Payment data security assessment method and system

Abstract

This invention applies to the field of payment data system vulnerability assessment technology and provides a payment data security assessment method and system. The method comprises: after performing vulnerability scanning and penetration testing on a payment data storage system, identifying a number of security vulnerabilities detected, assigning a preliminary risk priority assessment index to each security vulnerability, and simultaneously obtaining historical operation logs of the payment data storage system. By introducing a dual correction factor mechanism, the present invention optimizes the remediation priority assessment of potential risk vulnerabilities in the payment data storage system. First, by combining a hysteresis correction factor with a key update frequency deviation correction factor, the accuracy and timeliness of vulnerability remediation are effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of payment data system vulnerability assessment, and in particular relates to a payment data security assessment method and system. Background Art

[0002] Payment data security is a core issue in the information technology field. With the widespread use of payment systems, ensuring the security of payment data has become a major challenge facing enterprises and organizations. Currently, existing technologies mainly identify potential security flaws in payment systems through methods such as vulnerability scanning and penetration testing. The goal of vulnerability prioritization is to classify these security flaws and assign them priorities based on factors such as potential risk, attack likelihood, and degree of harm, so that system administrators can take appropriate measures. These measures include not only vulnerability remediation, but also various response methods such as enhanced monitoring, data encryption, and access control. However, existing vulnerability prioritization methods typically rely solely on static scanning results and do not consider the dynamic changes in vulnerability exposure or the impact of the external environment.

[0003] Existing vulnerability priority assessment methods are mostly based on static scanning or fixed rule-based models, ignoring the changing vulnerability exposure over time and under different circumstances. This is particularly true for cryptographic algorithm-related vulnerabilities, which may not immediately present a threat. However, over time, particularly with improper key management, the frequency and severity of vulnerability exposure may gradually increase. Existing technologies do not dynamically adjust remediation priorities based on changes in vulnerability exposure frequency and deviations in key update frequency, potentially leading to some long-standing vulnerabilities not being fixed in a timely manner, increasing the risk of system attacks.

[0004] Therefore, existing technologies for vulnerability prioritization have several flaws. First, they fail to consider changes in vulnerability exposure frequency over time, failing to accurately reflect the dynamics of vulnerability risk. Second, they fail to adjust vulnerability priorities based on the effectiveness of key updates, potentially leading to certain vulnerabilities caused by poor key management not receiving timely attention. Consequently, existing technologies are unable to comprehensively assess the actual risk of vulnerabilities and implement the most appropriate response measures, such as remediation, encryption, isolation, and monitoring, to effectively safeguard the security of payment data storage systems. Summary of the Invention

[0005] The purpose of the present invention is to provide a payment data security assessment method and system, aiming to solve the problems raised in the background technology.

[0006] The present invention is implemented as follows: a payment data security assessment method, the method comprising:

[0007] After performing vulnerability scanning and penetration testing on the payment data storage system, identify several security flaws found in the scan, obtain a preliminary risk priority assessment index assigned to each security flaw, and simultaneously obtain historical operation logs of the payment data storage system;

[0008] Screen several security flaws based on historical operation logs and identify potential risk vulnerabilities related to encryption algorithms, existing for longer than a predetermined period, and exposed in network latency conditions;

[0009] Analyze the changes in the exposure frequency of potential risk vulnerabilities within a predetermined period, quantify the changes in the exposure frequency, and obtain a first correction factor related to the hysteresis effect;

[0010] Select the key encryption key with the potential risk vulnerability, determine the standard key update frequency corresponding to the key encryption key, and the actual key update frequency within the predetermined period, quantify the deviation between the actual key update frequency and the standard key update frequency, and use it as the second correction factor;

[0011] Combining the first correction factor and the second correction factor, the preliminary risk priority assessment index of the potential risk vulnerability is doubly optimized and corrected.

[0012] As a further limitation of the technical solution of the embodiment of the present invention, the steps of analyzing the exposure frequency change of the potential risk vulnerability within a predetermined period, quantifying the exposure frequency change, and obtaining a first correction factor related to the hysteresis effect include:

[0013] Divide the scheduled period into several time periods of equal length, and count the frequency of potential risk vulnerabilities exposed in each time period based on historical operation logs;

[0014] Based on each time period and its corresponding exposure frequency, draw an exposure frequency change curve reflecting the hysteresis effect, and use this change curve as a visualization of the change in exposure frequency of potential risk vulnerabilities within a predetermined period;

[0015] The average slope of the variation curve is calculated and used as the first correction factor related to the hysteresis effect.

[0016] As a further limitation of the technical solution of the embodiment of the present invention, the steps of selecting a critical encryption key for a potential risk vulnerability, determining a standard key update frequency corresponding to the critical encryption key and an actual key update frequency within a predetermined period, quantifying a degree of deviation between the actual key update frequency and the standard key update frequency, and using the deviation as a second correction factor include:

[0017] Parse historical operation logs to determine the critical encryption keys associated with potential risk vulnerabilities based on vulnerability type and encryption operation mode. At the same time, read key usage records in historical operation logs and determine the actual key update frequency of potential risk vulnerabilities within a predetermined period.

[0018] Retrieve a preset reference model to determine the standard rekey frequency for critical encryption keys under the same network latency environment as the potential risk vulnerability;

[0019] The deviation between the actual key update frequency and the standard key update frequency is quantified and used as the second correction factor.

[0020] As a further limitation of the technical solution of the embodiment of the present invention, the reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets the encryption keys corresponding to different types of encryption algorithms and the corresponding standard key update frequencies in different network environments.

