Financial data persistent key management method and system based on dynamic key rotation

Abstract

The present application relates to the technical field of conformal key management, and discloses a financial data conformal key management method and system based on dynamic key rotation, the method comprising: conformal master key format matching on fields in a financial data stream, dynamic key rotation strategy function evaluation on rotation scheduling values of conformal master keys in a conformal master key set, and dynamic key rotation; multi-round derivation on conformal master keys; encryption round setting based on field access permissions, and round encryption processing on fields in different encryption rounds by using multi-round round keys.The present application matches conformal master keys based on field formats, dynamically evaluates scheduling values by combining dynamic key rotation strategy functions, filters keys to be replaced, performs multi-round derivation, sets encryption rounds based on field access permissions, calls round keys to perform multi-round encryption on fields, generates financial data stream encryption ciphertexts with consistent structures and bound permissions, and enhances financial data confidentiality and access control accuracy.

Description

Technical Field

[0001] This invention relates to the field of conformal key management, and more particularly to a method and system for conformal key management of financial data based on dynamic key rotation. Background Technology

[0002] With the accelerated digital transformation of the financial industry, banks, insurance companies, securities firms, and other institutions face severe information security challenges in data collection, sharing, and storage. Financial data not only involves key decision-making processes such as high-frequency trading and risk control, but also highly sensitive personal and corporate privacy information such as user identity, asset structure, and payment behavior. While traditional encryption methods can effectively protect data, most suffer from conformity issues, meaning the encrypted ciphertext often does not retain the original field structure and format. This leads to problems such as syntax incompatibility, rule validation failures, and uninterpretability by business systems when encrypted data is directly used in analysis, modeling, or transfer, severely limiting the usability and scalability of encrypted data in actual business operations. Although some conformity-preserving encryption algorithms (such as FF1 / FF3) possess structure preservation properties, their integration granularity in key management systems is insufficient, and they are decoupled from permission systems, limiting their secure application capabilities in multi-role financial data environments.

[0003] In existing research, CN103414554B proposed an object-oriented key management system and its management method. This scheme achieves centralized management of the entire key lifecycle by defining key templates and policies, combined with key generation and lifecycle control via a cryptographic machine. It can realize key templateization and automatic distribution mechanisms to a certain extent, which is significant for improving the flexibility of key management. However, this method is mainly applicable to key generation and maintenance in static business scenarios, and does not address dynamic key rotation mechanisms or multi-level key derivation logic driven by data access behavior. This leads to delayed key updates, vague security policies, and an inability to accurately control different users' access to different ciphertext contents, potentially causing security risks such as key replay attacks and privilege abuse.

[0004] To address this issue, this invention proposes a conformal key management method for financial data based on dynamic key rotation, which achieves key derivation consistency across rotation cycles and ensures the continuous availability of financial data. Summary of the Invention

[0005] This invention provides a method and system for managing conformal keys in financial data based on dynamic key rotation. It sets a dynamic key rotation strategy function, combining risk indicators such as field information entropy, access frequency, and encryption failure rate to evaluate the rotation scheduling value of the conformal master key in real time. Decision-making rotation is then performed based on the average scheduling value, effectively avoiding data security risks caused by long-term key use or exposure. By performing multiple rounds of key derivation on the rotated conformal master key, combined with a unique identifier and key registration mechanism, it ensures that the keys used in each round of encryption have isolation and traceability, meeting the requirements of layered encryption and dynamic scheduling for high-strength conformal encryption. Furthermore, it directly binds user access permissions to the number of field encryption rounds, constructing a mapping mechanism between access permissions and encryption strength. This achieves field-level and round-level encryption control, allowing only high-privilege users to access high-round decryption results, preventing unauthorized access by low-privilege users, thereby improving overall data minimum availability and security-in-depth.

[0006] Because the entire process uses a conformal encryption mechanism, the encrypted ciphertext maintains consistency with the financial data stream in length and structure, eliminating the need to adjust database field types or index configurations. This ensures low encryption transformation costs, flexible encryption strategy deployment, and strong adaptability.

[0007] To achieve the above objectives, the present invention provides a method for managing conformal keys for financial data based on dynamic key rotation, comprising the following steps: S1: Receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream, obtain a conformal master key set that is adapted to the format of the financial data stream, and use a dynamic key rotation strategy function to evaluate the rotation scheduling value of the conformal master key in the conformal master key set. S2: Calculate the average rotation scheduling value of all shape-preserving master keys in the shape-preserving master key set. If the rotation scheduling value of the shape-preserving master key in the shape-preserving master key set exceeds the average rotation scheduling value, then regenerate the shape-preserving master key for key replacement. Otherwise, retain the original shape-preserving master key and obtain the shape-preserving master key set after dynamic key rotation. S3: Perform multiple rounds of derivation on the conformal master key in the conformal master key set after dynamic key rotation to obtain multiple round keys for the conformal master key, assign a unique key identifier to the round key, and register it in the key registry; S4: Set access permissions for different fields in the financial data stream, set the encryption rounds for the fields based on the access permissions, and use multiple round keys to perform round encryption processing on the fields for different encryption rounds to obtain encrypted ciphertext of the financial data stream based on access permissions.

