Financial security transaction system with big data encryption

Abstract

The invention discloses a financial security transaction system with big data encryption, and relates to the technical field of financial transaction security, and the financial security transaction system with big data encryption adopts a hybrid encryption algorithm, combines AES-256 symmetric encryption and RSA asymmetric encryption, improves the efficiency through symmetric encryption during data transmission, and improves the security of financial transactions. The security of the key is ensured by means of asymmetric encryption, and the key is managed by means of the block chain, so that the integrity and traceability of the key are ensured. Through big data analysis and machine learning technologies, transaction behaviors are monitored in real time, a behavior model is constructed to early warn risks, and an external risk database optimization model can also be connected. Encrypted data are stored by using a distributed storage technology, and are backed up regularly and remotely, so that data reliability is guaranteed. User identity authentication and authority management are enhanced by using multi-factor identity authentication and role-based access control. The system greatly improves the safety of financial transaction data, effectively prevents and controls risks, and guarantees the safe and efficient operation of financial transactions.

Description

Technical Field

[0001] The present invention belongs to the technical field related to financial transaction security, and specifically relates to a financial security transaction system with big data encryption. Background Art

[0002] As the financial industry continues to digitize, the volume of financial transaction data is exploding. Data security and integrity are paramount in financial transactions. Traditional financial transaction systems are exposed to numerous security risks in the face of increasingly sophisticated cyberattacks. For example, transaction data is vulnerable to theft and tampering during transmission and storage, leading to customer information leakage, financial losses, and reputational risks for financial institutions. Furthermore, existing encryption technologies struggle with low encryption efficiency and complex key management when processing massive amounts of financial data, making them unable to meet the dual security and efficiency demands of financial transactions in the big data era. Summary of the Invention

[0003] The purpose of the present invention is to provide a financial security transaction system with big data encryption to solve the problems raised in the above background technology.

[0004] In order to achieve the above-mentioned purpose, the present invention provides the following technical solutions:.

[0005] A financial security transaction system for big data encryption, comprising:

[0006] A data encryption module, which is used to encrypt financial transaction data using a hybrid encryption algorithm and manage encryption keys through a blockchain-based key management mechanism;

[0007] The transaction monitoring and risk warning module uses big data analysis and machine learning technology to monitor financial transaction behavior in real time, establish transaction behavior models and conduct risk assessments, and issue risk warnings when transaction behavior is abnormal;

[0008] The data storage and backup module is used to store encrypted financial transaction data using distributed storage technology and perform regular data backup. The backup data is stored in a remote secure storage device.

[0009] The identity authentication and authorization module is used to authenticate transaction users using a multi-factor identity authentication mechanism and to manage user authorization based on a role-based access control model.

[0010] Preferably, in the data encryption module, the hybrid encryption algorithm uses a symmetric encryption algorithm to encrypt transaction data during the data transmission stage, the symmetric encryption algorithm is the AES-256 algorithm, and the encryption mode is selected from one of CBC or GCM.

[0011] Preferably, the data encryption module randomly generates a 128-bit or 256-bit AES key according to the size and type of the transaction data before using the symmetric encryption algorithm to encrypt the transaction data.

[0012] Preferably, after completing the symmetric encryption, the data encryption module uses an asymmetric encryption algorithm to encrypt and transmit the symmetric encryption key. The asymmetric encryption algorithm is the RSA algorithm, and the recipient's public key is obtained from the blockchain key management system, and its legitimacy and validity are verified through the blockchain smart contract.

[0013] Preferably, the blockchain-based key management mechanism records the generation, storage and distribution of encryption keys on the blockchain, and the blockchain is an Ethereum platform with smart contract functions; in the key generation stage, the generation time, validity period, usage limit of the AES key and the identity information of the two parties to the transaction are recorded on the blockchain.

[0014] Preferably, when key exchange and authorization are required, the corresponding operations are performed through the blockchain smart contract, and the smart contract decides whether to authorize the use of the key based on the preset identity verification results of the two parties to the transaction and the transaction amount limit rules.

[0015] Preferably, in the transaction monitoring and risk warning module, big data analysis technology collects transaction data in real time from the transaction database of the financial transaction system, payment gateway logs, and user behavior log data sources, and uses data collection tools to transmit the data to the big data processing platform.

[0016] Preferably, the data collection tool is Flume or Kafka Connect, and the big data processing platform is a Hadoop cluster; on the big data processing platform, the collected raw transaction data is pre-processed by cleaning, deduplication, and format conversion, and the distributed computing framework of MapReduce or Spark is used to extract key features for transaction behavior analysis, wherein the key features include transaction time, transaction amount, transaction initiation location, and transaction counterparty.