[0021] As a further limitation of the technical solution of the embodiment of the present invention, the step of performing dual optimization and correction on the preliminary risk priority assessment index of the potential risk vulnerability by combining the first correction factor and the second correction factor includes:

[0022] Retrieve the assessment index correction formula, and combine the first correction factor and the second correction factor to perform double optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability to obtain the optimized risk priority assessment index;

[0023] Apply the optimized risk priority assessment index to vulnerability repair priority sorting.

[0024] As a further limitation of the technical solution of the embodiment of the present invention, the evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial Refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0025] A payment data security assessment system includes: a data acquisition module, a vulnerability screening module, a first correction factor determination module, a second correction factor determination module, and a preliminary index correction module, wherein:

[0026] A data acquisition module is used to determine a number of security flaws found after vulnerability scanning and penetration testing of the payment data storage system, obtain a preliminary risk priority assessment index assigned to each security flaw, and obtain historical operation logs of the payment data storage system;

[0027] The vulnerability screening module is used to screen several security flaws based on historical operation logs, and screen out potential risk vulnerabilities related to encryption algorithms, which have existed for more than a predetermined period and are exposed in network delay conditions;

[0028] A first correction factor determination module is used to analyze the exposure frequency change of the potential risk vulnerability within a predetermined period, quantify the exposure frequency change, and obtain a first correction factor related to the hysteresis effect;

[0029] a second correction factor determination module, configured to select a key encryption key for a potential risk vulnerability, determine a standard key update frequency corresponding to the key encryption key, and an actual key update frequency within a predetermined period, quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use the deviation as a second correction factor;

[0030] The preliminary index correction module is used to combine the first correction factor and the second correction factor to perform dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability.

[0031] As a further limitation of the technical solution of the embodiment of the present invention, the first correction factor determination module specifically includes:

[0032] The exposure frequency statistics unit is used to divide the scheduled period into several time periods of equal length and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs;

[0033] A change curve drawing unit is used to draw an exposure frequency change curve reflecting the hysteresis effect based on each time period and its corresponding exposure frequency, and use the change curve as a visual representation of the change in exposure frequency of the potential risk vulnerability within a predetermined period;

[0034] The average slope calculation unit is used to calculate the average slope of the change curve and use it as a first correction factor related to the hysteresis effect.

[0035] As a further limitation of the technical solution of the embodiment of the present invention, the second correction factor determination module specifically includes:

[0036] An actual key update frequency determination unit is used to parse historical operation logs, determine the key encryption key associated with the potential risk vulnerability based on the vulnerability type and encryption operation mode, and read the key usage records in the historical operation logs to determine the actual key update frequency of the potential risk vulnerability within a predetermined period;

[0037] a standard key update frequency determination unit, configured to retrieve a preset reference model and determine a standard key update frequency for a key encryption key under a network latency environment that is the same as that of a potential risk vulnerability;

[0038] a deviation degree quantification unit, configured to quantify the deviation degree between the actual key update frequency and the standard key update frequency and use it as a second correction factor;

[0039] The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets the encryption keys corresponding to different types of encryption algorithms and the standard key update frequency corresponding to different network environments.

[0040] As a further limitation of the technical solution of the embodiment of the present invention, the preliminary index correction module specifically includes:

[0041] An initial assessment index correction unit is used to retrieve the assessment index correction formula and, by combining the first correction factor and the second correction factor, perform double optimization correction on the initial risk priority assessment index of the potential risk vulnerability to obtain an optimized risk priority assessment index;

[0042] An optimization assessment index application unit, used to apply the optimized risk priority assessment index to vulnerability repair priority sorting;

[0043] The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial Refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] This invention optimizes the remediation priority assessment for potential risk vulnerabilities in payment data storage systems by introducing a dual correction factor mechanism. First, by combining the hysteresis effect correction factor with the key update frequency deviation correction factor, the accuracy and timeliness of vulnerability remediation are effectively improved. The hysteresis effect correction factor identifies security threats that gradually emerge over time, ensuring that the system prioritizes long-standing and gradually intensifying vulnerabilities. The key update frequency deviation correction factor dynamically adjusts the priority of vulnerability remediation based on the effectiveness of key management, preventing security risks caused by insufficient key updates.

[0046] By comprehensively considering changes in vulnerability exposure and deviations in key update frequency, this method enables a more scientific assessment of the true risk of vulnerabilities, ensuring precise and efficient remediation measures. This approach avoids the limitations of a single factor, enhances the intelligence level of vulnerability remediation, and has significant practical significance and application value for enhancing the overall security of payment data storage systems. Furthermore, the system's real-time nature and automation further reduce the errors and workload of manual assessments, improving security management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flowchart of a method provided by an embodiment of the present invention;

[0048] Figure 2 A flow chart of generating a first correction factor in the method provided in an embodiment of the present invention;

[0049] Figure 3 A flow chart of generating a second correction factor in the method provided in an embodiment of the present invention;

[0050] Figure 4 A flowchart of modifying a preliminary risk priority assessment index in the method provided in an embodiment of the present invention;

[0051] Figure 5 An application architecture diagram of the system provided by an embodiment of the present invention;

[0052] Figure 6 A structural block diagram of a first correction factor determination module in a system provided by an embodiment of the present invention;

[0053] Figure 7 A structural block diagram of a second correction factor determination module in a system provided by an embodiment of the present invention;

[0054] Figure 8 This is a structural block diagram of the preliminary index correction module in the system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0056] Figure 1 A flow chart of a method provided by an embodiment of the present invention is shown.

