Payment data security assessment method and system

Abstract

The invention is suitable for the technical field of payment data system vulnerability assessment, and provides a payment data security assessment method and system.The method comprises the steps that after vulnerability scanning and penetration testing operation is conducted on a payment data storage system, a plurality of scanned security defects are determined, and acquiring a preliminary risk priority evaluation index allocated to each security defect, and acquiring a historical operation log of the payment data storage system. According to the method, the mechanism of double correction factors is introduced, so that the repair priority evaluation of the potential risk vulnerabilities in the payment data storage system is optimized. Firstly, in combination with a hysteresis effect correction factor and a secret key updating frequency deviation correction factor, the accuracy and timeliness of vulnerability repair are effectively improved;

Description

Technical Field

[0001] The present invention belongs to the technical field of payment data system vulnerability assessment, and in particular relates to a payment data security assessment method and system. Background Art

[0002] Payment data security is a core issue in the field of information technology. With the widespread application of payment systems, ensuring the security of payment data has become an important challenge faced by enterprises and organizations. At present, existing technologies mainly identify potential security defects in payment systems through vulnerability scanning, penetration testing and other methods. The goal of vulnerability priority assessment is to classify these security defects and assign priorities to them based on factors such as their potential risks, attack possibilities, and degree of harm, so that system administrators can take appropriate measures. These measures include not only vulnerability repairs, but also different response methods such as enhanced monitoring, data encryption, and access control. However, existing vulnerability priority assessment methods usually only rely on static scanning results, and do not consider the dynamic changes in vulnerability exposure and the impact of the external environment.

[0003] Most vulnerability priority assessment methods in existing technologies are based on static scanning or fixed rule models, ignoring the changes in vulnerability exposure in different time periods and environments. Especially for vulnerabilities related to encryption algorithms, these vulnerabilities may not immediately show their harm in the early stage. As time goes by, especially when key management is improper, the frequency of vulnerability exposure and harm may gradually increase. Existing technologies do not dynamically adjust the repair priority according to changes in vulnerability exposure frequency and deviations in key update frequency, which may result in some long-standing vulnerabilities not being repaired in time, increasing the risk of system attacks.

[0004] Therefore, the existing technology has several defects in vulnerability priority assessment. First, it does not consider the change of vulnerability exposure frequency over time and cannot accurately reflect the dynamic change of vulnerability risk. Second, it fails to adjust the vulnerability priority according to the effectiveness of key update, which may lead to some vulnerabilities caused by poor key management not receiving timely attention. Therefore, the existing technology cannot comprehensively assess the actual risk of the vulnerability and take the most appropriate treatment method, such as repair, encryption, isolation, monitoring, etc., so as to effectively protect the security of the payment data storage system. Summary of the invention

[0005] The purpose of the present invention is to provide a payment data security assessment method and system, aiming to solve the problems raised in the background technology.

[0006] The present invention is implemented as follows: a payment data security assessment method, the method comprising: After performing vulnerability scanning and penetration testing on the payment data storage system, determine a number of security defects found in the scan, obtain a preliminary risk priority assessment index assigned to each security defect, and obtain historical operation logs of the payment data storage system; Screen several security flaws based on historical operation logs, and identify potential risk vulnerabilities related to encryption algorithms, which exist for longer than a predetermined period and are exposed in network delay conditions; Analyze the change in exposure frequency of potential risk vulnerabilities within a predetermined period, quantify the change in exposure frequency, and obtain a first correction factor related to the hysteresis effect; Select the key encryption key of the potential risk vulnerability, determine the standard key update frequency corresponding to the key encryption key, and the actual key update frequency within the predetermined period, quantify the deviation between the actual key update frequency and the standard key update frequency, and use it as the second correction factor; Combining the first correction factor and the second correction factor, the preliminary risk priority assessment index of the potential risk vulnerability is doubly optimized and corrected.

[0007] As a further limitation of the technical solution of the embodiment of the present invention, the steps of analyzing the exposure frequency change of the potential risk vulnerability within a predetermined period, quantifying the exposure frequency change, and obtaining the first correction factor related to the hysteresis effect include: Divide the scheduled period into several time periods of equal length, and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs; Based on each time period and its corresponding exposure frequency, draw an exposure frequency change curve reflecting the hysteresis effect, and use the change curve as a visualization of the change in exposure frequency of potential risk vulnerabilities within a predetermined period; The average slope of the variation curve was calculated and used as the first correction factor related to the hysteresis effect.

[0008] As a further limitation of the technical solution of the embodiment of the present invention, the steps of selecting a key encryption key of a potential risk vulnerability, determining a standard key update frequency corresponding to the key encryption key, and an actual key update frequency within a predetermined period, quantifying the degree of deviation between the actual key update frequency and the standard key update frequency, and using it as a second correction factor include: Parse historical operation logs, determine the key encryption keys associated with potential risk vulnerabilities based on vulnerability types and encryption operation modes, read key usage records in historical operation logs, and determine the actual key update frequency of potential risk vulnerabilities within a predetermined period; Retrieve the preset reference model to determine the standard key update frequency of key encryption keys under the same network latency environment as the potential risk vulnerability; The deviation between the actual key update frequency and the standard key update frequency is quantified and used as the second correction factor.

[0009] As a further limitation of the technical solution of the embodiment of the present invention, the reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets the encryption keys corresponding to different types of encryption algorithms and the corresponding standard key update frequencies in different network environments.

