A method and system for intelligent management of financial and tax data based on encrypted storage

Abstract

The present invention discloses a method and system for intelligent management of financial and tax data based on encrypted storage, which relates to the technical field of enterprise financial and tax management. The method includes: collecting financial and tax-related data from multiple channels through a data acquisition module, performing sensitivity assessment on the data, and classifying the sensitivity levels; key generation and encryption strategy setting, formulating corresponding encryption schemes according to the sensitivity levels of the data, including generating encryption keys and setting dynamic encryption strategies; data encryption and storage, using the acquired keys and encryption strategies to encrypt the financial and tax data and securely store the ciphertext; data access and dynamic encryption maintenance, providing controlled encrypted data access services and performing dynamic security maintenance on the stored data according to predetermined strategies. The present invention effectively improves the refinement, intelligence, and long-term compliance of financial and tax data protection.

Description

Technical Field

[0001] The present invention relates to the technical field of enterprise finance and taxation management, and in particular to a method and system for intelligent management of finance and taxation data based on encrypted storage. Background Art

[0002] As the digitalization of businesses and the electronicization of taxation accelerate, the volume, complexity, and sensitivity of financial and tax data, a crucial information asset for business operations and compliance, continue to increase. The security requirements for financial and tax data are becoming increasingly stringent, and relevant laws and regulations are placing higher demands on the collection, storage, use, and transfer of sensitive data.

[0003] Existing financial and tax data protection technologies primarily rely on static, unified encryption methods, lacking the ability to differentiate protection for data of varying sensitivity. Furthermore, traditional systems lack key management, dynamic updates, ciphertext retrieval, and compliance auditing capabilities, making them difficult to meet the demands of complex and ever-changing business scenarios. This can easily lead to data leaks, encryption failures, and audit tracing difficulties.

[0004] In response to the above problems, the present invention proposes a method and system for intelligent management of financial and tax data based on encrypted storage. Through multi-feature fusion sensitivity evaluation, dynamic encryption strategy decision-making, composite chaotic mapping and lattice key generation, ciphertext retrieval access and dynamic key rotation mechanism, it realizes intelligent security protection and continuous compliance management of financial and tax data throughout its life cycle, effectively making up for the shortcomings of existing technologies. Summary of the Invention

[0005] In response to the above problems, the present invention provides a method and system for intelligent management of financial and tax data based on encrypted storage to solve the problems in the existing technology that the financial and tax data protection means are static and rigid, lack flexibility, and cannot dynamically respond to the needs of multiple scenarios.

[0006] To solve the above technical problems, the present invention provides the following technical solution: a method for intelligent management of financial and tax data based on encrypted storage, comprising the following steps:

[0007] Step S1: Collect financial and tax-related data from multiple channels through the data acquisition module, conduct sensitivity assessment on the data, and classify the sensitivity levels;

[0008] In step S1, the following sub-steps are also included:

[0009] S1-1, through the data interface unit based on the preset data collection rules and interface protocols, connect to the enterprise financial system and tax system external sources to extract structured financial and tax data, including accounts and declaration records;

[0010] S1-2, the data recognition unit uses the OCR recognition algorithm to scan and recognize the unstructured financial and tax data of bills and invoices, extract key fields and convert them into structured data format, as shown in the formula:

[0011]

[0012]

[0013] Among them, I is the image input space, T is the text output space, is the OCR recognition mapping function; D is the unstructured data set generated after OCR recognition, represents the jth textual data entry extracted from the image;

[0014] S1-3, calling the data preprocessing unit to clean and standardize the collected raw data, filter out abnormal and redundant information, fill in missing data, unify the data format model, and output standardized financial and tax data;

[0015] S1-4: Based on a preset sensitivity assessment model, the pre-processed data is analyzed and calculated to obtain a sensitivity index value for the data. The sensitivity assessment model integrates multiple influencing factors, including the degree of privacy information contained in the data, the financial value level of the data, and the strength of the compliance requirements involved in the data. Let the input data be denoted as D. The sensitivity index is calculated according to a weighted model, as shown in the formula:

[0016]

[0017] in, represents the privacy sensitivity factor of data D, represents the value sensitivity factor of data D, Denotes other relevant sensitivity factors, , ,..., is the weight coefficient of the corresponding factor;

[0018] S1-5, sensitivity level classification, compare the sensitivity index S(D) calculated in step S1-4 with the preset sensitivity level threshold to determine the sensitivity level category to which the data belongs. The specific classification criteria are as follows:

[0019] The sensitivity score range is [0.8, 1.0], the sensitivity level is top secret, and the data contains manager-level and core corporate financial and tax information. Leakage will cause significant losses.

[0020] The sensitivity score range is [0.6, 0.8), the sensitivity level is confidential, and the data contains large transaction data and important tax declaration information. Leakage will cause significant losses.