[0057] Specifically, a payment data security assessment method includes the following steps:

[0058] Step S100, after performing vulnerability scanning and penetration testing operations on the payment data storage system, determine a number of security defects scanned, obtain a preliminary risk priority assessment index assigned to each security defect, and simultaneously obtain a historical operation log of the payment data storage system.

[0059] In an embodiment of the present invention, vulnerability scanning and penetration testing of a payment data storage system refers to the use of automated tools to conduct comprehensive security checks on the payment data storage system to identify potential security vulnerabilities. Specifically, vulnerability scanning typically involves static and dynamic analysis of components such as systems, applications, and databases to detect potential weaknesses or known vulnerabilities. Penetration testing simulates attacker behavior and conducts actual penetration testing to assess the system's protection capabilities and the potential for exploitation of vulnerabilities. Vulnerability scanning and penetration testing are commonly performed using tools such as network scanning tools (e.g., Nessus, OpenVAS), application vulnerability scanning tools (e.g., Burp Suite, OWASP ZAP), and manual penetration testing techniques. These tools and techniques can help security personnel identify potential security risks in the system and implement appropriate remedial measures.

[0060] Security flaws typically refer to vulnerabilities or weaknesses in payment data storage systems that could be exploited by attackers. These flaws may involve issues with encryption algorithms, identity authentication, data storage, access control, and other aspects. In an embodiment of the present invention, a preliminary risk priority assessment index for security flaws is derived based on a preliminary assessment of multiple factors, including vulnerability severity, scope of impact, exploitability, and potential security risk. The calculation of this assessment index can refer to existing risk assessment models or frameworks, such as CVSS (Common Vulnerability Scoring System), or customized scoring methods based on specific organizational security policies. These risk assessment models are widely used in existing technologies and are combined with historical attack data or the specific characteristics of the vulnerability to assign a priority index. This method can quantify the remediation priority of different vulnerabilities in the system, thereby helping system administrators determine which vulnerabilities require priority remediation.

[0061] The historical operation logs of the payment data storage system are detailed records of all operations and events recorded during the system's operation. These logs typically include various transaction information that occurred in the system, user access records, system resource usage, database query and update records, etc.

[0062] Historical operation logs are detailed logs of key operations and events recorded in the payment data storage system. In addition to routine system operations, they should also include data related to encryption algorithms and key management. These logs record the time of encryption operations, the type of algorithm used, and key generation and updates, helping to analyze encryption algorithm vulnerabilities and key management issues.

[0063] Logs should also include vulnerability exposure records, specifically the frequency and timing of potential vulnerabilities, to support analysis of vulnerability changes within a predetermined period. Logs should also record key usage frequency and update times, assisting in screening critical encryption keys and assessing key update frequency. Recording encryption operation modes can help determine vulnerability types and encryption methods.

[0064] If the system operates in an environment with high network latency, the logs should include network performance data, such as latency and bandwidth fluctuations, to support analysis of changes in vulnerability exposure in such an environment. In general, historical operation logs provide essential data support for vulnerability screening, key management, and priority assessment.

[0065] Furthermore, the payment data security assessment method further includes the following steps:

[0066] In step S200, a number of security flaws are screened based on historical operation logs, and potential risk vulnerabilities that are related to encryption algorithms, have existed for more than a predetermined period, and are exposed in network delay conditions are screened out.

[0067] In this embodiment of the present invention, potential risk vulnerabilities related to encryption algorithms, existing for longer than a predetermined period, and exposed in network delay conditions are screened out primarily to accurately identify vulnerabilities that have existed for a long time and whose risks are exacerbated in specific environments. Encryption algorithms are central to protecting payment data security; vulnerabilities in encryption algorithms can lead to data leakage or tampering. Over time, some encryption vulnerabilities may gradually become exposed, especially when key management is improper or algorithm design is flawed. These vulnerabilities may be discovered by attackers during long-term use. Therefore, screening out vulnerabilities that have existed for longer than a predetermined period can provide early warning of potential security risks.

[0068] Furthermore, vulnerabilities exposed in environments with high network latency present unique challenges. This is because high network latency provides attackers with more time to conduct malicious attempts and probe. In such environments, the exposure of vulnerabilities can be magnified by the latency, making it difficult to detect and mitigate attacks in real time. Cryptographic algorithm vulnerabilities can be even more difficult to detect in such environments, and the probability of successful attacks is higher. Therefore, screening for these vulnerabilities helps identify potential risks promptly and implement effective remediation measures.

[0069] Furthermore, the payment data security assessment method further includes the following steps:

[0070] Step S300 , analyzing the exposure frequency change of the potential risk vulnerability within a predetermined period, quantifying the exposure frequency change, and obtaining a first correction factor related to the hysteresis effect.

[0071] Specifically, Figure 2 A flow chart for generating a first correction factor is shown.

[0072] Analyzing the exposure frequency change of the potential risk vulnerability within a predetermined period, quantifying the exposure frequency change, and obtaining the first correction factor related to the hysteresis effect specifically includes the following steps:

[0073] Step S301: Divide the predetermined period into several time periods of equal length, and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs;

[0074] Step S302: Based on each time period and its corresponding exposure frequency, draw an exposure frequency change curve reflecting the hysteresis effect, and use the change curve as a visualization of the exposure frequency change of the potential risk vulnerability within a predetermined period;

[0075] Step S303: Calculate the average slope of the change curve and use it as a first correction factor related to the hysteresis effect.