[0017] Preferably, the transaction monitoring and risk warning module uses a machine learning algorithm library to establish a transaction behavior model based on the preprocessed transaction data, the machine learning algorithm library is Scikit-learn or TensorFlow, and the machine learning algorithm is a support vector machine or a neural network algorithm; when establishing the transaction behavior model, the historical transaction data is divided into a training set and a test set, the training set data is used to train the model and adjust the parameters, and the test set data is used to evaluate the model, and the accuracy, recall rate, and F1 value indicators are calculated.

[0018] Preferably, the transaction monitoring and risk warning module is connected to the external financial risk database in real time. The external financial risk database includes the financial anti-fraud alliance database and the third-party risk intelligence provider database. The external risk intelligence data is imported into the risk intelligence library of this system using a data interface or data synchronization tool; based on the newly acquired risk intelligence and fraud cases, the transaction risk assessment model is updated and optimized using incremental learning or transfer learning methods.

[0019] Compared with the existing technology, the present invention provides a financial security transaction system with big data encryption, which has the following beneficial effects:

[0020] Significantly improve the security of financial transaction data, effectively preventing data leakage and tampering during transmission and storage through hybrid encryption algorithms and blockchain key management mechanisms;

[0021] Using big data analysis and machine learning technologies to achieve real-time monitoring and early warning of transaction risks, it can promptly detect and prevent potential fraudulent transactions, reducing the risk of losses for financial institutions and customers;

[0022] Distributed storage and off-site backup strategies ensure the reliability and integrity of financial transaction data, ensuring data availability even in the event of failure of some storage nodes or natural disasters.

[0023] Multi-factor identity authentication and role-based access control mechanisms enhance the authentication and permission management of transaction users and improve the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a system architecture diagram of the present invention.

[0025] Figure 2 This is the flow chart of the hybrid encryption algorithm. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0027] The present invention provides Figure 1-2 A financial security transaction system for big data encryption is shown, comprising:

[0028] A data encryption module, which is used to encrypt financial transaction data using a hybrid encryption algorithm and manage encryption keys through a blockchain-based key management mechanism;

[0029] The transaction monitoring and risk warning module uses big data analysis and machine learning technology to monitor financial transaction behavior in real time, establish transaction behavior models and conduct risk assessments, and issue risk warnings when transaction behavior is abnormal;

[0030] The data storage and backup module is used to store encrypted financial transaction data using distributed storage technology and perform regular data backup. The backup data is stored in a remote secure storage device.

[0031] The identity authentication and authorization module is used to authenticate transaction users using a multi-factor identity authentication mechanism and to manage user authorization based on a role-based access control model.

[0032] Data encryption module implementation

[0033] Symmetric encryption operations

[0034] When financial transaction data is generated, the system's data encryption module responds quickly. For example, in a common Java development environment, the Bouncy Castle library is called to execute the AES-256 encryption algorithm. During this process, the encryption module randomly generates a 128-bit or 256-bit AES key based on the size and type of the transaction data. For example, if the transaction data is a simple, small transfer record with a relatively simple structure and small data volume, a 128-bit AES key might be generated. However, for data involving complex financial product transactions and containing extensive customer information, a more secure 256-bit AES key might be generated.

[0035] After generating the key, the encryption module selects an appropriate encryption mode, such as CBC (Cipher Block Chaining) or GCM (Galois / Counter Mode), to encrypt the transaction data. If CBC mode is selected, the encryption module divides the transaction data into blocks of fixed length. Each block is encrypted by performing an XOR operation with the previous block, thereby increasing the complexity and security of the encryption and ensuring that the plaintext data can be accurately converted into ciphertext.

[0036] Asymmetric encryption and key transmission

[0037] After completing symmetric encryption, the data encryption module needs to obtain the recipient's public key to encrypt the AES key for transmission. This public key is obtained from the blockchain key management system. Through pre-configured blockchain smart contracts within this system, the legitimacy and validity of the obtained public key can be verified. For example, the smart contract verifies that the identity of the private key holder corresponding to the public key is legally registered within the system and that the public key's validity period is within the acceptable range.

[0038] After confirming the public key is correct, the encryption module uses the RSA asymmetric encryption algorithm to encrypt the previously generated AES key with the recipient's public key. In practical applications, this encryption operation can be performed using the OpenSSL library. After encryption is complete, the encrypted AES key is packaged and integrated with the previously encrypted transaction data. This packaged data is then sent to the recipient via a secure network channel such as SSL / TLS, ensuring the security of the key during transmission.