[0021] The sensitivity score range is [0.4, 0.6), the sensitivity level is sensitive, the data contains small and medium-sized financial bills and general tax-related data, and there is a medium risk of leakage;

[0022] The sensitivity score range is [0.2, 0.4), the sensitivity level is internal, and the data contains routine financial and tax information within the enterprise, so the impact of leakage is relatively small;

[0023] The sensitivity score range is [0.0, 0.2), the sensitivity level is public, and the data contains data that has been made public or has no sensitivity requirements, and no special encryption processing is required.

[0024] Step S2: Key generation and encryption strategy setting: Based on the data sensitivity level, the adapted encryption algorithm type and encryption parameters are dynamically determined to generate the corresponding key;

[0025] In step S2, the following sub-steps are also included:

[0026] S2-1: Based on the data sensitivity level determined in S1-5 and the preset encryption protection standards, select the matching encryption algorithm type and key parameters to achieve a dynamic balance between security and system performance for data of different sensitivity levels. The specific matching relationship is as follows:

[0027] Top secret data: NTRU quantum-resistant encryption combined with ABE attribute-based encryption is used. The NTRU key length is no less than 1024 bits, and the ABE policy supports fine-grained access control.

[0028] Confidential and sensitive data: Paillier homomorphic encryption is used, with a public key length of no less than 2048 bits, supporting data calculation and processing under ciphertext;

[0029] Internal and public-level data: AES-256 symmetric encryption is used with a 256-bit key length, balancing efficiency and security;

[0030] S2-2, calling the key generation mechanism of the key management unit to generate the encryption key K based on the selected algorithm and parameters. The key generation adopts a cryptographically secure random number algorithm;

[0031] In the case of symmetric encryption, a secure random number generator is used to generate a key of the length required by step S2-1. In the case of asymmetric encryption, a public key and a private key pair of corresponding strength are generated. The generated key should meet the security strength requirements and match the sensitivity level of the data.

[0032] S2-3, securely save the generated key K to the key library of the key management module, and establish a mapping relationship between the key identifier and the data sensitivity level. During the key storage process, the key is encrypted twice, and the key generation time, applicable data range and validity period metadata are recorded.

[0033] Step S3: Data encryption and storage: encrypt the financial and tax data using the acquired key and encryption strategy, and store the ciphertext securely.

[0034] In step S3, the following sub-steps are also included:

[0035] S3-1, call the encryption algorithm module, use the key K generated in step S2 to encrypt the financial and tax data classified in step S1, and obtain the corresponding ciphertext data C. The encryption process is strictly carried out according to the algorithm and parameters set in step S2 to ensure that the encryption strength meets the requirements;

[0036] For large amounts of data, block encryption and other technologies are used to ensure the efficiency of encryption processing, but the final encryption result should completely cover the original data. After the encryption is completed, the ciphertext data C and related metadata, including data identification, sensitivity level and key identification, are packaged and sent to the storage unit;

[0037] S3-2 receives the ciphertext data C from the encryption unit and writes it to a secure data storage medium. During the storage process, hierarchical management is performed based on the sensitivity level of the data, as follows:

[0038] For top-secret data, it is stored in high-security storage media with physical isolation capabilities, such as trusted execution environment memory and hardware encryption disk;

[0039] For confidential data, it is stored in an encrypted independent partition or dedicated encrypted disk volume, and adopts an independent access control policy;

[0040] For sensitive data, it is stored in a secure partition with standard data encryption enabled, i.e. AES encrypted disk;

[0041] For internal-level data, it is stored in standard storage media protected by conventional security measures and restricted by access controls;

[0042] Public-level data can be stored in ordinary storage space without special encryption, but access logs are still recorded;

[0043] S3-3 records the metadata corresponding to the ciphertext data, including the data identifier, sensitivity level, encryption key identifier, and encryption timestamp. An index is established in the storage medium, and the above metadata is associated with the ciphertext data for easy storage, facilitating subsequent retrieval, decryption, and key update management. This metadata record ensures that the system can quickly locate the key and perform decryption based on the data identifier.

[0044] Step S4, data access and dynamic encryption maintenance, provides controlled encrypted data access services and performs dynamic security maintenance on stored data according to predetermined policies.

[0045] In step S4, the following sub-steps are also included:

[0046] S4-1, the system verifies whether the identity credentials provided by the requester are legal and valid. It uses username / password verification and combines it with a multi-factor authentication mechanism to enhance authentication strength. Only entities that pass identity authentication can enter the subsequent authorization check process.

[0047] S4-2: Verify the permissions of authenticated access requests to see if the requester has access rights corresponding to the sensitivity level of the requested data. The system compares the requester's permission level with the sensitivity level of the target data based on pre-set permission policies. If the permission level meets the requirements, decryption access is allowed; otherwise, the request is rejected and the illegal access attempt is recorded.