[0076] In this embodiment of the present invention, the hysteresis effect refers to the fact that the exposure of certain vulnerabilities or risks does not occur immediately, but rather increases gradually over time. In particular, in cryptographic algorithms and key management, vulnerabilities may not initially pose a significant threat, but over time and with continued attacker attempts, their exposure may gradually increase. The hysteresis effect reflects the impact of this time delay, helping us identify potential vulnerabilities that gradually become exposed over a specific period of time.

[0077] Through steps S301 and S302, the predetermined period is divided into several time periods of equal length, and the exposure frequency of potential risk vulnerabilities in each time period is counted based on historical operation logs, which enables the system to more accurately analyze the changes in vulnerabilities in different time periods. This process of dividing and drawing change curves allows the changes in exposure frequency to be quantified and visualized, thereby helping to discover trends and patterns in vulnerability exposure. By converting the exposure frequency of a time period into a change curve, you can intuitively see whether the vulnerability shows a trend of gradually intensifying, as well as the changes in exposure frequency in different time periods. In this way, the system can accurately capture potential lag effects, thereby providing a basis for subsequent priority corrections.

[0078] Generating a first correction factor related to hysteresis effects in this way effectively and dynamically adjusts the remediation priority of potential risk vulnerabilities. This correction factor reflects the timeliness of vulnerability exposure and the gradual increase in risk, helping the system identify vulnerabilities that initially go unnoticed but whose impact gradually increases over time. The introduction of this correction factor improves the timeliness of vulnerability remediation, ensuring that vulnerabilities with hysteresis effects are fixed promptly, thereby reducing security risks in the long-term operation of the system.

[0079] Furthermore, the payment data security assessment method further includes the following steps:

[0080] In step S400, a key encryption key of a potential risk vulnerability is selected, a standard key update frequency corresponding to the key encryption key and an actual key update frequency within a predetermined period are determined, the degree of deviation between the actual key update frequency and the standard key update frequency is quantified, and the deviation is used as a second correction factor.

[0081] Specifically, Figure 3 A flow chart for generating a second correction factor is shown.

[0082] The steps of selecting a key encryption key for a potential risk vulnerability, determining a standard key update frequency corresponding to the key encryption key and an actual key update frequency within a predetermined period, quantifying the degree of deviation between the actual key update frequency and the standard key update frequency, and using the deviation as a second correction factor specifically include the following steps:

[0083] Step S401: Parse the historical operation logs to determine the key encryption key associated with the potential risk vulnerability based on the vulnerability type and encryption operation mode. Simultaneously, read the key usage records in the historical operation logs and determine the actual key update frequency of the potential risk vulnerability within a predetermined period.

[0084] Step S402 , calling a preset reference model to determine a standard key update frequency for a key encryption key under the same network latency environment as the potential risk vulnerability;

[0085] Step S403: quantify the deviation between the actual key update frequency and the standard key update frequency, and use it as a second correction factor.

[0086] In the embodiments of the present invention, critical encryption keys are selected based on the vulnerability type and encryption operation mode to identify encryption keys associated with potential vulnerabilities. These critical encryption keys are typically the most core keys involved in data protection, authentication, and encryption algorithms. For example, data encryption keys, key exchange keys, and signature keys are crucial for the confidentiality and integrity of payment data. The selection of these keys is significant because they directly impact the security of encryption operations and vulnerability remediation strategies. Therefore, their update frequency must be evaluated to ensure that key management meets security requirements and relevant vulnerabilities are promptly remediated.

[0087] The purpose of calling the preset reference model to determine the standard key update frequency of critical encryption keys under the same network latency environment as the potential risk vulnerability is to adjust the key update frequency according to different network environment factors. In certain network environments, especially those with high latency or unstable bandwidth, key updates may need to be performed more frequently to defend against attack risks caused by environmental factors. The significance of this step is that the reference model provides reasonable key update standards under different environmental conditions, allowing the system to dynamically adjust the key update strategy to ensure security in various environments. During specific implementation, the system will set the key update frequency requirements based on the network delay records in the historical operation log and the standard update frequency in the reference model.

[0088] The purpose of quantifying the deviation between the actual key update frequency and the standard key update frequency and using it as a second correction factor is to reflect the security of the critical security keys associated with the potential risk vulnerability through the degree of deviation. If the deviation indicates that the critical security key is updated frequently, it means that the key is updated promptly and the potential risk vulnerability is less vulnerable. Therefore, the initial vulnerability assessment parameters can be appropriately lowered. Conversely, if the deviation is large, it indicates that the key update frequency is insufficient and the potential risk vulnerability may be vulnerable to attack. In this case, the initial assessment parameters should be increased to prioritize the vulnerability remediation.

[0089] The reference model is a rekeying cycle model based on industry standards and best practices. This model defines rekeying cycles for different encryption algorithms and includes standard update frequencies for the key types used by each encryption algorithm. The model also adjusts rekeying cycles based on network factors (such as latency, bandwidth fluctuations, and data transmission speeds) to ensure that the rekeying frequency effectively addresses potential attacks in various operating environments. This model incorporates industry best practices and security standards, making it widely applicable and effective.

[0090] Furthermore, the payment data security assessment method further includes the following steps:

[0091] Step S500 : Combining the first correction factor and the second correction factor, a double optimization correction is performed on the preliminary risk priority assessment index of the potential risk vulnerability.

[0092] Specifically, Figure 4 A flow chart showing the revision of the preliminary risk priority assessment index.

[0093] The following steps are specifically used to perform dual optimization and correction on the preliminary risk priority assessment index of potential risk vulnerabilities by combining the first correction factor and the second correction factor:

[0094] Step S501: Retrieve the evaluation index correction formula, and perform dual optimization correction on the preliminary risk priority evaluation index of the potential risk vulnerability by combining the first correction factor and the second correction factor to obtain an optimized risk priority evaluation index;

[0095] Step S502: Apply the optimized risk priority assessment index to vulnerability repair priority sorting.