[0039] Blockchain key management

[0040] During the initial key generation phase, the data encryption module records a series of key AES key information, such as the specific time of key generation, the set validity period, and the number of uses, along with the identities of both parties to the transaction, on the blockchain. This system uses the Ethereum platform, which features smart contract functionality, as the blockchain medium. For example, when a financial institution A conducts a transaction with client B, information related to the generated AES key, along with the identification codes of both parties, is written to a specific block on the Ethereum blockchain.

[0041] When two parties in a transaction need to exchange keys and authorize transactions, blockchain smart contracts come into play. Smart contracts determine whether to authorize key use based on pre-defined rules, such as the identity verification results of both parties and whether the transaction amount is within the permitted range. For example, if Customer B's identity verification is successful and the transaction amount does not exceed the pre-set limit with Financial Institution A, the smart contract will issue an authorization instruction. Only authorized parties can access the key information required for decryption from the blockchain, thus ensuring the security and compliance of key usage.

[0042] Transaction Monitoring and Risk Warning Module Implementation Method

[0043] Data collection and preprocessing

[0044] The transaction monitoring and risk warning module is always operational, collecting transaction data in real time from multiple data sources within the financial transaction system. These data sources include transaction databases, which store a wealth of detailed transaction information, such as transaction time, amount, and parties involved; payment gateway logs, which record the operations and status of each payment; and user behavior logs, including user steps and duration during the transaction. To efficiently transmit this data, the module utilizes data collection tools such as Flume or Kafka Connect. Taking Flume as an example, it can accurately transmit transaction data scattered across various systems to a big data processing platform, such as a Hadoop cluster, according to predefined rules and paths, by configuring different data sources and receivers.

[0045] On the Hadoop cluster, a big data processing platform, a series of preprocessing operations are performed on the collected raw transaction data. Using distributed computing frameworks such as MapReduce or Spark, massive amounts of transaction data are processed in parallel. First, a cleansing operation is performed to remove noise and erroneous information from the data, such as incorrectly formatted timestamps and invalid transaction amounts. Next, deduplication is performed to prevent duplicate data from interfering with subsequent analysis. Finally, format conversion is performed to convert data from different data sources into a unified format suitable for analysis. For example, transaction times are converted to a standard time format and transaction amounts are converted to a unified monetary unit. Key features for transaction behavior analysis, such as transaction time, transaction amount, transaction origin, and counterparty, are extracted from the data, laying the foundation for subsequent transaction behavior modeling and risk assessment.

[0046] Transaction behavior modeling and risk assessment

[0047] The transaction monitoring and risk warning module utilizes machine learning libraries, such as Scikit-learn or TensorFlow, to build a trading behavior model based on preprocessed trading data. When building the model, historical trading data is first divided into a training set and a test set, for example, in a 7:3 ratio. The training set data is then used to train a support vector machine or neural network model. During training, model parameters, such as the kernel function parameters in the support vector machine and the number and weights of neurons in the neural network, are continuously adjusted to optimize model performance. For example, by repeatedly experimenting with different kernel functions, the kernel parameter combination that best distinguishes normal from abnormal trading behavior is found.

[0048] After model training is complete, the model is comprehensively evaluated using the test set data, calculating key metrics such as accuracy, recall, and F1 value. For example, if the model's accuracy reaches over 95%, its recall reaches over 90%, and its F1 value is high, it indicates that the model can relatively accurately identify normal and abnormal transaction behaviors. In actual operation, real-time transaction data is input into the trained model, and the model analyzes and judges the transaction data based on preset algorithms and parameters. If the degree to which transaction behavior deviates from the normal model exceeds a pre-set threshold, such as if the transaction amount suddenly exceeds five times the user's average transaction amount over the past three months, and the transaction originates from a frequently used area to an unfamiliar area, the model will determine that the transaction is abnormal and immediately trigger a risk warning mechanism.

[0049] Risk intelligence docking and model update

[0050] To stay abreast of the latest financial risk trends, the transaction monitoring and risk warning module regularly connects with external financial risk databases. These include the Financial Anti-Fraud Alliance database, which aggregates fraud cases and risk intelligence shared by numerous financial institutions; and third-party risk intelligence provider databases, which provide timely risk information through professional data analysis and research. The module imports external risk intelligence data into the system's risk intelligence database via data interfaces or data synchronization tools, such as specialized data synchronization software, at set intervals, such as every morning.

[0051] When new risk intelligence and fraud cases are acquired, the module updates and optimizes the transaction risk assessment model based on this new information. Using incremental learning or transfer learning, the model can quickly adapt to new risk patterns and fraud methods without affecting the original model's performance. For example, when a new fraudulent transaction pattern is discovered, such as fraud committed by forging transaction verification codes from a specific financial institution, the module will add the relevant case data to the training set and, using an incremental learning algorithm, retrain the model, updating its parameters and weights. This improves the model's ability to identify this new risk, ensuring the system can continuously and effectively monitor and warn of financial transaction risks.