[0008] As a further improvement of the present invention: Optionally, the system receives a financial data stream to be encrypted, performs conformal master key format matching on the fields in the financial data stream, and obtains a conformal master key set adapted to the format of the financial data stream, including: Receive financial data streams from business systems. The financial data streams consist of multiple fields. For each field, extract its format features, which include character set, field length, and format structure. For each field in the financial data stream, perform conformal master key format matching, select the conformal master key with the highest matching degree as the conformal master key associated with the field, and construct a set of conformal master keys adapted to the format of the financial data stream by associating all the conformal master keys associated with the fields. The matching method is as follows: extract the conformal master keys currently in use in the key management library, as well as the conformal parameters in the conformal master keys. The conformal parameters represent the data format of the conformal encrypted ciphertext corresponding to the conformal master key, including the character set, field length and format structure. Match the conformal parameters with the field type of each field in the financial data stream. The relationship between fields and conformal master keys in the financial data stream is expressed as follows: ; in, This represents the nth field in the financial data stream. Representation field The associated conformal master key, where N represents the number of fields in the financial data stream.

[0009] Furthermore, a dynamic key rotation strategy function is used to evaluate the rotation scheduling value of the conformal master keys in the conformal master key set, including: The form of the conformal master key set is as follows: The calculation method for the rotation scheduling value of the conformal master key is as follows: ; in, Represents the conformal master key For fields The rotation scheduling value, Representation field In terms of the amount of information in the financial data stream, This indicates the relationship between fields in the financial data stream. The number of fields with a consistent character set, where N represents the number of fields in the financial data stream. This indicates the relationship between fields in the financial data stream. The proportion of fields with consistent character sets Indicates the use of conformal master key The sum of the information content of all encrypted fields in the corresponding financial data stream; Represents the conformal master key Time decay coefficient, Represents the conformal master key Usage duration, This represents the attenuation control coefficient, which reflects the increasing trend of security risks arising from the conformal master key as the usage time increases; Represents the conformal master key Environmental risk coefficient Indicates based on conformal master key The total number of accesses to all encrypted fields. Indicates based on conformal master key The number of failed access attempts for all encrypted fields. Represents the conformal master key The number of encrypted fields, This indicates the preset threshold for the number of encrypted fields; All are rotation weights, representing the rotation weights of information content, environmental risk coefficient, and time decay coefficient, respectively. .

[0010] Further, the average rotation schedule value of all conformal master keys in the conformal master key set is calculated. If the rotation schedule value of a conformal master key in the set exceeds the average rotation schedule value, the conformal master key is regenerated for key replacement; otherwise, the original conformal master key is retained, resulting in a dynamically rotated conformal master key set, including: Calculate the mean of the rotation schedule value for all conformal master keys in the conformal master key set. Based on the average value of the rotation scheduling The conformal master key undergoes key replacement, where the key replacement formula for the conformal master key is: ; in, Represents the field after dynamic key rotation Associated conformal master key, This indicates the regenerated conformal master key. A conformal master key with consistent conformal parameter structure; The process for regenerating the conformal master key is as follows: Obtain the system master key (key) stored in the trusted hardware, and the conformal parameter (par) of the conformal master key to be replaced. Extract the device_id identifier, timestamp, and salt random perturbation parameter from the encryption service calling node. Use the encryption service calling node to generate the conformal master key from the conformal parameter (par), where the generation formula is: ; Where K represents the generated conformal master key that is consistent with the structure of the conformal parameter par; This refers to an HMAC-based KDF function, specifically an HMAC-based key extraction and expansion derivation function, where HMAC stands for Hash Message Authentication Code. Indicates splicing; Generate a conformal master key using SHA-256 hash operation. The hash value is used as the conformal master key. The unique key identifier will be used to generate the conformal master key. And the unique key identifier is stored in the key management repository; Constructing the conformal master key set after dynamic key rotation .

[0011] Furthermore, multiple rounds of derivation are performed on the conformal master keys in the conformal master key set after dynamic key rotation to obtain multi-round keys for the conformal master keys, including: The multi-round derivation process for the conformal master key is as follows: Extract the conformal master key and its derived parameters from the conformal master key set after dynamic key rotation. The derived parameters include the unique identifier ID of the financial data stream and the current round identifier. Use the derived parameters and encryption functions to derive multi-round keys from the conformal master key: ; in, Represents the conformal master key The r-th round key, where R represents the preset conformal encryption round. A unique identifier ID representing a financial data stream. Indicates the current round identifier. Indicates the generation of conformal master key The round key perturbation factor of the r-th round key. Secure hash function Represents a pseudo-random function. This indicates a splicing operation.