[0010] As a further limitation of the technical solution of the embodiment of the present invention, the step of performing dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability in combination with the first correction factor and the second correction factor includes: Retrieve the assessment index correction formula, and combine the first correction factor and the second correction factor to perform double optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability to obtain an optimized risk priority assessment index; Apply the optimized risk priority assessment index to vulnerability repair priority sorting.

[0011] As a further limitation of the technical solution of the embodiment of the present invention, the evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0012] A payment data security assessment system, the system comprising: a data acquisition module, a vulnerability screening module, a first correction factor determination module, a second correction factor determination module and a preliminary index correction module, wherein: A data acquisition module, used to determine a number of security defects found after performing vulnerability scanning and penetration testing operations on the payment data storage system, and obtain a preliminary risk priority assessment index assigned to each security defect, and obtain a historical operation log of the payment data storage system; The vulnerability screening module is used to screen a number of security defects based on historical operation logs, and screen out potential risk vulnerabilities related to encryption algorithms, which exist for more than a predetermined period and are exposed in network delay conditions; A first correction factor determination module is used to analyze the exposure frequency change of the potential risk vulnerability within a predetermined period, quantify the exposure frequency change, and obtain a first correction factor related to the hysteresis effect; A second correction factor determination module is used to select a key encryption key of a potential risk vulnerability, determine a standard key update frequency corresponding to the key encryption key, and an actual key update frequency within a predetermined period, quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use it as a second correction factor; The preliminary index correction module is used to combine the first correction factor and the second correction factor to perform dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability.

[0013] As a further limitation of the technical solution of the embodiment of the present invention, the first correction factor determination module specifically includes: The exposure frequency statistics unit is used to divide the scheduled period into several time periods of equal length, and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs; A change curve drawing unit is used to draw an exposure frequency change curve reflecting the hysteresis effect based on each time period and its corresponding exposure frequency, and use the change curve as a visual representation of the change of exposure frequency of potential risk vulnerabilities within a predetermined period; The average slope calculation unit is used to calculate the average slope of the change curve and use it as the first correction factor related to the hysteresis effect.

[0014] As a further limitation of the technical solution of the embodiment of the present invention, the second correction factor determination module specifically includes: An actual key update frequency determination unit is used to parse historical operation logs, determine the key encryption key associated with the potential risk vulnerability according to the vulnerability type and the encryption operation mode, and read the key usage record in the historical operation logs to determine the actual key update frequency of the potential risk vulnerability within a predetermined period; A standard key update frequency determination unit, used to call a preset reference model to determine a standard key update frequency of a critical encryption key under a network delay environment that is the same as the potential risk vulnerability; a deviation degree quantification unit, used to quantify the deviation degree between the actual key update frequency and the standard key update frequency, and use it as a second correction factor; The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets encryption keys corresponding to different types of encryption algorithms and corresponding standard key update frequencies in different network environments.

[0015] As a further limitation of the technical solution of the embodiment of the present invention, the preliminary index correction module specifically includes: The initial assessment index correction unit is used to retrieve the assessment index correction formula, and combine the first correction factor and the second correction factor to perform double optimization correction on the initial risk priority assessment index of the potential risk vulnerability to obtain an optimized risk priority assessment index; An optimization assessment index application unit, used to apply the optimized risk priority assessment index to vulnerability repair priority sorting; The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The present invention optimizes the repair priority assessment of potential risk vulnerabilities in the payment data storage system by introducing a dual correction factor mechanism. First, by combining the hysteresis effect correction factor and the key update frequency deviation correction factor, the accuracy and timeliness of vulnerability repair are effectively improved. The hysteresis effect correction factor can identify security threats that gradually emerge over time, ensuring that the system can give priority to those long-standing and gradually intensified vulnerabilities; while the key update frequency deviation correction factor dynamically adjusts the priority of vulnerability repair according to the effectiveness of key management, preventing security risks caused by insufficient key updates.

[0017] By comprehensively considering the changes in vulnerability exposure and the deviations in key update frequency, the present invention can more scientifically assess the real risk of vulnerabilities and ensure that the repair measures are accurate and efficient. This method avoids the limitations of a single factor, improves the level of intelligence in vulnerability repair, and has important practical significance and application value for enhancing the overall security of payment data storage systems. In addition, the real-time nature and automation of the system further reduce the errors and workload of manual evaluation and improve security management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of a method provided by an embodiment of the present invention; Figure 2 A flow chart of generating a first correction factor in the method provided in an embodiment of the present invention; Figure 3 A flow chart of generating a second correction factor in the method provided in an embodiment of the present invention; Figure 4A flowchart of modifying a preliminary risk priority assessment index in a method provided in an embodiment of the present invention; Figure 5 An application architecture diagram of a system provided by an embodiment of the present invention; Figure 6 A structural block diagram of a first correction factor determination module in a system provided by an embodiment of the present invention; Figure 7 A structural block diagram of a second correction factor determination module in a system provided by an embodiment of the present invention; Figure 8 This is a structural block diagram of a preliminary index correction module in a system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0020] Figure 1 A flow chart of a method provided by an embodiment of the present invention is shown.

[0021] Specifically, a payment data security assessment method comprises the following steps: Step S100, after performing vulnerability scanning and penetration testing operations on the payment data storage system, determine a number of security defects scanned, obtain a preliminary risk priority assessment index assigned to each security defect, and obtain a historical operation log of the payment data storage system.