[0096] The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial Refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0097] In an embodiment of the present invention, the preliminary risk priority assessment index of the potential risk vulnerability is double-optimized and corrected by combining the first correction factor and the second correction factor, mainly to comprehensively consider the exposure of the vulnerability, the hysteresis effect and the effectiveness of key management. The first correction factor mainly reflects the hysteresis effect based on the change in the frequency of vulnerability exposure. Through this factor, security threats that gradually emerge over time can be identified. The second correction factor evaluates the security of the encryption key by analyzing the deviation between the key update frequency and the standard update frequency, thereby providing dynamic adjustment for the priority of vulnerability repair. The combination of the two can comprehensively evaluate the potential harmfulness of the vulnerability and make comprehensive priority adjustments based on different security factors. There is a good linkage relationship between the first correction factor and the second correction factor, that is, the vulnerability exposure trend reflected by the hysteresis effect and the key management effectiveness reflected by the key update frequency complement each other and jointly affect the priority of vulnerability repair.

[0098] This dual-correction mechanism effectively improves the accuracy and timeliness of vulnerability remediation, prioritizing remediation efforts for those vulnerabilities that pose the highest risk and present the greatest potential threat. This approach avoids the limitations of a single factor and ensures a more scientific and rational approach to vulnerability remediation priorities in complex environments.

[0099] The following is a detailed example showing the process from obtaining initial parameters to final optimization:

[0100] When evaluating a potential risk vulnerability, we first determine an initial risk priority assessment index of 50. Next, based on historical operation logs and network latency, we analyze the vulnerability exposure and calculate two correction factors to optimize the vulnerability remediation priority.

[0101] First, consider the change in vulnerability exposure frequency. Assume our assessment period is divided into six months, and the vulnerability is detected 3, 4, 5, 6, 7, and 8 times each month. Analyzing this data, we find that the average slope of the change in vulnerability exposure frequency is 1.5. This slope reflects the gradual increase in vulnerability exposure, indicating that vulnerability exposure increases over time. This slope, as the first correction factor, accounts for the lag effect of vulnerability exposure.

[0102] Next, consider the update frequency of the critical encryption key associated with this vulnerability. While the standard key update frequency requires updates every three months, historical operation logs indicate that the key is actually updated every six months. The calculated deviation between the actual update frequency and the standard update frequency is 1, which serves as the second correction factor. A large deviation indicates an infrequent key update, potentially increasing the risk of this vulnerability.

[0103] By combining these two correction factors, we ultimately optimized the initial priority assessment index. Specifically, when both the first correction factor (the change in vulnerability exposure frequency) and the second correction factor (the deviation in key update frequency) were taken into account, the optimized risk priority assessment index significantly improved. This indicates that the vulnerability's remediation priority needs to be increased to ensure timely resolution.

[0104] Further, Figure 5 The application architecture diagram of the system provided by the embodiment of the present invention is shown.

[0105] In another preferred embodiment of the present invention, a payment data security assessment system includes:

[0106] The data acquisition module 100 is used to determine a number of security defects scanned after performing vulnerability scanning and penetration testing operations on the payment data storage system, and obtain a preliminary risk priority assessment index assigned to each security defect, and at the same time obtain the historical operation log of the payment data storage system.

[0107] In an embodiment of the present invention, vulnerability scanning and penetration testing of a payment data storage system refers to the use of automated tools to conduct comprehensive security checks on the payment data storage system to identify potential security vulnerabilities. Specifically, vulnerability scanning typically involves static and dynamic analysis of components such as systems, applications, and databases to detect potential weaknesses or known vulnerabilities. Penetration testing simulates attacker behavior and conducts actual penetration testing to assess the system's protection capabilities and the potential for exploitation of vulnerabilities. Vulnerability scanning and penetration testing are commonly performed using tools such as network scanning tools (e.g., Nessus, OpenVAS), application vulnerability scanning tools (e.g., Burp Suite, OWASP ZAP), and manual penetration testing techniques. These tools and techniques can help security personnel identify potential security risks in the system and implement appropriate remedial measures.

[0108] Security flaws typically refer to vulnerabilities or weaknesses in payment data storage systems that could be exploited by attackers. These flaws may involve issues with encryption algorithms, identity authentication, data storage, access control, and other aspects. In an embodiment of the present invention, a preliminary risk priority assessment index for security flaws is derived based on a preliminary assessment of multiple factors, including vulnerability severity, scope of impact, exploitability, and potential security risk. The calculation of this assessment index can refer to existing risk assessment models or frameworks, such as CVSS (Common Vulnerability Scoring System), or customized scoring methods based on specific organizational security policies. These risk assessment models are widely used in existing technologies and are combined with historical attack data or the specific characteristics of the vulnerability to assign a priority index. This method can quantify the remediation priority of different vulnerabilities in the system, thereby helping system administrators determine which vulnerabilities require priority remediation.

[0109] The historical operation logs of the payment data storage system are detailed records of all operations and events recorded during the system's operation. These logs typically include various transaction information that occurred in the system, user access records, system resource usage, database query and update records, etc.

[0110] Historical operation logs are detailed logs of key operations and events recorded in the payment data storage system. In addition to routine system operations, they should also include data related to encryption algorithms and key management. These logs record the time of encryption operations, the type of algorithm used, and key generation and updates, helping to analyze encryption algorithm vulnerabilities and key management issues.