[0048] S4-3: For authorized requests, the system extracts the corresponding ciphertext data C and its metadata from the data storage medium. Based on the metadata, the system determines the data key for decryption. It then calls the decryption algorithm module and uses the correct key to decrypt C, restoring the original plaintext data D. During the decryption process, the system verifies the data integrity and correctness to ensure that the decrypted result is consistent with the original data before encryption.

[0049] S4-4: The decrypted plaintext data is provided to the requesting party, and this data access is recorded and audited. The record includes the visitor's identity, the accessed data identifier, the sensitivity level, the access time, and the decryption key identifier for security audits and future tracing.

[0050] In step S4-5, the system continuously monitors the encryption status of the stored data. Based on the key validity period and usage count policy set in step S2, the system triggers the key update process under specific conditions. When the key update conditions are met, the following operations are performed on the corresponding data:

[0051] First, the key management module generates a new encryption key K', that is, re-executes a process similar to step S2-2, but generates a new key; then uses the old key K to decrypt the existing ciphertext data C to obtain the plaintext data D; then uses the new key K' to re-encrypt D according to step S3-1 to obtain the new ciphertext C'; finally, replaces the originally stored C with C', and updates the key identifier and encryption time in the metadata; during the update process, the new key K' and its metadata are synchronously stored in the key library, and the old key K is marked as invalid and cannot be used again.

[0052] An intelligent management system for financial and tax data based on encrypted storage, comprising:

[0053] Data classification module, key management and encryption strategy module, data encryption storage module, data access and dynamic encryption maintenance module;

[0054] The data classification module is used to perform sensitivity analysis and classification on financial and tax data. The module includes: a data acquisition unit, a sensitivity analysis unit, and a classification unit;

[0055] A data acquisition unit is used to collect raw financial and tax data and input the collected data into a data classification module for processing; a sensitivity analysis unit is used to calculate the sensitivity index of the financial and tax data according to a preset sensitivity assessment model; a classification unit is used to classify the financial and tax data into corresponding sensitivity levels according to the sensitivity index and provide the classification results to subsequent modules;

[0056] The key management and encryption policy module is used to generate encryption keys and formulate encryption policies according to the data sensitivity level. The module includes: a key generation unit, a policy setting unit and a key storage unit;

[0057] The key generation unit is used to generate encryption keys based on the selected algorithm type and parameters to ensure that the keys meet security strength requirements; the policy setting unit is used to determine parameters such as the encryption algorithm type, key length, and key update policy for the data; the key storage unit is used to securely store the generated keys and maintain the mapping relationship between the keys and data sensitivity levels as well as key lifecycle information;

[0058] The data encryption storage module is used to perform encryption operations on financial and tax data and store and manage the encrypted data. The module includes: an encryption execution unit and a data storage unit;

[0059] The encryption execution unit is used to call the selected encryption algorithm to encrypt the financial and tax data and generate the corresponding ciphertext data; the data storage unit is used to store the encrypted ciphertext data and save the meta-information associated with the ciphertext data to support subsequent data retrieval, decryption and key update operations;

[0060] Data access and dynamic encryption maintenance module, used to control access and decryption of encrypted data and perform dynamic encryption maintenance. This module includes: identity authentication unit, authority control unit, data extraction unit, data decryption unit, dynamic maintenance unit and audit unit;

[0061] The identity authentication unit is used to authenticate the data access requester to ensure that he is a legitimate user; the permission control unit is used to verify whether the requester who has passed the identity authentication has the access rights corresponding to the sensitivity level of the target data; the data extraction unit is used to retrieve the requested financial and tax data ciphertext and its related metadata from the storage medium; the data decryption unit is used to call the decryption algorithm to use the correct key to decrypt the retrieved ciphertext data and restore the original plaintext data; the dynamic maintenance unit is used to monitor the key usage status according to the predetermined encryption strategy, and regularly trigger key updates and perform data re-encryption operations; the audit unit is used to record and monitor key events in the data access process, including information such as visitor identity, access time, access data identification, and operation results, to support security auditing and exception tracing.

[0062] Compared with the prior art, the present invention has the following beneficial effects:

[0063] By introducing a sensitivity assessment model based on the fusion of amount features, sensitive field features, business scenario features and contextual semantic features, the present invention can perform fine-grained intelligent sensitivity classification of financial and tax data. This is different from the traditional unified static encryption method, and realizes the differentiation and intelligence of data protection strategies.

[0064] The present invention dynamically selects the optimal encryption algorithm based on the data sensitivity level and matches the corresponding key generation method. Highly sensitive data adopts quantum-resistant encryption combined with attribute-based encryption mechanism, and internal and public data adopt symmetric encryption. The symmetric key is generated by composite chaotic mapping, which enhances the randomness and unpredictability of the key.

[0065] The present invention combines a data integrity hash verification mechanism in the data storage process to ensure that the stored ciphertext data is not tampered with during transmission and long-term storage, thereby improving data credibility. At the same time, it introduces searchable encryption technology, and through the encryption index and Bloom filter protection mechanism, it supports rapid retrieval of sensitive fields such as invoice number and amount range in the encrypted state, effectively solving the problem that traditional encrypted data cannot be retrieved, and taking into account both security and business availability. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. It is understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0067] Figure 1 is a flow chart of the method of the present invention;

[0068] Figure 2 It is a system architecture diagram of the present invention. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but is merely for selected embodiments of the present invention.