[0022] In an embodiment of the present invention, the vulnerability scanning and penetration testing operation of the payment data storage system refers to a comprehensive security check of the payment data storage system through an automated tool to identify potential security vulnerabilities. Specifically, vulnerability scanning usually involves static and dynamic analysis of components such as systems, applications, and databases to detect possible weaknesses or known vulnerabilities. Penetration testing simulates the behavior of attackers and conducts actual penetration testing to evaluate the system's protection capabilities and the actual exploitability of vulnerabilities. In the prior art, network scanning tools (such as Nessus, OpenVAS), application vulnerability scanning tools (such as Burp Suite, OWASP ZAP) and manual penetration testing techniques are often used to implement vulnerability scanning and penetration testing operations. These tools and technical means can help security personnel identify potential security risks in the system and take corresponding remedial measures.

[0023] Security defects generally refer to loopholes or weaknesses in payment data storage systems that may be exploited by attackers. These defects may involve problems in encryption algorithms, identity authentication, data storage, access control, etc. In an embodiment of the present invention, the preliminary risk priority assessment index of security defects is obtained by preliminary assessment based on multiple factors such as the severity of the vulnerability, the scope of impact, the availability, and the potential security risks. The calculation of the assessment index can refer to existing risk assessment models or frameworks, such as CVSS (Common Vulnerability Scoring System) or customized scoring methods based on the security policies of specific organizations. The prior art has widely used these risk assessment models and assigned priority indexes in combination with historical attack data or the specific characteristics of the vulnerability. In this way, the repair priority of different vulnerabilities in the system can be quantified, thereby helping system administrators determine which vulnerabilities need to be repaired first.

[0024] The historical operation log of the payment data storage system refers to the detailed record of all operations and events recorded by the system during operation. These logs usually contain various transaction information, user access records, system resource usage, database query and update records, etc.

[0025] Historical operation logs are detailed logs of key operations and events recorded in the payment data storage system. In addition to regular system operations, they should also contain data related to encryption algorithms and key management. These logs record the time of encryption operations, the type of algorithm used, and the generation and update of keys, helping to analyze vulnerabilities and key management issues related to encryption algorithms.

[0026] The log should also include vulnerability exposure records, especially the exposure frequency and time of potential risk vulnerabilities, to support the analysis of vulnerability changes within a predetermined period. At the same time, the log will record the frequency of key use and update time, to assist in screening key encryption keys and evaluating the frequency of key updates. The record of encryption operation mode helps to determine the type of vulnerability and encryption method.

[0027] If the system is running in a network latency environment, the log should contain network performance data, such as latency and bandwidth fluctuations, to support analysis of changes in vulnerability exposure in such an environment. In general, historical operation logs provide necessary data support for vulnerability screening, key management, and priority assessment.

[0028] Furthermore, the payment data security assessment method further comprises the following steps: Step S200, screening a number of security defects based on historical operation logs, and screening out potential risk vulnerabilities that are related to encryption algorithms, exist for more than a predetermined period, and are exposed in an environment with network delay conditions.

[0029] In the embodiment of the present invention, potential risk vulnerabilities related to the encryption algorithm, which exist for more than a predetermined period and are exposed in a network delay condition are screened out, mainly to accurately identify those vulnerabilities that exist for a long time and whose risks are aggravated in a specific environment. The encryption algorithm is the core of protecting the security of payment data. If there are vulnerabilities in the encryption algorithm, it may lead to data leakage or tampering. Over time, some encryption vulnerabilities may gradually be exposed, especially when the key management is improper or the algorithm design is defective, these vulnerabilities may be discovered by attackers during long-term use. Therefore, screening out vulnerabilities that exist for more than a predetermined period can provide early warning of potential security risks.

[0030] In addition, vulnerabilities exposed in network delay conditions are special because in an environment with large network delays, attackers have more time to make malicious attempts and probes. In this environment, the exposure of vulnerabilities may be amplified by delays, making it difficult to detect and defend against attacks in real time. Vulnerabilities related to encryption algorithms may be more difficult to detect in this environment, and the probability of successful attacks is higher. Therefore, screening these vulnerabilities helps to identify potential risks in a timely manner and take effective remediation measures.

[0031] Furthermore, the payment data security assessment method further comprises the following steps: Step S300, analyzing the exposure frequency change of the potential risk vulnerability within a predetermined period, quantifying the exposure frequency change, and obtaining a first correction factor related to the hysteresis effect.

[0032] Specifically, Figure 2 A flow chart for generating a first correction factor is shown.

[0033] The steps of analyzing the exposure frequency change of the potential risk vulnerability within a predetermined period, quantifying the exposure frequency change, and obtaining the first correction factor related to the hysteresis effect specifically include the following steps: Step S301, dividing the predetermined period into a number of time periods of equal length, and counting the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs; Step S302, based on each time period and its corresponding exposure frequency, draw an exposure frequency change curve reflecting the hysteresis effect, and use the change curve as a visual representation of the exposure frequency change of the potential risk vulnerability within a predetermined period; Step S303: Calculate the average slope of the change curve and use it as the first correction factor related to the hysteresis effect.

[0034] In the embodiments of the present invention, the hysteresis effect refers to the fact that the exposure of certain vulnerabilities or risks does not occur immediately, but the frequency of exposure gradually increases over time. Especially in encryption algorithms and key management, vulnerabilities may not show obvious harm in the early stage, but with the accumulation of time and the continuous attempts of attackers, the frequency of exposure may gradually increase. The hysteresis effect reflects the impact of this time delay and helps us identify potential risk vulnerabilities that are gradually exposed within a specific period.