[0111] Logs should also include vulnerability exposure records, specifically the frequency and timing of potential vulnerabilities, to support analysis of vulnerability changes within a predetermined period. Logs should also record key usage frequency and update times, assisting in screening critical encryption keys and assessing key update frequency. Recording encryption operation modes can help determine vulnerability types and encryption methods.

[0112] If the system operates in an environment with high network latency, the logs should include network performance data, such as latency and bandwidth fluctuations, to support analysis of changes in vulnerability exposure in such an environment. In general, historical operation logs provide essential data support for vulnerability screening, key management, and priority assessment.

[0113] Furthermore, the payment data security assessment system further includes:

[0114] The vulnerability screening module 200 is used to screen a number of security defects based on historical operation logs, and screen out potential risk vulnerabilities that are related to encryption algorithms, have existed for more than a predetermined period, and are exposed in network delay conditions.

[0115] In this embodiment of the present invention, potential risk vulnerabilities related to encryption algorithms, existing for longer than a predetermined period, and exposed in network delay conditions are screened out primarily to accurately identify vulnerabilities that have existed for a long time and whose risks are exacerbated in specific environments. Encryption algorithms are central to protecting payment data security; vulnerabilities in encryption algorithms can lead to data leakage or tampering. Over time, some encryption vulnerabilities may gradually become exposed, especially when key management is improper or algorithm design is flawed. These vulnerabilities may be discovered by attackers during long-term use. Therefore, screening out vulnerabilities that have existed for longer than a predetermined period can provide early warning of potential security risks.

[0116] Furthermore, vulnerabilities exposed in environments with high network latency present unique challenges. This is because high network latency provides attackers with more time to conduct malicious attempts and probe. In such environments, the exposure of vulnerabilities can be magnified by the latency, making it difficult to detect and mitigate attacks in real time. Cryptographic algorithm vulnerabilities can be even more difficult to detect in such environments, and the probability of successful attacks is higher. Therefore, screening for these vulnerabilities helps identify potential risks promptly and implement effective remediation measures.

[0117] Furthermore, the payment data security assessment system further includes:

[0118] The first correction factor determination module 300 is used to analyze the exposure frequency change of the potential risk vulnerability within a predetermined period, quantify the exposure frequency change, and obtain a first correction factor related to the hysteresis effect.

[0119] Specifically, Figure 6 FIG. 4 shows a structural block diagram of the first correction factor determination module 300 in the system provided by an embodiment of the present invention.

[0120] In a preferred embodiment of the present invention, the first correction factor determination module 300 specifically includes:

[0121] The exposure frequency statistics unit 301 is used to divide the predetermined period into a number of time periods of equal length and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs;

[0122] The change curve drawing unit 302 is used to draw an exposure frequency change curve reflecting the hysteresis effect based on each time period and its corresponding exposure frequency, and use the change curve as a visual representation of the change in exposure frequency of the potential risk vulnerability within a predetermined period;

[0123] The average slope calculation unit 303 is used to calculate the average slope of the change curve and use it as a first correction factor related to the hysteresis effect.

[0124] In this embodiment of the present invention, the hysteresis effect refers to the fact that the exposure of certain vulnerabilities or risks does not occur immediately, but rather increases gradually over time. In particular, in cryptographic algorithms and key management, vulnerabilities may not initially pose a significant threat, but over time and with continued attacker attempts, their exposure may gradually increase. The hysteresis effect reflects the impact of this time delay, helping us identify potential vulnerabilities that gradually become exposed over a specific period of time.

[0125] By using the exposure frequency statistics unit 301 and the change curve drawing unit 302, the predetermined period is divided into several time periods of equal length, and the exposure frequency of potential risk vulnerabilities in each time period is counted based on the historical operation log, which enables the system to more accurately analyze the changes in vulnerabilities in different time periods. This process of dividing and drawing change curves allows the changes in exposure frequency to be quantified and visualized, thereby helping to discover trends and patterns in vulnerability exposure. By converting the exposure frequency of a time period into a change curve, you can intuitively see whether the vulnerability shows a trend of gradually intensifying, as well as the changes in exposure frequency in different time periods. In this way, the system can accurately capture potential lag effects, thereby providing a basis for subsequent priority corrections.

[0126] Generating a first correction factor related to hysteresis effects in this way effectively and dynamically adjusts the remediation priority of potential risk vulnerabilities. This correction factor reflects the timeliness of vulnerability exposure and the gradual increase in risk, helping the system identify vulnerabilities that initially go unnoticed but whose impact gradually increases over time. The introduction of this correction factor improves the timeliness of vulnerability remediation, ensuring that vulnerabilities with hysteresis effects are fixed promptly, thereby reducing security risks in the long-term operation of the system.

[0127] Furthermore, the payment data security assessment system further includes:

[0128] The second correction factor determination module 400 is used to select a critical encryption key for a potential risk vulnerability, determine the standard key update frequency corresponding to the critical encryption key, and the actual key update frequency within a predetermined period, quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use it as the second correction factor.

[0129] Specifically, Figure 7 FIG. 4 is a structural block diagram of a second correction factor determination module 400 in a system provided by an embodiment of the present invention.