[0070] Please refer to Figure 1 and Figure 2 , Figure 1 A flowchart of a method for intelligent management of financial and tax data based on encrypted storage provided by an embodiment of the present invention. Figure 2 The architecture diagram of an intelligent management system for financial and tax data based on encrypted storage provided by an embodiment of the present invention includes the following steps:

[0071] Step S1: Collect financial and tax-related data from multiple channels through the data acquisition module, conduct sensitivity assessment on the data, and classify the sensitivity levels;

[0072] S1-1, structured data collection, connects to external sources such as the enterprise's financial system and tax system through the data interface unit based on preset data collection rules and interface protocols to extract structured financial and tax data, including accounts and declaration records;

[0073] S1-2, unstructured data collection, uses the OCR recognition algorithm through the data recognition unit to scan and recognize unstructured financial and tax data such as bills and invoices, extract key fields and convert them into structured data format, as shown in the formula:

[0074]

[0075]

[0076] Among them, I is the image input space, T is the text output space, is the OCR recognition mapping function, which outputs key fields such as invoice number, amount, and invoice issuer; D is the unstructured data set generated after OCR recognition. represents the jth textual data entry extracted from the image;

[0077] S1-3, data preprocessing, calls the data preprocessing unit to clean and standardize the collected raw data, filter out abnormal and redundant information, fill in missing data, and unify the data format model to output standardized financial and tax data to ensure data integrity and consistency;

[0078] S1-4, sensitivity index calculation, based on the preset sensitivity assessment model, analyzes and calculates the pre-processed data to obtain the sensitivity index value of the data. The sensitivity assessment model integrates multiple influencing factors, including the degree of privacy information contained in the data, the financial value level of the data, and the strength of the compliance requirements involved in the data. Let the input data be recorded as D, and the sensitivity index is calculated according to the weighted model, as shown in the formula:

[0079]

[0080] in, is the sensitivity index, represents the privacy sensitivity factor of data D, represents the value sensitivity factor of data D, Denotes other relevant sensitivity factors, , ,..., is the weight coefficient of the corresponding factor.

[0081] S1-5, sensitivity level classification, compare the sensitivity index S(D) calculated in step S1-4 with the preset sensitivity level threshold to determine the sensitivity level category to which the data belongs. The specific classification criteria are as follows:

[0082] The sensitivity score range is [0.8, 1.0], the sensitivity level is top secret, and the data contains manager-level and core corporate financial and tax information. Leakage will cause significant losses.

[0083] The sensitivity score range is [0.6, 0.8), the sensitivity level is confidential, and the data contains large transaction data and important tax declaration information. Leakage will cause significant losses.

[0084] The sensitivity score range is [0.4, 0.6), the sensitivity level is sensitive, the data contains small and medium-sized financial bills and general tax-related data, and there is a medium risk of leakage;

[0085] The sensitivity score range is [0.2, 0.4), the sensitivity level is internal, and the data contains routine financial and tax information within the enterprise, so the impact of leakage is relatively small;

[0086] The sensitivity score range is [0.0, 0.2), the sensitivity level is public, and the data contains data that has been made public or has no sensitivity requirements, and no special encryption processing is required;

[0087] When S(D) falls into the corresponding interval, the data will be marked as top secret, confidential, sensitive, internal or public, and the sensitivity level label will be associated and stored in the metadata of the data. The sensitivity level classification result will serve as an important basis for the dynamic encryption strategy formulation and key management configuration in the subsequent step S2.

[0088] Step S2: key generation and encryption strategy setting. Based on the data sensitivity level, the adapted encryption algorithm type and encryption parameters are dynamically determined to generate the corresponding key.

[0089] S2-1: Based on the data sensitivity level determined in S1-5 and the preset encryption protection standards, select the matching encryption algorithm type and key parameters to achieve a dynamic balance between security and system performance for data of different sensitivity levels. The specific matching relationship is as follows:

[0090] Top secret data: NTRU quantum-resistant encryption combined with attribute-based encryption (ABE) is used. The NTRU key length is no less than 1024 bits, and the ABE policy supports fine-grained access control.

[0091] Confidential and sensitive data: Paillier homomorphic encryption is used, with a public key length of no less than 2048 bits, supporting data calculation and processing under ciphertext;

[0092] Internal and public-level data: Use AES-256 symmetric encryption with a 256-bit key length, balancing efficiency and security.