[0012] Optionally, set , Indicates the generation of the round key The timestamp, where r ensures that the round key perturbation factor is different for different rounds. To ensure that the perturbation factor of the round key generated at different times within the same round is unique, the ID is used to improve key uniqueness and anti-copying properties. This represents the message authentication code function, i.e., using The HMAC algorithm for generating hash values; Furthermore, access permissions are set for different fields in the financial data stream, and the encryption rounds for these fields are determined based on these access permissions, including: The fields in the financial data stream are divided into identity recognition fields, account sensitive fields, and behavior record fields. Access permissions for different field categories in the financial data stream are set according to access control policies. The access permissions for identity recognition fields, account sensitive fields, and behavior record fields are respectively high-level access permissions, medium-level access permissions, and low-level access permissions. The encryption rounds for fields are set based on access permissions. The encryption rounds for fields with high access permissions are 10 rounds, 8 rounds, and 6 rounds, respectively. Users with high access permissions can receive the round keys for 10 encryption rounds for each field, users with medium access permissions can receive the round keys for 8 encryption rounds for each field, and users with low access permissions can receive the round keys for 6 encryption rounds for each field.

[0013] The round encryption process for the field is as follows: S401: Obtain the current encryption round d, and the output result of the (d-1)th encryption round. The output results will be Divide into left and right parts respectively. ; S402: Combine the encryption round with the left part The concatenation is performed, and the key from the d-th round of the field is used as input. The result is then encrypted using the AES-ECB encryption function to obtain the length and the right part. Consistent intermediate ciphertext values ; S403: Use modular arithmetic to convert the intermediate ciphertext value With the right part When adding, the output of the modulo operation is used as the left part. new value Swap the new values ​​of the left part With the right part The results are then concatenated to obtain the output of the d-th encryption round. ; Furthermore, by using multi-round keys to perform round-by-round encryption on fields in the financial data stream for different encryption rounds, the encrypted ciphertext of the financial data stream based on access permissions is obtained, including: Obtain the encryption rounds and multi-round keys of fields in the financial data stream. Perform round encryption processing on the fields for different encryption rounds based on the FF3 encryption algorithm. Use the output of the last encryption round as the shape-preserving encrypted ciphertext of the field and distribute the multi-round keys to authorized users. Concatenate the shape-preserving encrypted ciphertexts of all fields to obtain the encrypted ciphertext of the financial data stream.

[0014] To address the aforementioned problems, this invention provides a conformal key management system for financial data. The system includes a dynamic key rotation unit, a round key derivation module, a conformal encryption module, and a key management library. The key management library stores the conformal master key and a unique key identifier, and includes a key registry for registering round key information. The dynamic key rotation unit is used to receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream to obtain a conformal master key set adapted to the financial data stream format, use a dynamic key rotation strategy function to evaluate the rotation scheduling value of the conformal master keys in the conformal master key set, calculate the average rotation scheduling value of all conformal master keys in the conformal master key set, if the rotation scheduling value of the conformal master key in the conformal master key set exceeds the average rotation scheduling value, then regenerate the conformal master key for key replacement, otherwise retain the original conformal master key, and obtain the conformal master key set after dynamic key rotation; The round key derivation module is used to perform multiple rounds of derivation on the conformal master key in the conformal master key set after dynamic key rotation, to obtain multiple round keys of the conformal master key, assign a unique key identifier to the round key, and register it in the key registry; The conformal encryption module is used to set access permissions for different fields in the financial data stream, set the encryption rounds for the fields based on the access permissions, and use multiple round keys to perform round encryption processing on the fields for different encryption rounds to obtain encrypted ciphertext of the financial data stream based on access permissions.

[0015] To address the aforementioned problems, the present invention also provides a computer-readable storage medium storing at least one instruction, which is executed by a processor in an electronic device to implement the above-described method for managing conformal keys for financial data based on dynamic key rotation.

[0016] Compared with existing technologies, this invention proposes a conformal key management method for financial data based on dynamic key rotation, which has the following advantages: First, during key rotation, the dynamic key rotation strategy function introduces a multi-factor fusion scheduling mechanism into the conformal encryption system, significantly improving the security dynamism and robustness of the conformal master key. On one hand, by introducing the information content of the field to be encrypted, the sensitivity and potential leakage risk inherent in the field are quantified, ensuring that fields with high information content preferentially use master keys with higher rotation frequencies, thereby improving the protection level of critical data encryption. On the other hand, combined with the time decay coefficient of the conformal master key, conformal master keys that have not been rotated for a long time are preferentially replaced, avoiding security risks caused by key abuse or leakage. Simultaneously, the strategy function also considers environmental risk coefficients, particularly by combining the proportion of failed accesses to encrypted fields with the normalized result of the number of encrypted fields, dynamically reflecting the frequency of external attack attempts and the potential exposure of the key encryption range during the operation of the encryption system. The overall strategy implements a conformal master key scheduling mechanism that adapts to sensitivity, time characteristics, and usage behavior, effectively avoiding the security bottleneck caused by static key management, and significantly enhancing the intelligence level of conformal master key scheduling and the anti-attack capability of the encryption system while ensuring the conformal format of the encrypted structure.