[0052] Data storage and backup module implementation

[0053] Distributed storage implementation

[0054] The data storage and backup module achieves reliable data storage by building a distributed storage system. Open-source distributed storage software such as Ceph or GlusterFS can be used during this setup. Multiple storage nodes are organized into a storage cluster. Each storage node can be a high-performance physical server or a virtual machine created using virtualization technology. Within the storage cluster, data storage strategies are implemented based on the type and characteristics of financial transaction data. For example, transaction records can be stored in a dedicated transaction data storage pool, while customer identity information can be stored in a customer data storage area to facilitate data management and retrieval.

[0055] When encrypted financial transaction data needs to be stored, the data storage and backup module divides the data into multiple appropriately sized data blocks based on the data size and established storage strategy. To determine the specific storage node for each data block, the module applies distributed storage algorithms such as consistent hashing. For example, consistent hashing maps data blocks to corresponding storage nodes by performing a hash calculation on the data blocks and storage nodes. Once the calculation is complete, the data blocks are transferred to the corresponding storage nodes via a high-speed network for storage. While storing data blocks, storage nodes also record detailed metadata about the data blocks, such as their actual size, their specific storage location within the storage node, and their creation time. This metadata is crucial for subsequent data retrieval, management, and data integrity verification.

[0056] Data backup operations

[0057] The data storage and backup module pre-defines a detailed data backup plan. For example, a full backup of the previous day's financial transaction data is scheduled every day at 2:00 AM to ensure data integrity. An incremental backup of the week's data is performed every Sunday at 3:00 AM, backing up only newly added and modified data during the week to improve backup efficiency. When the backup time arrives, the module automatically initiates the backup task.

[0058] When executing a backup task, the module retrieves the data blocks to be backed up from various storage nodes in the distributed storage system. To ensure data security during transmission, the SSL / TLS encrypted transmission protocol is used to transmit the data blocks to a backup node located in a remote data center. Backup nodes are typically highly reliable storage devices with large storage capacities. The transferred backup data is properly stored on the backup node, and a comprehensive backup data index is established. For example, by establishing indexes based on multiple dimensions such as time, data type, and transaction subject, the required backup data can be quickly located and retrieved based on different query criteria when data recovery is required.

[0059] To ensure the reliability of backup data, the module regularly performs integrity checks on the backup data. During the check, a hash value is calculated using a hash algorithm such as MD5 or SHA-256, and the result is compared with the hash value generated when the original data was stored. If the hash value of the backup data is inconsistent with the original hash value, it indicates that the backup data may be damaged or lost. The module will promptly retrieve the corresponding data from the distributed storage system for backup to ensure the consistency and integrity of the backup data with the original data.

[0060] Identity authentication and authorization module implementation

[0061] Multi-factor authentication implementation

[0062] When a user logs into a financial transaction system, the authentication and authorization module first asks for a password. To prevent password theft during transmission, the system encrypts the password using the SSL / TLS encryption protocol. After the user enters the password, the system compares it with the encrypted password stored in the user database to verify its correctness. For example, passwords are stored in the user database using a salted hashing method. This involves adding a random string (the salt) to the original password before performing a hash calculation to enhance password security.

[0063] If the password verification passes, the system will further call the fingerprint recognition or facial recognition device driver to perform biometric identification. Taking mobile devices as an example, if the device has a built-in fingerprint sensor, the system will activate the fingerprint recognition function and guide the user to place their finger on the sensor to collect the fingerprint. The collected fingerprint data will be compared with the fingerprint template pre-entered by the user during registration and stored in the system. If facial recognition is used, the system will call the front camera to capture the user's facial image, and use the image recognition algorithm to compare the captured image with the pre-stored facial template to verify the user's identity. Only when both password verification and biometric recognition pass will the system determine that the user's identity authentication is successful and allow the user to enter the system for subsequent operations.

[0064] Role-based access control enforcement

[0065] During the system initialization phase, the identity authentication and authorization module defines various user roles based on the financial institution's organizational structure and actual business needs. For example, a general customer role is defined, whose primary permissions include performing basic transactions such as account inquiries and small transfers; an account manager role, in addition to general customer permissions, can also perform operations such as customer information management and preliminary loan application reviews; and a risk manager role is defined, allowing users to view and conduct in-depth analysis of transaction risk data and develop risk prevention and control strategies. Each role is assigned specific permissions and stored in a permissions database.