[0035] Through steps S301 and S302, the predetermined period is divided into several time periods of equal length, and the exposure frequency of potential risk vulnerabilities in each time period is counted based on historical operation logs, which enables the system to more accurately analyze the changes in vulnerabilities in different time periods. This process of dividing and drawing change curves allows the changes in exposure frequency to be quantified and visualized, thereby helping to discover trends and patterns in vulnerability exposure. By converting the exposure frequency of a time period into a change curve, you can intuitively see whether the vulnerability shows a trend of gradually intensifying, as well as the changes in exposure frequency in different time periods. In this way, the system can accurately capture potential lag effects, thereby providing a basis for subsequent priority corrections.

[0036] By generating the first correction factor related to the hysteresis effect in this way, the priority of repairing potential risk vulnerabilities can be effectively adjusted dynamically. The correction factor related to the hysteresis effect reflects the timeliness of vulnerability exposure and the gradually increasing risk, which can help the system identify those vulnerabilities that were not fully noticed in the early stage but whose impact gradually increased over time. The introduction of this correction factor can improve the timeliness of vulnerability repair, ensure that those vulnerabilities with hysteresis effects can be repaired in time, and reduce the security risks in the long-term operation of the system.

[0037] Furthermore, the payment data security assessment method further comprises the following steps: Step S400, select the critical encryption key of the potential risk vulnerability, determine the standard key update frequency corresponding to the critical encryption key, and the actual key update frequency within a predetermined period, quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use it as the second correction factor.

[0038] Specifically, Figure 3 A flow chart for generating a second correction factor is shown.

[0039] Among them, selecting a key encryption key of a potential risk vulnerability, determining a standard key update frequency corresponding to the key encryption key, and an actual key update frequency within a predetermined period, quantifying the degree of deviation between the actual key update frequency and the standard key update frequency, and using it as a second correction factor specifically includes the following steps: Step S401, parsing the historical operation log, determining the key encryption key associated with the potential risk vulnerability according to the vulnerability type and the encryption operation mode, reading the key usage record in the historical operation log, and determining the actual key update frequency of the potential risk vulnerability within a predetermined period; Step S402, calling a preset reference model to determine a standard key update frequency of a key encryption key under the same network delay environment as the potential risk vulnerability; Step S403: quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use it as a second correction factor.

[0040] In the embodiment of the present invention, the selection basis of the key encryption key is to determine the encryption key related to the potential risk vulnerability according to the vulnerability type and the encryption operation mode. These key encryption keys are usually the most core keys involved in data protection, authentication and encryption algorithms. For example, data encryption keys, key exchange keys, signature keys, etc., are crucial to the confidentiality and integrity of payment data. The significance of selecting these keys is that they directly affect the security of encryption operations and vulnerability repair strategies, so their update frequency must be evaluated to ensure that key management meets security requirements and relevant vulnerabilities are repaired in a timely manner.

[0041] Recalling the preset reference model to determine the standard key update frequency of critical encryption keys under the same network delay environment as the potential risk vulnerability is to adjust the key update frequency according to different network environment factors. In some network environments, especially those with high latency or unstable bandwidth, key updates may need to be performed more frequently to resist the risk of attacks caused by environmental factors. The significance of this step is that the reference model provides reasonable key update standards under different environmental conditions, allowing the system to dynamically adjust the key update strategy to ensure security in various environments. During specific implementation, the system will set the key update frequency requirements based on the network delay records in the historical operation log and the standard update frequency in the reference model.

[0042] The step of quantifying the degree of deviation between the actual key update frequency and the standard key update frequency and using it as the second correction factor is to reflect the security of the key security key associated with the potential risk vulnerability through the degree of deviation. If the degree of deviation indicates that the update frequency of the key security key is high, it means that the key has been updated in time and the potential risk vulnerability is less vulnerable, so the initial assessment parameters of the vulnerability can be appropriately lowered; on the contrary, if the degree of deviation is large, it means that the key update frequency is insufficient and the potential risk vulnerability may be vulnerable to attack. At this time, the initial assessment parameters should be increased to increase the priority of vulnerability repair.

[0043] The reference model refers to a key update cycle model based on industry standards and best practices. The model sets corresponding key update cycles for different types of encryption algorithms, and includes the standard update frequency for the key type used by each encryption algorithm. The reference model will also make appropriate adjustments to the key update cycle based on different network environment factors (such as network latency, bandwidth fluctuations, data transmission speed, etc.) to ensure that the update frequency of encryption keys in various operating environments can effectively respond to potential attack risks. The model integrates the industry's best practices and security standards, making it widely applicable and effective.

[0044] Furthermore, the payment data security assessment method further comprises the following steps: Step S500, combining the first correction factor and the second correction factor to perform dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability.

[0045] Specifically, Figure 4 A flow chart for revising the preliminary risk priority assessment index is shown.

[0046] The following steps are specifically used to perform dual optimization and correction on the preliminary risk priority assessment index of potential risk vulnerabilities by combining the first correction factor and the second correction factor: Step S501, calling the evaluation index correction formula, and combining the first correction factor and the second correction factor to perform double optimization correction on the preliminary risk priority evaluation index of the potential risk vulnerability, to obtain an optimized risk priority evaluation index; Step S502: Apply the optimized risk priority assessment index to vulnerability repair priority sorting.