[0017] Meanwhile, by combining the adjustable round-by-round encryption strategy under the FF3 architecture, users with different access permissions can only decrypt the ciphertext output in the corresponding round. This effectively limits the ability of low-privilege users to deeply restore financially sensitive fields and ensures the principle of minimum data availability. That is, each user, system, or program is only granted the minimum data access permissions and resource access scope required to fulfill its responsibilities, no more and no less. Secondly, by setting three levels of encryption rounds—high permission (10 rounds), medium permission (8 rounds), and low permission (6 rounds)—the original fields are encrypted layer by layer, which enhances the anti-analysis strength of conformal encrypted ciphertext, effectively resists attacks such as intermediate state leakage and statistical inference, and improves the overall security of the system. The independent distribution of multiple round keys enables field-level access auditing and key traceability, improving the controllability and security traceability of key management. Furthermore, the conformal encryption ciphertext has the same structural characteristics as the original field, facilitating seamless integration with existing database systems without altering field formats or causing index failures, significantly enhancing compatibility and deployment capabilities in traditional financial systems. This access-based round encryption method ensures data security isolation while achieving refined access control, high efficiency in conformal encryption, and transparency in encryption system integration. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a conformal key management method for financial data based on dynamic key rotation, provided in an embodiment of the present invention. Figure 2 This is a flowchart of the field wheel encryption process provided in an embodiment of the present invention; Figure 3This is a schematic diagram of the structure of a conformal key management system for financial data provided in an embodiment of the present invention. Detailed Implementation

[0019] The realization of the objectives, functional characteristics, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0020] This application provides a method for conformal key management of financial data based on dynamic key rotation. The executing entity of this method includes, but is not limited to, at least one electronic device that can be configured to execute the method provided in this application, such as a server or a terminal. In other words, the method can be executed by software or hardware installed on a terminal device or server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0021] Reference Figure 1 as well as Figure 2 Embodiment 1 of the present invention is as follows: S1: Receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream, obtain a conformal master key set adapted to the format of the financial data stream, and use a dynamic key rotation strategy function to evaluate the rotation scheduling value of the conformal master keys in the conformal master key set.

[0022] Receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream, and obtain a conformal master key set adapted to the format of the financial data stream, including: Receive financial data streams from business systems. The financial data streams consist of multiple fields. For each field, extract its format features, which include character set, field length, and format structure. It should be noted that the field types include, but are not limited to, bank card number, ID card number, transaction number, mobile phone number, email address, and enterprise tax identification number; the character set includes [0-9], [a-zA-Z0-9] or a specific combination of symbols; the field length includes fixed length (such as 16-digit bank card number, 18-digit ID card number) or variable length; and the format structure includes whether it contains separators, masks, check bits, prefixes or suffixes (such as the prefix "+86" for mobile phone numbers). For each field in the financial data stream, perform conformal master key format matching, select the conformal master key with the highest matching degree as the conformal master key associated with the field, and construct a set of conformal master keys adapted to the format of the financial data stream by associating all the conformal master keys associated with the fields. The matching method is as follows: extract the conformal master keys currently in use in the key management library, as well as the conformal parameters in the conformal master keys. The conformal parameters represent the data format of the conformal encrypted ciphertext corresponding to the conformal master key, including the character set, field length and format structure. Match the conformal parameters with the field type of each field in the financial data stream. The relationship between fields and conformal master keys in the financial data stream is expressed as follows: ; in, This represents the nth field in the financial data stream. Representation field The associated conformal master key, where N represents the number of fields in the financial data stream.

[0023] The dynamic key rotation strategy function is used to evaluate the rotation scheduling value of the conformal master keys in the conformal master key set, including: The form of the conformal master key set is as follows: The calculation method for the rotation scheduling value of the conformal master key is as follows: ; in, Represents the conformal master key For fields The rotation scheduling value, Representation field In terms of the amount of information in the financial data stream, This indicates the relationship between fields in the financial data stream. The number of fields with a consistent character set, where N represents the number of fields in the financial data stream. This indicates the relationship between fields in the financial data stream. The proportion of fields with consistent character sets Indicates the use of conformal master key The sum of the information content of all encrypted fields in their respective financial data streams. The higher the value, the more likely it is to be a field. The less common a character set is in financial data streams, the more likely the field is to be valuable. It can provide a greater amount of information Higher security requirements apply to conformal master keys; Represents the conformal master key Time decay coefficient, Represents the conformal master key Usage duration, Indicates the attenuation control coefficient, set The time decay coefficient is 0.8, which reflects the increasing trend of security risks caused by the conformal master key as the usage time increases; specifically, the initial value of the time decay coefficient is close to 0, and it approaches 1 as time goes on, reflecting the increased risk of aging of the conformal master key and the urgent need for rotation. Represents the conformal master key Environmental risk coefficient Indicates based on conformal master key The total number of accesses to all encrypted fields. Indicates based on conformal master key The number of failed access attempts for all encrypted fields. Represents the conformal master key The number of encrypted fields, This indicates the preset threshold for the number of encrypted fields. It is 100; All are rotation weights, representing the rotation weights of information content, environmental risk coefficient, and time decay coefficient, respectively. Specifically, set The values ​​are 0.2, 0.4, and 0.4, respectively.