[0093] To support dynamic encryption and long-term compliance requirements, key update policy parameters corresponding to each sensitivity level are pre-set, including key validity period and maximum number of uses, as follows:

[0094] The validity period of the top secret data key is 30 days, or it can be used no more than 100 times;

[0095] The validity period of confidentiality-level data keys is 90 days, or they may be used no more than 500 times;

[0096] Sensitive-level data keys are valid for 180 days or may be used no more than 1,000 times;

[0097] Internal-level data keys are valid for 365 days or no more than 3,000 uses;

[0098] The public level data can flexibly set the key update strategy according to needs.

[0099] S2-2, key generation, calls the key generation mechanism of the key management unit to generate the encryption key K based on the selected algorithm and parameters. The key generation adopts a cryptographically secure random number algorithm to ensure the randomness and uniqueness of the key;

[0100] In the case of symmetric encryption, a secure random number generator is used to generate a key of the length required by step S2-1; in the case of asymmetric encryption, a public key and private key pair of corresponding strength are generated. The generated key should meet the security strength requirements and match the data sensitivity level.

[0101] S2-3, key storage, securely saves the generated key K to the key library of the key management module, and establishes a mapping relationship between the key identifier and the data sensitivity level. During the key storage process, the key is re-encrypted or assisted by a hardware security module to prevent key leakage. Metadata such as the key generation time, applicable data range, and validity period are recorded to provide support for subsequent dynamic updates.

[0102] Output the formulated encryption strategy and key information and pass it to the encryption storage module. The encryption strategy includes the selected algorithm type, key identifier, key validity policy, etc., providing a basis for subsequent data encryption execution.

[0103] Step S3: Data encryption and storage: encrypt the financial and tax data using the acquired key and encryption strategy, and store the ciphertext securely.

[0104] S3-1, call the encryption algorithm module, use the key K generated in step S2 to encrypt the financial and tax data classified in step S1, and obtain the corresponding ciphertext data C. The encryption process is strictly carried out according to the algorithm and parameters set in step S2 to ensure that the encryption strength meets the requirements;

[0105] For large amounts of data, block encryption and other technologies are used to ensure the efficiency of the encryption process, but the final encryption result should completely cover the original data. After the encryption is completed, the ciphertext data C and related metadata, including data identification, sensitivity level and key identification, are packaged and sent to the storage unit.

[0106] S3-2 receives the ciphertext data C from the encryption unit and writes it to a secure data storage medium. During the storage process, hierarchical management is performed based on the sensitivity level of the data, as follows:

[0107] For top-secret data, it is stored in high-security storage media with physical isolation capabilities, such as trusted execution environment memory and hardware encryption disk;

[0108] For confidential data, it is stored in an encrypted independent partition or dedicated encrypted disk volume, and adopts an independent access control policy;

[0109] For sensitive data, it is stored in a secure partition with standard data encryption enabled, i.e. AES encrypted disk;

[0110] For internal-level data, it is stored in standard storage media protected by conventional security measures and restricted by access controls;

[0111] Public-level data can be stored in ordinary storage space without special encryption, but access logs are still recorded.

[0112] Through the above-mentioned tiered storage strategy, differentiated security measures are taken at the physical storage level according to the data sensitivity level, thereby further improving the overall security and protection strength of data in a static storage state.

[0113] S3-3 records the metadata corresponding to the ciphertext data, including the data identifier, sensitivity level, encryption key identifier (or public key identifier), and encryption timestamp, etc., establishes an index or mapping table in the storage medium, and associates the above metadata with the ciphertext data for storage to facilitate subsequent retrieval, decryption, and key update management. This metadata record ensures that the system can quickly locate the key based on the data identifier and perform decryption or re-encryption operations.

[0114] Verify the integrity and availability of encrypted data in the storage medium to ensure that the data is successfully written and can be retrieved.

[0115] Step S4, data access and dynamic encryption maintenance, provides controlled encrypted data access services and performs dynamic security maintenance on stored data according to predetermined policies.

[0116] S4-1, the system verifies whether the identity credentials provided by the requester are legal and valid, using username / password verification combined with a multi-factor authentication mechanism to improve authentication strength. Only entities that pass identity authentication can enter the subsequent authorization check process.

[0117] It should be noted that multi-factor authentication mechanisms include: time-based one-time dynamic password (TOTP) authentication, hardware encryption key authentication (such as tax UKey), biometric authentication (such as fingerprint, facial recognition), etc.

[0118] S4-2, performs permission verification on the authenticated access request to check whether the requester has access rights of the corresponding sensitivity level of the requested data. The system compares the requester's permission level with the sensitivity level of the target data based on the pre-set permission policy; if the permission level meets the requirements, decryption access is allowed; otherwise, the request is rejected and the illegal access attempt is recorded.

[0119] S4-3: For authorized requests, the corresponding ciphertext data C and its meta-information are extracted from the data storage medium. The system determines the data key (or corresponding private key) used for decryption based on the meta-information, then calls the decryption algorithm module and uses the correct key to perform decryption operations on C to restore the original plaintext data D. During the decryption process, the data integrity and correctness are verified to ensure that the decryption result is consistent with the original plaintext data.