[0047] The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0048] In an embodiment of the present invention, the preliminary risk priority assessment index of the potential risk vulnerability is double optimized and corrected by combining the first correction factor and the second correction factor, mainly to comprehensively consider the exposure of the vulnerability, the hysteresis effect and the effectiveness of key management. The first correction factor mainly reflects the hysteresis effect based on the change in the frequency of vulnerability exposure. Through this factor, security threats that gradually emerge over time can be identified. The second correction factor evaluates the security of the encryption key by analyzing the deviation between the key update frequency and the standard update frequency, thereby providing dynamic adjustment for the priority of vulnerability repair. The combination of the two can comprehensively evaluate the potential harmfulness of the vulnerability and make comprehensive priority adjustments based on different security factors. There is a good linkage relationship between the first correction factor and the second correction factor, that is, the vulnerability exposure trend reflected by the hysteresis effect and the key management effectiveness reflected by the key update frequency complement each other and jointly affect the priority of vulnerability repair.

[0049] This dual correction mechanism can effectively improve the accuracy and timeliness of vulnerability repair, so that repair measures can prioritize those vulnerabilities that are truly high-risk and potential threats. This approach can avoid the limitations of a single factor and ensure that the priority of vulnerability repair is more scientific and reasonable in a complex environment.

[0050] The following is a detailed example showing the process from obtaining initial parameters to final optimization: When evaluating a potential risk vulnerability, the initial risk priority assessment index is first determined to be 50. Then, based on historical operation logs and network latency environment, the vulnerability exposure is analyzed and two correction factors are calculated to optimize the vulnerability repair priority.

[0051] First, consider the change in the frequency of vulnerability exposure. Assume that we divide the evaluation period into 6 months, and the exposure frequency of the vulnerability is monitored 3, 4, 5, 6, 7, and 8 times each month. By analyzing these data, we find that the average slope of the change in vulnerability exposure frequency is 1.5. This slope reflects the gradual increase in vulnerability exposure, indicating that the degree of vulnerability exposure is gradually increasing over time. This slope, as the first correction factor, reflects the lag effect of vulnerability exposure.

[0052] Secondly, consider the update of the key encryption key associated with the vulnerability. The standard key update frequency requires an update every 3 months, but the historical operation log shows that the actual update frequency of the key is once every 6 months. The calculation shows that the deviation between the actual update frequency and the standard update frequency is 1, which becomes the second correction factor. A large deviation indicates that the key update frequency is low, which may increase the risk of this vulnerability.

[0053] By combining these two correction factors, we finally optimized the initial priority assessment index. Specifically, when the first correction factor (change in vulnerability exposure frequency) and the second correction factor (deviation in key update frequency) are taken into account, the optimized risk priority assessment index is significantly improved. This means that the priority of vulnerability repair needs to be increased to ensure that the vulnerability is handled in a timely manner.

[0054] Furthermore, Figure 5 The application architecture diagram of the system provided by the embodiment of the present invention is shown.

[0055] In another preferred embodiment of the present invention, a payment data security assessment system includes: The data acquisition module 100 is used to determine a number of security defects scanned after performing vulnerability scanning and penetration testing operations on the payment data storage system, and obtain a preliminary risk priority assessment index assigned to each security defect, and at the same time obtain the historical operation log of the payment data storage system.

[0056] In an embodiment of the present invention, the vulnerability scanning and penetration testing operation of the payment data storage system refers to a comprehensive security check of the payment data storage system through an automated tool to identify potential security vulnerabilities. Specifically, vulnerability scanning usually involves static and dynamic analysis of components such as systems, applications, and databases to detect possible weaknesses or known vulnerabilities. Penetration testing simulates the behavior of attackers and conducts actual penetration testing to evaluate the system's protection capabilities and the actual exploitability of vulnerabilities. In the prior art, network scanning tools (such as Nessus, OpenVAS), application vulnerability scanning tools (such as Burp Suite, OWASP ZAP) and manual penetration testing techniques are often used to implement vulnerability scanning and penetration testing operations. These tools and technical means can help security personnel identify potential security risks in the system and take corresponding remedial measures.

[0057] Security defects generally refer to loopholes or weaknesses in payment data storage systems that may be exploited by attackers. These defects may involve problems in encryption algorithms, identity authentication, data storage, access control, etc. In an embodiment of the present invention, the preliminary risk priority assessment index of security defects is obtained by preliminary assessment based on multiple factors such as the severity of the vulnerability, the scope of impact, the availability, and the potential security risks. The calculation of the assessment index can refer to existing risk assessment models or frameworks, such as CVSS (Common Vulnerability Scoring System) or customized scoring methods based on the security policies of specific organizations. The prior art has widely used these risk assessment models and assigned priority indexes in combination with historical attack data or the specific characteristics of the vulnerability. In this way, the repair priority of different vulnerabilities in the system can be quantified, thereby helping system administrators determine which vulnerabilities need to be repaired first.

[0058] The historical operation log of the payment data storage system refers to the detailed record of all operations and events recorded by the system during operation. These logs usually contain various transaction information, user access records, system resource usage, database query and update records, etc.

[0059] Historical operation logs are detailed logs of key operations and events recorded in the payment data storage system. In addition to regular system operations, they should also contain data related to encryption algorithms and key management. These logs record the time of encryption operations, the type of algorithm used, and the generation and update of keys, helping to analyze vulnerabilities and key management issues related to encryption algorithms.