[0130] In a preferred embodiment of the present invention, the second correction factor determination module 400 specifically includes:

[0131] The actual key update frequency determination unit 401 is configured to parse historical operation logs, determine the key encryption key associated with the potential risk vulnerability based on the vulnerability type and encryption operation mode, read the key usage records in the historical operation logs, and determine the actual key update frequency of the potential risk vulnerability within a predetermined period;

[0132] A standard key update frequency determination unit 402 is configured to retrieve a preset reference model and determine a standard key update frequency for a key encryption key under the same network latency environment as the potential risk vulnerability;

[0133] a deviation degree quantification unit 403, configured to quantify the deviation degree between the actual key update frequency and the standard key update frequency and use it as a second correction factor;

[0134] The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets the encryption keys corresponding to different types of encryption algorithms and the standard key update frequency corresponding to different network environments.

[0135] In the embodiments of the present invention, critical encryption keys are selected based on the vulnerability type and encryption operation mode to identify encryption keys associated with potential vulnerabilities. These critical encryption keys are typically the most core keys involved in data protection, authentication, and encryption algorithms. For example, data encryption keys, key exchange keys, and signature keys are crucial for the confidentiality and integrity of payment data. The selection of these keys is significant because they directly impact the security of encryption operations and vulnerability remediation strategies. Therefore, their update frequency must be evaluated to ensure that key management meets security requirements and relevant vulnerabilities are promptly remediated.

[0136] The purpose of calling the preset reference model to determine the standard key update frequency of critical encryption keys under the same network latency environment as the potential risk vulnerability is to adjust the key update frequency according to different network environment factors. In certain network environments, especially those with high latency or unstable bandwidth, key updates may need to be performed more frequently to defend against attack risks caused by environmental factors. The significance of this step is that the reference model provides reasonable key update standards under different environmental conditions, allowing the system to dynamically adjust the key update strategy to ensure security in various environments. During specific implementation, the system will set the key update frequency requirements based on the network delay records in the historical operation log and the standard update frequency in the reference model.

[0137] The purpose of quantifying the deviation between the actual key update frequency and the standard key update frequency and using it as a second correction factor is to reflect the security of the critical security keys associated with the potential risk vulnerability through the degree of deviation. If the deviation indicates that the critical security key is updated frequently, it means that the key is updated promptly and the potential risk vulnerability is less vulnerable. Therefore, the initial vulnerability assessment parameters can be appropriately lowered. Conversely, if the deviation is large, it indicates that the key update frequency is insufficient and the potential risk vulnerability may be vulnerable to attack. In this case, the initial assessment parameters should be increased to prioritize the vulnerability remediation.

[0138] The reference model is a rekeying cycle model based on industry standards and best practices. This model defines rekeying cycles for different encryption algorithms and includes standard update frequencies for the key types used by each encryption algorithm. The model also adjusts rekeying cycles based on network factors (such as latency, bandwidth fluctuations, and data transmission speeds) to ensure that the rekeying frequency effectively addresses potential attacks in various operating environments. This model incorporates industry best practices and security standards, making it widely applicable and effective.

[0139] Furthermore, the payment data security assessment system further includes:

[0140] The preliminary index correction module 500 is used to perform dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability by combining the first correction factor and the second correction factor.

[0141] Specifically, Figure 8 FIG. 5 shows a structural block diagram of a preliminary index correction module 500 in a system provided by an embodiment of the present invention.

[0142] In a preferred embodiment of the present invention, the preliminary index correction module 500 specifically includes:

[0143] The initial assessment index correction unit 501 is used to retrieve the assessment index correction formula and perform dual optimization correction on the initial risk priority assessment index of the potential risk vulnerability by combining the first correction factor and the second correction factor to obtain an optimized risk priority assessment index;

[0144] An optimized assessment index application unit 502 is configured to apply the optimized risk priority assessment index to vulnerability repair priority sorting;

[0145] The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial Refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

[0146] In an embodiment of the present invention, the preliminary risk priority assessment index of the potential risk vulnerability is double-optimized and corrected by combining the first correction factor and the second correction factor, mainly to comprehensively consider the exposure of the vulnerability, the hysteresis effect and the effectiveness of key management. The first correction factor mainly reflects the hysteresis effect based on the change in the frequency of vulnerability exposure. Through this factor, security threats that gradually emerge over time can be identified. The second correction factor evaluates the security of the encryption key by analyzing the deviation between the key update frequency and the standard update frequency, thereby providing dynamic adjustment for the priority of vulnerability repair. The combination of the two can comprehensively evaluate the potential harmfulness of the vulnerability and make comprehensive priority adjustments based on different security factors. There is a good linkage relationship between the first correction factor and the second correction factor, that is, the vulnerability exposure trend reflected by the hysteresis effect and the key management effectiveness reflected by the key update frequency complement each other and jointly affect the priority of vulnerability repair.

[0147] This dual-correction mechanism effectively improves the accuracy and timeliness of vulnerability remediation, prioritizing remediation efforts for those vulnerabilities that pose the highest risk and present the greatest potential threat. This approach avoids the limitations of a single factor and ensures a more scientific and rational approach to vulnerability remediation priorities in complex environments.

[0148] It should be understood that, although the various steps in the flow chart of each embodiment of the present invention are shown in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in order, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0149] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a non-volatile computer-readable storage medium. When executed, the program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the various embodiments provided herein may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM).