[0024] S2: Calculate the average rotation scheduling value of all shape-preserving master keys in the shape-preserving master key set. If the rotation scheduling value of the shape-preserving master key in the shape-preserving master key set exceeds the average rotation scheduling value, then regenerate the shape-preserving master key for key replacement. Otherwise, retain the original shape-preserving master key and obtain the shape-preserving master key set after dynamic key rotation.

[0025] Specifically, it includes: Calculate the mean of the rotation schedule value for all conformal master keys in the conformal master key set. Based on the average value of the rotation scheduling The conformal master key undergoes key replacement, where the key replacement formula for the conformal master key is: ; in, Represents the field after dynamic key rotation Associated conformal master key This indicates the regenerated conformal master key. A conformal master key with a consistent conformal parameter structure; specifically, if Then Use the shape-preserving master key to be replaced, extract the shape-preserving parameters of the shape-preserving master key to be replaced, and regenerate the shape-preserving master key. As a field after dynamic key rotation The associated conformal master key; The process for regenerating the conformal master key is as follows: Obtain the system master key (key) stored in the trusted hardware, and the conformal parameter (par) of the conformal master key to be replaced. Extract the device_id identifier, timestamp, and salt random perturbation parameter from the encryption service calling node. Use the encryption service calling node to generate the conformal master key from the conformal parameter (par), where the generation formula is: ; Where K represents the generated conformal master key that is consistent with the structure of the conformal parameter par; This refers to an HMAC-based KDF function, specifically an HMAC-based key extraction and expansion derivation function, where HMAC stands for Hash Message Authentication Code. Indicates splicing; Generate a conformal master key using SHA-256 hash operation. The hash value is used as the conformal master key. The unique key identifier will be used to generate the conformal master key. And the unique key identifier is stored in the key management repository; Constructing the conformal master key set after dynamic key rotation .

[0026] In this embodiment, the timestamp is the timestamp for generating the conformal master key, the device_id identifier of the encryption service calling node is the identifier of the encryption service calling node used (e.g., DEVICE-7E8B23), and the salt random perturbation parameter is a randomly generated perturbation parameter (e.g., 0x12ABF4) used to enhance the uniqueness of the conformal master key.

[0027] It should be noted that for conformal master keys that need to be replaced, a key compatibility period is set (that is, after the key rotation, the old conformal master key and the rotation key can still be used for decryption within a limited time). After the key compatibility period ends, the old conformal master key is automatically deregistered and its traces are completely removed from key cache, memory mapping, database and other locations to avoid data leakage. This process will generate a complete key retirement audit log.

[0028] S3: Perform multiple rounds of derivation on the conformal master key in the conformal master key set after dynamic key rotation to obtain multiple round keys for the conformal master key. Assign a unique key identifier to each round key and register it in the key registry.

[0029] Multiple rounds of derivation are performed on the conformal master keys in the conformal master key set after dynamic key rotation to obtain the multi-round keys of the conformal master keys, including: The multi-round derivation process for the conformal master key is as follows: Extract the conformal master key and its derived parameters from the conformal master key set after dynamic key rotation. The derived parameters include the unique identifier ID of the financial data stream and the current round identifier. Use the derived parameters and encryption functions to derive multi-round keys from the conformal master key: ; in, Represents the conformal master key The key for the r-th round is given, where R represents the preset conformal encryption round number, and R is set to 10. A unique identifier ID representing a financial data stream. Indicates the current round identifier. Indicates the generation of conformal master key The round key perturbation factor of the r-th round key. Secure hash function This represents a pseudo-random function; in the embodiments of this application, For SHA3-256 functions, For HKDF functions, This indicates a splicing operation.

[0030] Optionally, set , Indicates the generation of the round key The timestamp, where r ensures that the round key perturbation factor is different for different rounds. To ensure that the perturbation factor of the round key generated at different times within the same round is unique, the ID is used to improve key uniqueness and anti-copying properties. This represents the message authentication code function, i.e., using The HMAC algorithm for generating hash values.

[0031] S4: Set access permissions for different fields in the financial data stream, set the encryption rounds for the fields based on the access permissions, and use multiple round keys to perform round encryption processing on the fields for different encryption rounds to obtain encrypted ciphertext of the financial data stream based on access permissions.