[0060] The log should also include vulnerability exposure records, especially the exposure frequency and time of potential risk vulnerabilities, to support the analysis of vulnerability changes within a predetermined period. At the same time, the log will record the frequency of key use and update time, to assist in screening key encryption keys and evaluating the frequency of key updates. The record of encryption operation mode helps to determine the type of vulnerability and encryption method.

[0061] If the system is running in a network latency environment, the log should contain network performance data, such as latency and bandwidth fluctuations, to support analysis of changes in vulnerability exposure in such an environment. In general, historical operation logs provide necessary data support for vulnerability screening, key management, and priority assessment.

[0062] Furthermore, the payment data security assessment system further includes: The vulnerability screening module 200 is used to screen a number of security defects based on historical operation logs, and screen out potential risk vulnerabilities that are related to encryption algorithms, exist for more than a predetermined period, and are exposed in an environment with network delay conditions.

[0063] In the embodiment of the present invention, potential risk vulnerabilities related to the encryption algorithm, which exist for more than a predetermined period and are exposed in a network delay condition are screened out, mainly to accurately identify those vulnerabilities that exist for a long time and whose risks are aggravated in a specific environment. The encryption algorithm is the core of protecting the security of payment data. If there are vulnerabilities in the encryption algorithm, it may lead to data leakage or tampering. Over time, some encryption vulnerabilities may gradually be exposed, especially when the key management is improper or the algorithm design is defective, these vulnerabilities may be discovered by attackers during long-term use. Therefore, screening out vulnerabilities that exist for more than a predetermined period can provide early warning of potential security risks.

[0064] In addition, vulnerabilities exposed in network delay conditions are special because in an environment with large network delays, attackers have more time to make malicious attempts and probes. In this environment, the exposure of vulnerabilities may be amplified by delays, making it difficult to detect and defend against attacks in real time. Vulnerabilities related to encryption algorithms may be more difficult to detect in this environment, and the probability of successful attacks is higher. Therefore, screening these vulnerabilities helps to identify potential risks in a timely manner and take effective remediation measures.

[0065] Furthermore, the payment data security assessment system further includes: The first correction factor determination module 300 is used to analyze the exposure frequency change of the potential risk vulnerability within a predetermined period, quantify the exposure frequency change, and obtain a first correction factor related to the hysteresis effect.

[0066] Specifically, Figure 6 It shows a structural block diagram of the first correction factor determination module 300 in the system provided by an embodiment of the present invention.

[0067] In a preferred embodiment of the present invention, the first correction factor determination module 300 specifically includes: The exposure frequency statistics unit 301 is used to divide the predetermined period into a number of time periods of equal length, and to count the exposure frequency of the potential risk vulnerability in each time period according to the historical operation log; The change curve drawing unit 302 is used to draw an exposure frequency change curve reflecting the hysteresis effect based on each time period and its corresponding exposure frequency, and use the change curve as a visual representation of the change of exposure frequency of the potential risk vulnerability within a predetermined period; The average slope calculation unit 303 is used to calculate the average slope of the change curve and use it as the first correction factor related to the hysteresis effect.

[0068] In the embodiments of the present invention, the hysteresis effect refers to the fact that the exposure of certain vulnerabilities or risks does not occur immediately, but the frequency of exposure gradually increases over time. Especially in encryption algorithms and key management, vulnerabilities may not show obvious harm in the early stage, but with the accumulation of time and the continuous attempts of attackers, the frequency of exposure may gradually increase. The hysteresis effect reflects the impact of this time delay and helps us identify potential risk vulnerabilities that are gradually exposed within a specific period.

[0069] By dividing the predetermined period into several time periods of equal length through the exposure frequency statistics unit 301 and the change curve drawing unit 302, and counting the exposure frequency of potential risk vulnerabilities in each time period based on the historical operation log, the system can more accurately analyze the changes in vulnerabilities in different time periods. This process of dividing and drawing change curves allows the changes in exposure frequency to be quantified and visualized, thereby helping to discover trends and patterns in vulnerability exposure. By converting the exposure frequency of a time period into a change curve, you can intuitively see whether the vulnerability shows a trend of gradually intensifying, as well as the changes in exposure frequency in different time periods. In this way, the system can accurately capture potential lag effects, thereby providing a basis for subsequent priority corrections.

[0070] By generating the first correction factor related to the hysteresis effect in this way, the priority of repairing potential risk vulnerabilities can be effectively adjusted dynamically. The correction factor related to the hysteresis effect reflects the timeliness of vulnerability exposure and the gradually increasing risk, which can help the system identify those vulnerabilities that were not fully noticed in the early stage but whose impact gradually increased over time. The introduction of this correction factor can improve the timeliness of vulnerability repair, ensure that those vulnerabilities with hysteresis effects can be repaired in time, and reduce the security risks in the long-term operation of the system.

[0071] Furthermore, the payment data security assessment system further includes: The second correction factor determination module 400 is used to select a critical encryption key of a potential risk vulnerability, determine a standard key update frequency corresponding to the critical encryption key, and an actual key update frequency within a predetermined period, quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use it as a second correction factor.

[0072] Specifically, Figure 7 It shows a structural block diagram of the second correction factor determination module 400 in the system provided by an embodiment of the present invention.

