use the CFGBuilder tool to identify all basic blocks and control flow boundaries; According to the results of control flow analysis, the FlowOptimizer tool is used to reorganize the code fragments, eliminate redundant control flow boundaries, and achieve control flow flattening; The KLEE symbolic execution engine is used to perform path exploration on the flattened code to generate constraints covering all possible execution paths; According to the generated constraints, use the Obfuscator-LLVM obfuscation tool to generate the corresponding obfuscated code snippets; The obfuscated code fragments are reintegrated into the original code framework using the Clang compiler, and the correctness and executableness of the obfuscated code are ensured through static analysis and dynamic testing methods; Use the AFL fuzz testing tool to perform functional and performance testing on the integrated code to verify the equivalence of the obfuscated code with the original code in terms of function and performance; Use the Tigress obfuscation strength assessment tool to evaluate the effectiveness and strength of code obfuscation based on the static characteristics and dynamic behavior of the obfuscated code; The anti-debugging and anti-injection detection logic is inserted into the key code segment of the mobile aggregation payment application, and when abnormal behavior is found, the application operation is interrupted, including: establishing a code security detection mechanism for the key code segment of the mobile aggregation payment application, and monitoring the code operation status in real time by inserting a special detection logic; In the anti-debugging detection logic, a variety of technical means are used, including detecting the debugger process and detecting the openness of the debugging port, to fully identify possible debugging behaviors; If debugging behavior is detected, it is considered abnormal and the application interruption mechanism is triggered; In the anti-injection detection logic, the parameters of key functions are checked for legitimacy to determine whether there is any illegally injected code; At the same time, dynamic binary instrumentation technology is used to insert detection code during the function call process, track the function call stack, and interrupt the application operation when an abnormal call chain is found; For the identified abnormal behaviors, log records and asymmetric encryption algorithm RSA are used for encryption, and the abnormal information is reported to the server through the secure transmission protocol HTTPS to facilitate subsequent analysis and auditing; After receiving the abnormal information, the server triggers the corresponding alarm mechanism and notifies the security management personnel to handle it in time; To further improve the security of the code segment, the key code is obfuscated and reinforced; Use the code obfuscation tool ProGuard to rename the code and change the process control structure to increase the difficulty of reverse engineering; At the same time, use third-party hardening tools to protect the application to prevent code tampering and secondary packaging; Establish a comprehensive application security response mechanism. Once an abnormality is found, the application operation can be quickly interrupted and security reminders can be sent to users to guide them to upgrade to the latest security version. At the same time, the device information and user behavior where abnormalities occurred are recorded to provide data support for subsequent security analysis; Regularly conduct security audits and penetration tests on aggregate payment applications, use static code analysis tools such as Fortify and dynamic testing tools such as AppScan to proactively discover potential security vulnerabilities and fix them in a timely manner, continuously improve the overall security of the application, and provide users with more reliable mobile payment services; The key data structure of the payment information of the mobile aggregation payment application is checked for integrity to ensure that the payment data has not been tampered with; the key functions of the payment logic are checked for integrity to prevent the payment logic from being tampered with, including: obtaining the key data structure and fields of the payment information of the mobile aggregation payment application, and establishing a payment information integrity check model; The integrity of the key data structure is checked using the SHA-256 hash algorithm. If the check result does not match the preset threshold, it is determined that the payment data may have been tampered with and the payment request is rejected. For key functions in payment logic, extract their code structure features, including control flow graph and data flow graph; Use the static code analysis tool Coverity to scan the code for defects and build a payment logic integrity verification model; The symbolic execution tool KLEE is used to explore the paths of key functions and obtain the input and output behavior characteristics of functions under complete path coverage; Use the support vector machine (SVM) algorithm to determine whether the function code has been maliciously modified. If so, reject the payment request. After the payment data verification and payment logic verification are completed, the transaction amount and transaction time fields in the payment information are obtained, and combined with the user's historical behavior data, the K-Means clustering algorithm is used to determine whether the transaction is abnormal; Map transaction data to a multi-dimensional feature space, and determine whether it is abnormal based on whether the distance between the transaction data and the cluster center exceeds a preset threshold. If abnormal, perform secondary verification or interrupt payment. According to the payment risk verification results, the AdaBoost algorithm is used to dynamically adjust the risk control rule threshold in the payment logic, and the payment risk judgment model is continuously optimized by improving the decision tree algorithm to improve the accuracy of risk identification; Apply the optimized risk control threshold to the payment logic, and use the optimized payment risk judgment model in the verification of the next payment request.