[0150] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0151] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

[0152] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A payment data security assessment method, characterized in that: The method comprises: After performing vulnerability scanning and penetration testing on the payment data storage system, identify several security flaws found in the scan, obtain a preliminary risk priority assessment index assigned to each security flaw, and simultaneously obtain historical operation logs of the payment data storage system; Screen several security flaws based on historical operation logs and identify potential risk vulnerabilities related to encryption algorithms, existing for longer than a predetermined period, and exposed in network latency conditions; Analyze the changes in the exposure frequency of potential risk vulnerabilities within a predetermined period, quantify the changes in the exposure frequency, and obtain a first correction factor related to the hysteresis effect; The specific steps include: Divide the scheduled period into several time periods of equal length, and count the frequency of potential risk vulnerabilities exposed in each time period based on historical operation logs; Based on each time period and its corresponding exposure frequency, draw an exposure frequency change curve reflecting the hysteresis effect, and use this change curve as a visualization of the change in exposure frequency of potential risk vulnerabilities within a predetermined period; The average slope of the change curve is calculated and used as the first correction factor related to the hysteresis effect; Select the key encryption key with the potential risk vulnerability, determine the standard key update frequency corresponding to the key encryption key, and the actual key update frequency within the predetermined period, quantify the deviation between the actual key update frequency and the standard key update frequency, and use it as the second correction factor; The specific steps include: Parse historical operation logs to determine the critical encryption keys associated with potential risk vulnerabilities based on vulnerability type and encryption operation mode. At the same time, read key usage records in historical operation logs and determine the actual key update frequency of potential risk vulnerabilities within a predetermined period. Retrieve a preset reference model to determine the standard rekey frequency for critical encryption keys under the same network latency environment as the potential risk vulnerability; Quantify the degree of deviation between the actual key update frequency and the standard key update frequency and use it as the second correction factor; Combining the first correction factor and the second correction factor, the preliminary risk priority assessment index of the potential risk vulnerability is doubly optimized and corrected.

2. The payment data security assessment method according to claim 1, characterized in that: The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets the encryption keys corresponding to different types of encryption algorithms and the standard key update frequency corresponding to different network environments.

3. The payment data security assessment method according to claim 2, characterized in that: The steps of performing dual optimization and correction on the preliminary risk priority assessment index of potential risk vulnerabilities by combining the first correction factor and the second correction factor include: Retrieve the assessment index correction formula, and combine the first correction factor and the second correction factor to perform double optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability to obtain the optimized risk priority assessment index; Apply the optimized risk priority assessment index to vulnerability repair priority sorting.

4. The payment data security assessment method according to claim 3, characterized in that: The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial Refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

5. A payment data security assessment system, characterized in that: The system includes: a data acquisition module, a vulnerability screening module, a first correction factor determination module, a second correction factor determination module, and a preliminary index correction module, wherein: A data acquisition module is used to determine a number of security flaws found after vulnerability scanning and penetration testing of the payment data storage system, obtain a preliminary risk priority assessment index assigned to each security flaw, and obtain historical operation logs of the payment data storage system; The vulnerability screening module is used to screen several security flaws based on historical operation logs, and screen out potential risk vulnerabilities related to encryption algorithms, which have existed for more than a predetermined period and are exposed in network delay conditions; A first correction factor determination module is used to analyze the exposure frequency change of the potential risk vulnerability within a predetermined period, quantify the exposure frequency change, and obtain a first correction factor related to the hysteresis effect; The first correction factor determination module specifically includes: The exposure frequency statistics unit is used to divide the scheduled period into several time periods of equal length and count the exposure frequency of potential risk vulnerabilities in each time period based on historical operation logs; A change curve drawing unit is used to draw an exposure frequency change curve reflecting the hysteresis effect based on each time period and its corresponding exposure frequency, and use the change curve as a visual representation of the change in exposure frequency of the potential risk vulnerability within a predetermined period; an average slope calculation unit, used for calculating the average slope of the change curve and using it as a first correction factor related to the hysteresis effect; a second correction factor determination module, configured to select a key encryption key for a potential risk vulnerability, determine a standard key update frequency corresponding to the key encryption key, and an actual key update frequency within a predetermined period, quantify the degree of deviation between the actual key update frequency and the standard key update frequency, and use the deviation as a second correction factor; The second correction factor determination module specifically includes: An actual key update frequency determination unit is used to parse historical operation logs, determine the key encryption key associated with the potential risk vulnerability based on the vulnerability type and encryption operation mode, and read the key usage records in the historical operation logs to determine the actual key update frequency of the potential risk vulnerability within a predetermined period; a standard key update frequency determination unit, configured to retrieve a preset reference model and determine a standard key update frequency for a key encryption key under a network latency environment that is the same as that of a potential risk vulnerability; a deviation degree quantification unit, configured to quantify the deviation degree between the actual key update frequency and the standard key update frequency and use it as a second correction factor; The preliminary index correction module is used to combine the first correction factor and the second correction factor to perform dual optimization correction on the preliminary risk priority assessment index of the potential risk vulnerability.

6. The payment data security assessment system according to claim 5, characterized in that: The preliminary index correction module specifically includes: An initial assessment index correction unit is used to retrieve the assessment index correction formula and, by combining the first correction factor and the second correction factor, perform double optimization correction on the initial risk priority assessment index of the potential risk vulnerability to obtain an optimized risk priority assessment index; An optimization assessment index application unit, used to apply the optimized risk priority assessment index to vulnerability repair priority sorting; The evaluation index correction formula is: , where P optimized Refers to the optimized risk priority assessment index, P initial Refers to the preliminary risk priority assessment index, S refers to the first correction factor, that is, the average slope of the change curve, and K1 is the adjustment weight of the first correction factor. It refers to the second correction factor, that is, the degree of deviation between the actual key update frequency and the standard key update frequency, and K2 refers to the adjustment weight of the second correction factor.

7. The payment data security assessment system according to claim 5, characterized in that: The reference model refers to a key update cycle model based on industry standards and best practices. The reference model sets the encryption keys corresponding to different types of encryption algorithms and the standard key update frequency corresponding to different network environments.

Images