[0120] S4-4: The decrypted plaintext data is provided to the requesting party, and this data access is recorded and audited. The record includes the visitor's identity, the accessed data identifier, the sensitivity level, the access time, and the decryption key identifier, etc., for security audits and future traceability.

[0121] S4-5, the system continuously monitors the encryption status of the stored data, and triggers the key update process regularly or under specific conditions according to the key validity period or usage count policy set in step S2. When the key update conditions are met, the following operations are performed for the corresponding data: first, the key management module generates a new encryption key K', that is, re-executes a process similar to step S2-2, but generates a new key; then uses the old key K to decrypt the existing ciphertext data C to obtain the plaintext data D; then uses the new key K' to re-encrypt D according to step S3-1 to obtain a new ciphertext C'; finally, replaces the originally stored C with C', and updates the key identifier and encryption time in the metadata. During the update process, the new key K' and its metadata are synchronously stored in the key library, and the old key K is marked as invalid and cannot be used again. Through the above-mentioned dynamic key update mechanism, it is ensured that the long-term stored data continues to meet the security requirements and reduce the risk of key leakage.

[0122] The present invention also provides an intelligent management system for financial and tax data based on encrypted storage, comprising:

[0123] Data classification module, key management and encryption policy module, data encryption storage module, data access and dynamic encryption maintenance module.

[0124] The data classification module is used to perform sensitivity analysis and classification on financial and tax data. The module includes: a data acquisition unit, a sensitivity analysis unit, and a classification unit;

[0125] The data acquisition unit is used to collect original financial and tax data and input the collected data into the data classification module for processing; the sensitivity analysis unit is used to calculate the sensitivity index of the financial and tax data according to the preset sensitivity assessment model; the classification unit is used to divide the financial and tax data into corresponding sensitivity levels according to the sensitivity index and provide the classification results to subsequent modules.

[0126] The key management and encryption policy module is used to generate encryption keys and formulate encryption policies according to the data sensitivity level. The module includes: a key generation unit, a policy setting unit and a key storage unit;

[0127] The key generation unit is used to generate encryption keys based on the selected algorithm type and parameters to ensure that the keys meet the security strength requirements; the policy setting unit is used to determine parameters such as the encryption algorithm type, key length, and key update policy of the data; the key storage unit is used to safely store the generated keys and maintain the mapping relationship between the keys and data sensitivity levels as well as the key life cycle information.

[0128] The data encryption storage module is used to perform encryption operations on financial and tax data and store and manage the encrypted data. The module includes: an encryption execution unit and a data storage unit;

[0129] The encryption execution unit is used to call the selected encryption algorithm to encrypt the financial and tax data and generate the corresponding ciphertext data; the data storage unit is used to store the encrypted ciphertext data and save the metadata associated with the ciphertext data to support subsequent data retrieval, decryption and key update operations.

[0130] Data access and dynamic encryption maintenance module, used to control access and decryption of encrypted data and perform dynamic encryption maintenance. This module includes: identity authentication unit, authority control unit, data extraction unit, data decryption unit, dynamic maintenance unit and audit unit;

[0131] The identity authentication unit is used to authenticate the data access requester to ensure that he is a legitimate user; the permission control unit is used to verify whether the requester who has passed the identity authentication has the access rights corresponding to the sensitivity level of the target data; the data extraction unit is used to retrieve the requested financial and tax data ciphertext and its related metadata from the storage medium; the data decryption unit is used to call the decryption algorithm to use the correct key to decrypt the retrieved ciphertext data and restore the original plaintext data; the dynamic maintenance unit is used to monitor the key usage status according to the predetermined encryption strategy, and regularly trigger key updates and perform data re-encryption operations; the audit unit is used to record and monitor key events in the data access process, including information such as visitor identity, access time, access data identification, and operation results, to support security auditing and exception tracing.