[0066] Once a user logs in and passes identity authentication, the system quickly retrieves the permissions corresponding to that role from the permissions database based on the user's role. Whenever a user performs a transaction or accesses transaction data, the system checks the user's permissions in real time. For example, if a customer attempts to access a risk assessment report, the system will determine that the operation is unauthorized based on their role permissions and immediately notify the user that they do not have permission to perform the operation. This ensures that only authorized users can access specific transaction data and perform corresponding transaction operations, effectively safeguarding the system's data security and operational compliance.

[0067] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein. Any modification, replacement, and improvement made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A financial security transaction system with big data encryption, characterized in that: include: A data encryption module, which is used to encrypt financial transaction data using a hybrid encryption algorithm and manage encryption keys through a blockchain-based key management mechanism; The transaction monitoring and risk warning module uses big data analysis and machine learning technology to monitor financial transaction behavior in real time, establish transaction behavior models and conduct risk assessments, and issue risk warnings when transaction behavior is abnormal; The data storage and backup module is used to store encrypted financial transaction data using distributed storage technology and perform regular data backup. The backup data is stored in a remote secure storage device. The identity authentication and authorization module is used to authenticate transaction users using a multi-factor identity authentication mechanism and to manage user authorization based on a role-based access control model.

2. The financial security transaction system for big data encryption according to claim 1, characterized in that: In the data encryption module, the hybrid encryption algorithm uses a symmetric encryption algorithm to encrypt transaction data during the data transmission stage. The symmetric encryption algorithm is the AES-256 algorithm, and the encryption mode is selected from one of CBC or GCM.

3. The financial security transaction system for big data encryption according to claim 2, characterized in that: The data encryption module randomly generates a 128-bit or 256-bit AES key according to the size and type of the transaction data before encrypting the transaction data using the symmetric encryption algorithm.

4. The financial security transaction system for big data encryption according to claim 2, characterized in that: After completing the symmetric encryption, the data encryption module uses an asymmetric encryption algorithm to encrypt and transmit the symmetric encryption key. The asymmetric encryption algorithm is the RSA algorithm, and the recipient's public key is obtained from the blockchain key management system, and its legitimacy and validity are verified through the blockchain smart contract.

5. The financial security transaction system for big data encryption according to claim 1, characterized in that: The blockchain-based key management mechanism records the generation, storage, and distribution of encryption keys on the blockchain, which is the Ethereum platform with smart contract capabilities; During the key generation phase, the AES key generation time, validity period, usage limit, and identity information of both parties to the transaction are recorded on the blockchain.

6. The financial security transaction system for big data encryption according to claim 5, characterized in that: When key exchange and authorization are required, the corresponding operations are performed through the blockchain smart contract. The smart contract decides whether to authorize the use of the key based on the preset identity verification results of both parties to the transaction and the transaction amount limit rules.

7. The financial security transaction system for big data encryption according to claim 1, characterized in that: In the transaction monitoring and risk warning module, big data analysis technology collects transaction data in real time from the transaction database of the financial transaction system, payment gateway logs, and user behavior log data sources, and uses data collection tools to transmit the data to the big data processing platform.

8. The financial security transaction system for big data encryption according to claim 1, characterized in that: The data collection tool is Flume or Kafka Connect, and the big data processing platform is a Hadoop cluster. On the big data processing platform, the collected raw transaction data is preprocessed by cleaning, deduplication, and format conversion, and the distributed computing framework of MapReduce or Spark is used to extract key features for transaction behavior analysis. The key features include transaction time, transaction amount, transaction initiation location, and transaction counterparty.

9. The financial security transaction system for big data encryption according to claim 1, characterized in that: The transaction monitoring and risk warning module uses a machine learning algorithm library to establish a transaction behavior model based on preprocessed transaction data. The machine learning algorithm library is Scikit-learn or TensorFlow, and the machine learning algorithm is a support vector machine or a neural network algorithm. When establishing the transaction behavior model, the historical transaction data is divided into a training set and a test set. The training set data is used to train the model and adjust the parameters. The test set data is used to evaluate the model and calculate the accuracy, recall rate, and F1 value indicators.

10. The financial security transaction system for big data encryption according to claim 1, characterized in that: The transaction monitoring and risk warning module is connected to the external financial risk database in real time. The external financial risk database includes the financial anti-fraud alliance database and the third-party risk intelligence provider database. The external risk intelligence data is imported into the risk intelligence library of this system using a data interface or data synchronization tool; based on the newly acquired risk intelligence and fraud cases, the transaction risk assessment model is updated and optimized using incremental learning or transfer learning methods.

Images