[0032] Set access permissions for different fields in the financial data stream, and set the encryption rounds for the fields based on the access permissions, including: The fields in the financial data stream are divided into identity recognition fields, account sensitive fields, and behavior record fields. Access permissions for different field categories in the financial data stream are set according to access control policies. The access permissions for identity recognition fields, account sensitive fields, and behavior record fields are respectively high-level access permissions, medium-level access permissions, and low-level access permissions. The encryption rounds for fields are set based on access permissions. The encryption rounds for fields with high access permissions are 10 rounds, 8 rounds, and 6 rounds, respectively. Users with high access permissions can receive the round keys for 10 encryption rounds for each field, users with medium access permissions can receive the round keys for 8 encryption rounds for each field, and users with low access permissions can receive the round keys for 6 encryption rounds for each field.

[0033] It should be noted that example fields for identity recognition include ID card numbers and bank card numbers, which are used to uniquely identify or sensitively authenticate an individual's identity. Leakage of these fields may pose significant privacy and financial security risks. Example fields for account-sensitive fields include transaction amounts and account balances, which are used to directly reflect a user's asset status and are considered financial confidential information, requiring a medium level of protection. Example fields for behavior recording include transaction timestamps and payment methods, which are used to assist in recording transaction behavior. Individual leakage of these fields carries a low risk, but they can be used for pattern analysis.

[0034] This approach effectively achieves "sensitivity-driven hierarchical encryption" by setting differentiated access permissions for different fields in the financial data stream and dynamically adjusting the encryption rounds accordingly. Specifically, fields with high access permissions (such as transaction accounts and identity identifiers) are typically associated with a higher risk of data leakage, thus requiring more rounds of encryption processing to enhance their confidentiality and resistance to attacks. Conversely, fields with lower access permissions (such as exchange rate types and non-sensitive timestamps) employ lightweight encryption strategies to reduce encryption and decryption overhead and improve overall encryption efficiency. This dynamically adjustable round control mechanism not only enhances the system's protection strength for highly sensitive fields but also ensures efficient access to less sensitive fields, achieving a good balance between security and performance. It has broad practical application value and engineering promotion potential.

[0035] By using multiple round keys to perform round-encryption processing on fields in the financial data stream for different rounds, the encrypted ciphertext of the financial data stream based on access permissions is obtained, including: Obtain the encryption rounds and multi-round keys of fields in the financial data stream. Perform round encryption processing on the fields for different encryption rounds based on the FF3 encryption algorithm. Use the output of the last encryption round as the shape-preserving encrypted ciphertext of the field and distribute the multi-round keys to authorized users. Concatenate the shape-preserving encrypted ciphertexts of all fields to obtain the encrypted ciphertext of the financial data stream.

[0036] For reference Figure 2 The flowchart shown illustrates the field round encryption process, and the output result for the (d-1)th encryption round. The encryption process for the d-th round of encryption is performed, and the steps for the round encryption process of the field are as follows: S401: Obtain the current encryption round d, and the output result of the (d-1)th encryption round. The output results will be Divide into left and right parts respectively. ; Specifically, the method of equal distribution is adopted. The parts are divided into left and right sections. The lengths are consistent; S402: Combine the encryption round with the left part The concatenation is performed, and the key from the d-th round of the field is used as input. The result is then encrypted using the AES-ECB encryption function to obtain the length and the right part. Consistent intermediate ciphertext values ; It should be noted that the AES-ECB (Advanced Encryption Standard – Electronic Codebook) encryption function is a block cipher mode that combines AES encryption with the ECB cipherbook. Its inputs are a fixed-length result to be encrypted and a round key. The encrypted result is generated through row shifting, column mixing, and round key addition operations. The ciphertext value in the middle and the rightmost part... To maintain consistency, so that modular summation can be performed in the next step; S403: Use modular arithmetic to convert the intermediate ciphertext value With the right part When adding, the output of the modulo operation is used as the left part. new value Swap the new values ​​of the left part. With the right part The results are then concatenated to obtain the output of the d-th encryption round. ; Specifically, the formula for the modulo operation is: ; Where Len is the right part Length, Using a model The operation ensures that the output result is still Len, preventing overflow; Specifically, the FF3 encryption algorithm performs encryption operations within character fields (such as numeric strings and alphabetic strings) through the Feistel network structure, without generating values ​​that cross the range of the original data. For example, when encrypting an ID number (18 digits), the output is still an 18-digit number, without introducing non-numeric characters. The FF3 encryption algorithm is restricted by the format characteristics of the field, ensuring that the format characteristics of the conformal encrypted ciphertext are consistent with the format characteristics of the original field.