[0132] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A method for intelligent management of financial and tax data based on encrypted storage, characterized in that: The following steps are involved: Step S1: Collect financial and tax-related data from multiple channels through the data acquisition module, conduct sensitivity assessment on the data, and classify the sensitivity levels; Step S2: Key generation and encryption strategy setting. Based on the data sensitivity level, the adapted encryption algorithm type and encryption parameters are dynamically determined to generate the corresponding key. Step S3: Data encryption and storage: encrypt the financial and tax data using the acquired key and encryption strategy, and store the ciphertext securely. Step S4, data access and dynamic encryption maintenance, provides controlled encrypted data access services and performs dynamic security maintenance on stored data according to predetermined policies; In step S1, the following sub-steps are also included: S1-1, through the data interface unit based on the preset data collection rules and interface protocols, connect to the enterprise financial system and tax system external sources to extract structured financial and tax data, including accounts and declaration records; S1-2, the data recognition unit uses the OCR recognition algorithm to scan and recognize the unstructured financial and tax data of bills and invoices, extract key fields and convert them into structured data format, as shown in the formula: ； ； Among them, I is the image input space, T is the text output space, is the OCR recognition mapping function; D is the unstructured data set generated after OCR recognition, represents the jth textual data entry extracted from the image; S1-3, calling the data preprocessing unit to clean and standardize the collected raw data, filter out abnormal and redundant information, fill in missing data, unify the data format model, and output standardized financial and tax data; S1-4: Based on a preset sensitivity assessment model, the pre-processed data is analyzed and calculated to obtain a sensitivity index value for the data. The sensitivity assessment model integrates multiple influencing factors, including the degree of privacy information contained in the data, the financial value level of the data, and the strength of the compliance requirements involved in the data. Let the input data be denoted as D. The sensitivity index is calculated according to a weighted model, as shown in the formula: ； in, represents the privacy sensitivity factor of data D, represents the value sensitivity factor of data D, Denotes other relevant sensitivity factors, , ,..., is the weight coefficient of the corresponding factor; S1-5, sensitivity level classification, compare the sensitivity index S(D) calculated in step S1-4 with the preset sensitivity level threshold to determine the sensitivity level category to which the data belongs. The specific classification criteria are as follows: The sensitivity score range is [0.8, 1.0], the sensitivity level is top secret, and the data contains supervisor-level and core corporate financial and tax information. Leakage will cause significant losses. The sensitivity score range is [0.6, 0.8), the sensitivity level is confidential, and the data contains large transaction data and important tax declaration information. Leakage will cause significant losses. The sensitivity score range is [0.4, 0.6), the sensitivity level is sensitive, the data contains small and medium-sized financial bills and general tax-related data, and there is a medium risk of leakage; The sensitivity score range is [0.2, 0.4), the sensitivity level is internal, and the data contains routine financial and tax information within the enterprise, so the impact of leakage is relatively small; The sensitivity score range is [0.0, 0.2), the sensitivity level is public, and the data contains data that has been made public or has no sensitivity requirements, and no special encryption processing is required.

2. The method for intelligent management of financial and tax data based on encrypted storage according to claim 1, characterized in that: In step S2, the following sub-steps are also included: S2-1: Based on the data sensitivity level determined in S1-5 and the preset encryption protection standards, select the matching encryption algorithm type and key parameters to achieve a dynamic balance between security and system performance for data of different sensitivity levels. The specific matching relationship is as follows: For top-secret data, NTRU quantum-resistant encryption combined with ABE attribute-based encryption is used. The NTRU key length is no less than 1024 bits, and the ABE policy supports fine-grained access control. Confidential and sensitive data uses Paillier homomorphic encryption with a public key length of no less than 2048 bits, supporting data calculation and processing under ciphertext; Internal and public-level data are encrypted using AES-256 symmetric encryption with a 256-bit key length, balancing efficiency and security; S2-2, calling the key generation mechanism of the key management unit to generate the encryption key K based on the selected algorithm and parameters. The key generation adopts a cryptographically secure random number algorithm; In the case of symmetric encryption, a secure random number generator is used to generate a key of the length required by step S2-1. In the case of asymmetric encryption, a public key and a private key pair of corresponding strength are generated. The generated key should meet the security strength requirements and match the sensitivity level of the data. S2-3, securely save the generated key K to the key library of the key management module, and establish a mapping relationship between the key identifier and the data sensitivity level. During the key storage process, the key is encrypted twice, and the key generation time, applicable data range and validity period metadata are recorded.

3. The method for intelligent management of financial and tax data based on encrypted storage according to claim 1, characterized in that: In step S3, the following sub-steps are also included: S3-1, call the encryption algorithm module, use the key K generated in step S2 to encrypt the financial and tax data classified in step S1, and obtain the corresponding ciphertext data C. The encryption process is strictly carried out according to the algorithm and parameters set in step S2 to ensure that the encryption strength meets the requirements; For large amounts of data, block encryption and other technologies are used to ensure the efficiency of encryption processing, but the final encryption result should completely cover the original data. After the encryption is completed, the ciphertext data C and related metadata, including data identification, sensitivity level and key identification, are packaged and sent to the storage unit; S3-2 receives the ciphertext data C from the encryption unit and writes it to a secure data storage medium. During the storage process, hierarchical management is performed based on the sensitivity level of the data, as follows: For top-secret data, it is stored in high-security storage media with physical isolation capabilities, such as trusted execution environment memory and hardware encryption disk; For confidential data, it is stored in an encrypted independent partition or dedicated encrypted disk volume, and adopts an independent access control policy; For sensitive data, it is stored in a secure partition with standard data encryption enabled, i.e. AES encrypted disk; For internal-level data, it is stored in standard storage media protected by conventional security measures and restricted by access controls; Public-level data can be stored in ordinary storage space without special encryption, but access logs are still recorded; S3-3 records the metadata corresponding to the ciphertext data, including the data identifier, sensitivity level, encryption key identifier, and encryption timestamp. An index is established in the storage medium, and the above metadata is associated with the ciphertext data for easy storage, facilitating subsequent retrieval, decryption, and key update management. This metadata record ensures that the system can quickly locate the key and perform decryption based on the data identifier.