2. The method according to claim 1, characterized in that: The method of obtaining the code of the mobile aggregate payment application, introducing a random key during the compilation process, and using a multi-level dynamic encryption technology to generate an encrypted code; when the application is running, decrypting the encrypted code in real time through a dynamic decryption engine to obtain the original code and execute it, includes: Obtain the installation package file of the mobile aggregation payment application, decompile the installation package using the decompilation tool Apktool, and obtain the original code file of the application; For the original code obtained by decompilation, the abstract syntax tree analysis tool ASTParser is used to perform syntax analysis on the code and generate the abstract syntax tree of the code; By traversing the abstract syntax tree, determine the structure and execution flow of the code and build the control flow graph of the code; According to the generated control flow graph, the dynamic symbolic execution tool SymbolicPathFinder is used to perform symbolic execution on the key path to generate a set of test cases covering all possible paths; During symbolic execution, the runtime trace and data flow information of the code are dynamically obtained through instrumentation technology; Based on the runtime trajectory and data flow information obtained, the data flow analysis tool Soot is used to identify sensitive data and locate key operations. The taint analysis algorithm is used to determine the areas and data in the code that need to be dynamically encrypted. According to the determined encryption area and data, one or both of AES and RSA encryption algorithms are used to design a multi-layer dynamic encryption scheme; During the code compilation process, a custom Gradle plug-in is used to embed randomly generated keys into the code, encrypt the identified sensitive code and data in layers, and generate encrypted code files. Package and sign the encrypted code files, and use the Android packaging tool APKTool to generate an application installation package with enhanced protection; Ensure the integrity and source credibility of the application installation package through integrity verification and signature verification mechanisms; When the application is running, the code is decrypted in real time using the same key as that used for encryption through the preset dynamic decryption engine module; The decrypted code file is loaded into the Android runtime environment for execution, and the runtime recovery of the original code is completed through the dynamic loading technology DexClassLoader, thereby realizing the mobile aggregate payment function; For identified sensitive data and key operations, white box encryption technology will continue to be used for dynamic protection to prevent core algorithms and data from being maliciously tampered with or stolen.

3. The method according to claim 1, characterized in that The secure hash algorithm is used to extract the fingerprint of the key code segment and data structure of the mobile aggregation payment application and generate an application integrity check code, including: Obtain the installation package file of the mobile aggregation payment application, decompress it and extract the key code segments and data structure information; For the extracted key code segments and data structures, the SHA-256 algorithm is used to calculate the hash value to obtain the fingerprint information of the code segments and data structures; Concatenate the fingerprint information of the code segment and the data structure into strings to generate the integrity fingerprint of the application; According to the preset CRC32 check algorithm, a 32-bit application integrity check code is generated using the application integrity fingerprint; The generated application integrity verification code is associated with the package name and version number of the application and stored in the database to establish a mapping relationship between the application and the verification code; When the application is started, the integrity fingerprint of the current application is dynamically obtained, and the verification code is recalculated according to the preset CRC32 verification algorithm; The dynamically calculated verification code is compared with the verification code stored in the database. If they match, the verification passes and the application is allowed to run normally. Otherwise, the application integrity check is judged to have failed, a warning prompt is popped up, and further execution of the application is blocked. At the same time, the failure log is recorded and reported to the server for risk analysis.

4. The method according to claim 1, characterized in that: The method comprises: calculating the integrity check code of the mobile aggregation payment application in real time during the application operation, and comparing the integrity check code calculated in real time with the preset application integrity check code; if the integrity check code calculated in real time is inconsistent with the preset application integrity check code, determining that the mobile aggregation payment application has been tampered with, and triggering a protection mechanism, including: Obtain the runtime code and key data of the mobile aggregate payment application, and calculate the real-time integrity check code using the secure hash algorithm SHA-256; Read the pre-set application integrity check code from the application security storage area TrustZone; Compare the integrity check code calculated in real time with the preset application integrity check code to determine whether the two match; If the real-time integrity check code does not match the preset check code, it is determined that the code or key data of the mobile aggregation payment application has been tampered with, triggering a predefined protection mechanism, including preventing the application from continuing to run, sending an alarm notification, and recording a tampering event log; Continuously collect system call, file access, and network communication behavior data when the application is running, and perform necessary data cleaning and feature engineering processing; Use the support vector machine (SVM) algorithm to train the abnormal behavior detection model and determine in real time whether there are abnormal behavior patterns during application operation; The security status of mobile aggregate payment applications is evaluated by combining the results of static integrity verification and dynamic behavior analysis; When static integrity checks fail or abnormal behavior is detected, the protection strategy is dynamically adjusted and corresponding risk prevention and control measures are taken, including enhancing code obfuscation, limiting sensitive API calls, and raising abnormal behavior thresholds; At the same time, application security incidents will be reported to the monitoring platform, triggering the early warning mechanism and notifying relevant operation and maintenance personnel to handle them in a timely manner.

5. The method according to claim 1, characterized in that The obtaining of security threat intelligence of the mobile aggregate payment application operating environment, dynamically adjusting security policies, and updating encryption algorithms and keys include: Obtain operating environment information and security threat intelligence of mobile aggregate payment applications; Based on the acquired security threat intelligence, use security assessment tools to conduct security assessments on the encryption algorithms and keys currently in use to determine whether there are any security risks; If it is determined that there are security risks, the encryption algorithm and key that need to be updated will be determined based on the security assessment results; Select an encryption algorithm and key that matches the security assessment result and has higher security from the pre-established encryption algorithm library and key library; Update the encryption algorithm and key of the mobile aggregation payment application to the selected encryption algorithm and key, and re-encrypt and deploy the application; During the operation of the mobile aggregation payment application, the security threat intelligence changes of the operating environment are continuously monitored through the security monitoring system, with a monitoring frequency of once an hour; When changes in security threat intelligence are detected, the security assessment process is triggered, and the subsequent steps of security assessment, encryption algorithm and key update are re-executed to achieve dynamic adjustment of the security policy of mobile aggregation payment applications; Security threat intelligence can be obtained by subscribing to third-party security intelligence sources and analyzing internal security incidents; Match the acquired security threat intelligence with the pre-established encryption algorithm security assessment rules, and determine whether the encryption algorithm needs to be updated based on the matching results; At the same time, the encryption algorithm library and key library are updated and maintained regularly to ensure that the encryption algorithms and keys therein meet the latest security standards and requirements.

Images