[0073] In a preferred embodiment of the present invention, the second correction factor determination module 400 specifically includes: The actual key update frequency determination unit 401 is used to parse the historical operation log, determine the key encryption key associated with the potential risk vulnerability according to the vulnerability type and the encryption operation mode, and read the key usage record in the historical operation log, and determine the actual key update frequency of the potential risk vulnerability within a predetermined period; A standard key update frequency determination unit 402, used to retrieve a preset reference model to determine a standard key update frequency of a critical encryption key under the same network delay environment as the potential risk vulnerability; The deviation degree quantification unit 403 is used to quantify the deviation degree between the actual key update frequency and the standard key update frequency and use it as a second correction factor; The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets encryption keys corresponding to different types of encryption algorithms and the corresponding standard key update frequencies in different network environments.

[0074] In the embodiment of the present invention, the selection basis of the key encryption key is to determine the encryption key related to the potential risk vulnerability according to the vulnerability type and the encryption operation mode. These key encryption keys are usually the most core keys involved in data protection, authentication and encryption algorithms. For example, data encryption keys, key exchange keys, signature keys, etc., are crucial to the confidentiality and integrity of payment data. The significance of selecting these keys is that they directly affect the security of encryption operations and vulnerability repair strategies, so their update frequency must be evaluated to ensure that key management meets security requirements and relevant vulnerabilities are repaired in a timely manner.

[0075] Recalling the preset reference model to determine the standard key update frequency of critical encryption keys under the same network delay environment as the potential risk vulnerability is to adjust the key update frequency according to different network environment factors. In some network environments, especially those with high latency or unstable bandwidth, key updates may need to be performed more frequently to resist the risk of attacks caused by environmental factors. The significance of this step is that the reference model provides reasonable key update standards under different environmental conditions, allowing the system to dynamically adjust the key update strategy to ensure security in various environments. During specific implementation, the system will set the key update frequency requirements based on the network delay records in the historical operation log and the standard update frequency in the reference model.

[0076] The step of quantifying the degree of deviation between the actual key update frequency and the standard key update frequency and using it as the second correction factor is to reflect the security of the key security key associated with the potential risk vulnerability through the degree of deviation. If the degree of deviation indicates that the update frequency of the key security key is high, it means that the key has been updated in time and the potential risk vulnerability is less vulnerable, so the initial assessment parameters of the vulnerability can be appropriately lowered; on the contrary, if the degree of deviation is large, it means that the key update frequency is insufficient and the potential risk vulnerability may be vulnerable to attack. At this time, the initial assessment parameters should be increased to increase the priority of vulnerability repair.

[0077] The reference model refers to a key update cycle model based on industry standards and best practices. The model sets corresponding key update cycles for different types of encryption algorithms, and includes the standard update frequency for the key type used by each encryption algorithm. The reference model will also make appropriate adjustments to the key update cycle based on different network environment factors (such as network latency, bandwidth fluctuations, data transmission speed, etc.) to ensure that the update frequency of encryption keys in various operating environments can effectively respond to potential attack risks. The model integrates the industry's best practices and security standards, making it widely applicable and effective.

[0078] Furthermore, the payment data security assessment system further includes: The preliminary index correction module 500 is used to perform dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability by combining the first correction factor and the second correction factor.

[0079] Specifically, Figure 8 It shows a structural block diagram of the preliminary index correction module 500 in the system provided by an embodiment of the present invention.

[0080] Among them, in the preferred embodiment provided by the present invention, the preliminary index correction module 500 specifically includes: The initial assessment index correction unit 501 is used to retrieve the assessment index correction formula, and perform double optimization correction on the initial risk priority assessment index of the potential risk vulnerability by combining the first correction factor and the second correction factor to obtain an optimized risk priority assessment index; An optimization assessment index application unit 502 is used to apply the optimized risk priority assessment index to vulnerability repair priority sorting; The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0081] In an embodiment of the present invention, the preliminary risk priority assessment index of the potential risk vulnerability is double optimized and corrected by combining the first correction factor and the second correction factor, mainly to comprehensively consider the exposure of the vulnerability, the hysteresis effect and the effectiveness of key management. The first correction factor mainly reflects the hysteresis effect based on the change in the frequency of vulnerability exposure. Through this factor, security threats that gradually emerge over time can be identified. The second correction factor evaluates the security of the encryption key by analyzing the deviation between the key update frequency and the standard update frequency, thereby providing dynamic adjustment for the priority of vulnerability repair. The combination of the two can comprehensively evaluate the potential harmfulness of the vulnerability and make comprehensive priority adjustments based on different security factors. There is a good linkage relationship between the first correction factor and the second correction factor, that is, the vulnerability exposure trend reflected by the hysteresis effect and the key management effectiveness reflected by the key update frequency complement each other and jointly affect the priority of vulnerability repair.

[0082] This dual correction mechanism can effectively improve the accuracy and timeliness of vulnerability repair, so that repair measures can prioritize those vulnerabilities that are truly high-risk and potential threats. This approach can avoid the limitations of a single factor and ensure that the priority of vulnerability repair is more scientific and reasonable in a complex environment.