4. The method for intelligent management of financial and tax data based on encrypted storage according to claim 1, characterized in that: In step S4, the following sub-steps are also included: S4-1, the system verifies whether the identity credentials provided by the requester are legal and valid. It uses username / password verification and combines it with a multi-factor authentication mechanism to enhance authentication strength. Only entities that pass identity authentication can enter the subsequent authorization check process. S4-2: Authenticated access requests are subject to permission verification to check whether the requester has access rights corresponding to the sensitivity level of the requested data. The system compares the requester's permission level with the sensitivity level of the target data based on pre-defined permission policies. If the permission level meets the requirements, decryption access is allowed; otherwise, the request is rejected and the illegal access attempt is recorded; S4-3: For authorized requests, the system extracts the corresponding ciphertext data C and its metadata from the data storage medium. Based on the metadata, the system determines the data key for decryption. It then calls the decryption algorithm module and uses the correct key to decrypt C, restoring the original plaintext data D. During the decryption process, the system verifies the data integrity and correctness to ensure that the decrypted result is consistent with the original data before encryption. S4-4: The decrypted plaintext data is provided to the requesting party, and this data access is recorded and audited. The record includes the visitor's identity, the accessed data identifier, the sensitivity level, the access time, and the decryption key identifier for security audits and future tracing. In step S4-5, the system continuously monitors the encryption status of the stored data. Based on the key validity period and usage count policy set in step S2, the system triggers the key update process under specific conditions. When the key update conditions are met, the following operations are performed on the corresponding data: First, the key management module generates a new encryption key K', that is, re-executes a process similar to step S2-2, but generates a new key; then uses the old key K to decrypt the existing ciphertext data C to obtain the plaintext data D; then uses the new key K' to re-encrypt D according to step S3-1 to obtain the new ciphertext C'; finally, replaces the originally stored C with C', and updates the key identifier and encryption time in the metadata; during the update process, the new key K' and its metadata are synchronously stored in the key library, and the old key K is marked as invalid and cannot be used again.

5. An intelligent management system for financial and tax data based on encrypted storage, applied to an intelligent management method for financial and tax data based on encrypted storage according to any one of claims 1 to 4, characterized in that: include: Data classification module, key management and encryption strategy module, data encryption storage module, data access and dynamic encryption maintenance module; The data classification module is used to perform sensitivity analysis and classification on financial and tax data. The module includes: a data acquisition unit, a sensitivity analysis unit, and a classification unit; A data acquisition unit is used to collect raw financial and tax data and input the collected data into a data classification module for processing; a sensitivity analysis unit is used to calculate the sensitivity index of the financial and tax data according to a preset sensitivity assessment model; a classification unit is used to classify the financial and tax data into corresponding sensitivity levels according to the sensitivity index and provide the classification results to subsequent modules; The key management and encryption policy module is used to generate encryption keys and formulate encryption policies according to the data sensitivity level. The module includes: a key generation unit, a policy setting unit and a key storage unit; The key generation unit is used to generate encryption keys based on the selected algorithm type and parameters to ensure that the keys meet security strength requirements; the policy setting unit is used to determine parameters such as the encryption algorithm type, key length, and key update policy for the data; the key storage unit is used to securely store the generated keys and maintain the mapping relationship between the keys and data sensitivity levels as well as key lifecycle information; The data encryption storage module is used to perform encryption operations on financial and tax data and store and manage the encrypted data. The module includes: an encryption execution unit and a data storage unit; The encryption execution unit is used to call the selected encryption algorithm to encrypt the financial and tax data and generate the corresponding ciphertext data; the data storage unit is used to store the encrypted ciphertext data and save the meta-information associated with the ciphertext data to support subsequent data retrieval, decryption and key update operations; Data access and dynamic encryption maintenance module, used to control access and decryption of encrypted data and perform dynamic encryption maintenance. This module includes: identity authentication unit, authority control unit, data extraction unit, data decryption unit, dynamic maintenance unit and audit unit; The identity authentication unit is used to authenticate the data access requester to ensure that he is a legitimate user; the permission control unit is used to verify whether the requester who has passed the identity authentication has the access rights corresponding to the sensitivity level of the target data; the data extraction unit is used to retrieve the requested financial and tax data ciphertext and its related metadata from the storage medium; the data decryption unit is used to call the decryption algorithm to use the correct key to decrypt the retrieved ciphertext data and restore the original plaintext data; the dynamic maintenance unit is used to monitor the key usage status according to the predetermined encryption strategy, and regularly trigger key updates and perform data re-encryption operations; the audit unit is used to record and monitor key events in the data access process, including information such as visitor identity, access time, access data identification, and operation results, to support security auditing and exception tracing.

Images