[0037] Example 2: For reference Figure 3 The diagram shows the structure of a conformal key management system 100 for financial data. It includes a dynamic key rotation unit 101, a round key derivation module 102, a conformal encryption module 103, and a key management library 104. The key management library stores the conformal master key and a unique key identifier, and includes a key registry for registering round key information. The dynamic key rotation unit 101 is used to receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream to obtain a conformal master key set adapted to the format of the financial data stream, use a dynamic key rotation strategy function to evaluate the rotation scheduling value of the conformal master keys in the conformal master key set, calculate the average rotation scheduling value of all conformal master keys in the conformal master key set, if the rotation scheduling value of the conformal master key in the conformal master key set exceeds the average rotation scheduling value, then regenerate the conformal master key for key replacement, otherwise retain the original conformal master key, and obtain the conformal master key set after dynamic key rotation; The round key derivation module 102 is used to perform multiple rounds of derivation on the conformal master key in the conformal master key set after dynamic key rotation, to obtain multiple round keys of the conformal master key, assign a unique key identifier to the round key, and register it in the key registry; The conformal encryption module 103 is used to set access permissions for different fields in the financial data stream, set the encryption rounds for the fields based on the access permissions, and use multiple round keys to perform round encryption processing on the fields for different encryption rounds to obtain encrypted ciphertext of the financial data stream based on access permissions.

[0038] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0039] It should be noted that the sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0040] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0041] The above are merely preferred embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for conformal key management of financial data based on dynamic key rotation, characterized in that, The method includes: S1: Receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream, obtain a conformal master key set that is adapted to the format of the financial data stream, and use a dynamic key rotation strategy function to evaluate the rotation scheduling value of the conformal master key in the conformal master key set. The dynamic key rotation strategy function is used to evaluate the rotation scheduling value of the conformal master keys in the conformal master key set, including: The form of the conformal master key set is as follows: The calculation method for the rotation scheduling value of the conformal master key is as follows: ； in, This represents the nth field in the financial data stream. Representation field Associated conformal master key, Represents the conformal master key For fields The rotation scheduling value, Representation field In terms of the amount of information in the financial data stream, This indicates the relationship between fields in the financial data stream. The number of fields with a consistent character set, where N represents the number of fields in the financial data stream. This indicates the relationship between fields in the financial data stream. The proportion of fields with consistent character sets Indicates the use of conformal master key The sum of the information content of all encrypted fields in the corresponding financial data stream; Represents the conformal master key Time decay coefficient, Represents the conformal master key Usage duration, This represents the attenuation control coefficient, which reflects the increasing trend of security risks arising from the conformal master key as the usage time increases; Represents the conformal master key Environmental risk coefficient Indicates based on conformal master key The total number of accesses to all encrypted fields. Indicates based on conformal master key The number of failed access attempts for all encrypted fields. Represents the conformal master key The number of encrypted fields, This indicates the preset threshold for the number of encrypted fields; All are rotation weights, representing the rotation weights of information content, environmental risk coefficient, and time decay coefficient, respectively. ; S2: Calculate the average rotation scheduling value of all shape-preserving master keys in the shape-preserving master key set. If the rotation scheduling value of the shape-preserving master key in the shape-preserving master key set exceeds the average rotation scheduling value, then regenerate the shape-preserving master key for key replacement. Otherwise, retain the original shape-preserving master key and obtain the shape-preserving master key set after dynamic key rotation. S3: Perform multiple rounds of derivation on the conformal master key in the conformal master key set after dynamic key rotation to obtain multiple round keys for the conformal master key, assign a unique key identifier to the round key, and register it in the key registry; S4: Set access permissions for different fields in the financial data stream, set the encryption rounds for the fields based on the access permissions, and use multiple round keys to perform round encryption processing on the fields for different encryption rounds to obtain encrypted ciphertext of the financial data stream based on access permissions.

2. The conformal key management method for financial data based on dynamic key rotation as described in claim 1, characterized in that, Receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream, and obtain a conformal master key set adapted to the format of the financial data stream, including: Receive financial data streams from business systems. The financial data streams consist of multiple fields. For each field, extract its format features, which include character set, field length, and format structure. For each field in the financial data stream, perform conformal master key format matching, select the conformal master key with the highest matching degree as the conformal master key associated with the field, and construct a set of conformal master keys adapted to the format of the financial data stream by associating all the conformal master keys associated with the fields. The matching method is as follows: extract the conformal master keys currently in use in the key management library, as well as the conformal parameters in the conformal master keys. The conformal parameters represent the data format of the conformal encrypted ciphertext corresponding to the conformal master key, including the character set, field length and format structure. Match the conformal parameters with the field type of each field in the financial data stream. The relationship between fields and conformal master keys in the financial data stream is expressed as follows: ； in, This represents the nth field in the financial data stream. Representation field The associated conformal master key, where N represents the number of fields in the financial data stream.