[0083] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0084] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0085] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0086] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0087] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A payment data security assessment method, characterized in that: The method comprises: After performing vulnerability scanning and penetration testing on the payment data storage system, determine a number of security defects found in the scan, obtain a preliminary risk priority assessment index assigned to each security defect, and obtain historical operation logs of the payment data storage system; Screen several security flaws based on historical operation logs, and identify potential risk vulnerabilities related to encryption algorithms, which exist for longer than a predetermined period and are exposed in network delay conditions; Analyze the change in exposure frequency of potential risk vulnerabilities within a predetermined period, quantify the change in exposure frequency, and obtain a first correction factor related to the hysteresis effect; Select the key encryption key of the potential risk vulnerability, determine the standard key update frequency corresponding to the key encryption key, and the actual key update frequency within the predetermined period, quantify the deviation between the actual key update frequency and the standard key update frequency, and use it as the second correction factor; Combining the first correction factor and the second correction factor, the preliminary risk priority assessment index of the potential risk vulnerability is doubly optimized and corrected.

2. The payment data security assessment method according to claim 1, characterized in that: The steps of analyzing the exposure frequency change of the potential risk vulnerability within a predetermined period, quantifying the exposure frequency change, and obtaining the first correction factor related to the hysteresis effect include: Divide the scheduled period into several time periods of equal length, and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs; Based on each time period and its corresponding exposure frequency, draw an exposure frequency change curve reflecting the hysteresis effect, and use the change curve as a visualization of the change in exposure frequency of potential risk vulnerabilities within a predetermined period; The average slope of the variation curve was calculated and used as the first correction factor related to the hysteresis effect.

3. The payment data security assessment method according to claim 2, characterized in that: The steps of selecting a key encryption key of a potential risk vulnerability, determining a standard key update frequency corresponding to the key encryption key and an actual key update frequency within a predetermined period, quantifying the degree of deviation between the actual key update frequency and the standard key update frequency, and using it as a second correction factor include: Parse historical operation logs, determine the key encryption keys associated with potential risk vulnerabilities based on vulnerability types and encryption operation modes, read key usage records in historical operation logs, and determine the actual key update frequency of potential risk vulnerabilities within a predetermined period; Retrieve the preset reference model to determine the standard key update frequency of key encryption keys under the same network latency environment as the potential risk vulnerability; The deviation between the actual key update frequency and the standard key update frequency is quantified and used as the second correction factor.

4. The payment data security assessment method according to claim 3, characterized in that: The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets encryption keys corresponding to different types of encryption algorithms and corresponding standard key update frequencies in different network environments.

5. The payment data security assessment method according to claim 4, characterized in that: Combining the first correction factor and the second correction factor, the steps of double optimizing and correcting the preliminary risk priority assessment index of the potential risk vulnerability include: Retrieve the assessment index correction formula, and combine the first correction factor and the second correction factor to perform double optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability to obtain an optimized risk priority assessment index; Apply the optimized risk priority assessment index to vulnerability repair priority sorting.

6. The payment data security assessment method according to claim 5, characterized in that: The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

7. A payment data security assessment system, characterized in that: The system comprises: a data acquisition module, a vulnerability screening module, a first correction factor determination module, a second correction factor determination module and a preliminary index correction module, wherein: A data acquisition module, used to determine a number of security defects found after performing vulnerability scanning and penetration testing operations on the payment data storage system, and obtain a preliminary risk priority assessment index assigned to each security defect, and obtain a historical operation log of the payment data storage system; The vulnerability screening module is used to screen a number of security defects based on historical operation logs, and screen out potential risk vulnerabilities related to encryption algorithms, which exist for more than a predetermined period and are exposed in network delay conditions; A first correction factor determination module is used to analyze the exposure frequency change of the potential risk vulnerability within a predetermined period, quantify the exposure frequency change, and obtain a first correction factor related to the hysteresis effect; A second correction factor determination module is used to select a key encryption key of a potential risk vulnerability, determine a standard key update frequency corresponding to the key encryption key, and an actual key update frequency within a predetermined period, quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use it as a second correction factor; The preliminary index correction module is used to combine the first correction factor and the second correction factor to perform dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability.

8. The payment data security assessment system according to claim 7, characterized in that: The first correction factor determination module specifically includes: The exposure frequency statistics unit is used to divide the scheduled period into several time periods of equal length, and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs; A change curve drawing unit is used to draw an exposure frequency change curve reflecting the hysteresis effect based on each time period and its corresponding exposure frequency, and use the change curve as a visual representation of the change of exposure frequency of potential risk vulnerabilities within a predetermined period; The average slope calculation unit is used to calculate the average slope of the change curve and use it as the first correction factor related to the hysteresis effect.

9. The payment data security assessment system according to claim 8, characterized in that: The second correction factor determination module specifically includes: An actual key update frequency determination unit is used to parse historical operation logs, determine the key encryption key associated with the potential risk vulnerability according to the vulnerability type and the encryption operation mode, and read the key usage record in the historical operation logs to determine the actual key update frequency of the potential risk vulnerability within a predetermined period; A standard key update frequency determination unit, used to call a preset reference model to determine a standard key update frequency of a critical encryption key under a network delay environment that is the same as the potential risk vulnerability; a deviation degree quantification unit, used to quantify the deviation degree between the actual key update frequency and the standard key update frequency, and use it as a second correction factor; The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets encryption keys corresponding to different types of encryption algorithms and corresponding standard key update frequencies in different network environments.

10. The payment data security assessment system according to claim 9, characterized in that: The preliminary index correction module specifically includes: The initial assessment index correction unit is used to retrieve the assessment index correction formula, and combine the first correction factor and the second correction factor to perform double optimization correction on the initial risk priority assessment index of the potential risk vulnerability to obtain an optimized risk priority assessment index; An optimization assessment index application unit, used to apply the optimized risk priority assessment index to vulnerability repair priority sorting; The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

Images