3. The conformal key management method for financial data based on dynamic key rotation as described in claim 1, characterized in that, Calculate the average rotation schedule value of all conformal master keys in the conformal master key set. If the rotation schedule value of a conformal master key in the set exceeds the average rotation schedule value, then regenerate the conformal master key for key replacement; otherwise, retain the original conformal master key. This results in a dynamically rotated conformal master key set, including: Calculate the mean of the rotation schedule value for all conformal master keys in the conformal master key set. Based on the average value of the rotation scheduling The conformal master key undergoes key replacement, where the key replacement formula for the conformal master key is: ； in, Represents the field after dynamic key rotation Associated conformal master key, This indicates the regenerated conformal master key. A conformal master key with a consistent conformal parameter structure; The process for regenerating the conformal master key is as follows: Obtain the system master key (key) stored in the trusted hardware, and the conformal parameter (par) of the conformal master key to be replaced. Extract the device_id identifier, timestamp, and salt random perturbation parameter from the encryption service calling node. Use the encryption service calling node to generate the conformal master key from the conformal parameter (par), where the generation formula is: ； Where K represents the generated conformal master key that is consistent with the structure of the conformal parameter par; This refers to an HMAC-based KDF function, specifically an HMAC-based key extraction and expansion derivation function, where HMAC stands for Hash Message Authentication Code. Indicates splicing; Generate a conformal master key using SHA-256 hash operation. The hash value is used as the conformal master key. The unique key identifier will be used to generate the conformal master key. And the unique key identifier is stored in the key management repository; Constructing the conformal master key set after dynamic key rotation .

4. The conformal key management method for financial data based on dynamic key rotation as described in claim 3, characterized in that, Multiple rounds of derivation are performed on the conformal master keys in the conformal master key set after dynamic key rotation to obtain the multi-round keys of the conformal master keys, including: The multi-round derivation process for the conformal master key is as follows: Extract the conformal master key and its derived parameters from the conformal master key set after dynamic key rotation. The derived parameters include the unique identifier ID of the financial data stream and the current round identifier. Use the derived parameters and encryption functions to derive multi-round keys from the conformal master key: ； in, Represents the conformal master key The r-th round key, where R represents the preset conformal encryption round. A unique identifier ID representing a financial data stream. Indicates the current round identifier. Indicates the generation of conformal master key The round key perturbation factor of the r-th round key. Secure hash function Represents a pseudo-random function. This indicates a splicing operation.

5. The conformal key management method for financial data based on dynamic key rotation as described in claim 1, characterized in that, Set access permissions for different fields in the financial data stream, and set the encryption rounds for the fields based on the access permissions, including: The fields in the financial data stream are divided into identity recognition fields, account sensitive fields, and behavior record fields. Access permissions for different field categories in the financial data stream are set according to access control policies. The access permissions for identity recognition fields, account sensitive fields, and behavior record fields are respectively high-level access permissions, medium-level access permissions, and low-level access permissions. The encryption rounds for fields are set based on access permissions. The encryption rounds for fields with high access permissions are 10 rounds, 8 rounds, and 6 rounds, respectively. Users with high access permissions can receive the round keys for 10 encryption rounds for each field, users with medium access permissions can receive the round keys for 8 encryption rounds for each field, and users with low access permissions can receive the round keys for 6 encryption rounds for each field.

6. The conformal key management method for financial data based on dynamic key rotation as described in claim 5, characterized in that, By using multiple round keys to perform round-encryption processing on fields in the financial data stream for different rounds, the encrypted ciphertext of the financial data stream based on access permissions is obtained, including: Obtain the encryption rounds and multi-round keys of fields in the financial data stream. Perform round encryption processing on the fields for different encryption rounds based on the FF3 encryption algorithm. Use the output of the last encryption round as the shape-preserving encrypted ciphertext of the field and distribute the multi-round keys to authorized users. Concatenate the shape-preserving encrypted ciphertexts of all fields to obtain the encrypted ciphertext of the financial data stream.

7. A conformal key management system for financial data, characterized in that, The conformal key management system for financial data includes a dynamic key rotation unit, a round key derivation module, a conformal encryption module, and a key management library. The key management library stores the conformal master key and unique key identifier, and includes a key registry for registering round key information. The dynamic key rotation unit is used to receive the financial data stream to be encrypted, perform conformal master key format matching on the fields in the financial data stream to obtain a conformal master key set adapted to the financial data stream format, use a dynamic key rotation strategy function to evaluate the rotation scheduling value of the conformal master keys in the conformal master key set, calculate the average rotation scheduling value of all conformal master keys in the conformal master key set, if the rotation scheduling value of the conformal master key in the conformal master key set exceeds the average rotation scheduling value, then regenerate the conformal master key for key replacement, otherwise retain the original conformal master key, and obtain the conformal master key set after dynamic key rotation; The round key derivation module is used to perform multiple rounds of derivation on the conformal master key in the conformal master key set after dynamic key rotation, to obtain multiple round keys of the conformal master key, assign a unique key identifier to the round key, and register it in the key registry; The conformal encryption module is used to set access permissions for different fields in the financial data stream, set the encryption rounds for the fields based on the access permissions, and use multiple round keys to perform round encryption processing on the fields for different encryption rounds to obtain encrypted ciphertext of the financial data stream based on access permissions. To implement the conformal key management method for financial data based on dynamic key rotation as described in any one of claims 1-6.

Images