Financial big data security management platform and working method thereof

Abstract

The invention relates to the technical field of data security, and discloses a financial big data security management platform and a working method thereof, and the platform comprises a collaborative strategy center module which generates a unified collaborative control strategy and issues the collaborative control strategy to other modules; the privacy calculation and analysis module is used for generating cross-domain security insight data based on the strategy; the hidden verification service module is used for generating a ciphertext verification assertion based on the strategy; the intelligent cognitive engine module is used for fusing the cross-domain security insight data, the ciphertext verification assertion and the real-time security data flow and generating comprehensive security situation information; and the full-link evidence storage module captures key operation and output of each module and forms a tamper-proof full-life-cycle auditing evidence chain. The method corresponds to the platform. Through cooperation of strategy driving and multiple modules, cross-domain security management and credible auditing of financial data under privacy protection are realized.

Description

Technical Field

[0001] This application relates to the field of data security technology, specifically a financial big data security management platform and its working method. Background Technology

[0002] In the process of financial digitalization, data has become a core asset. Financial institutions have an increasingly urgent need for cross-institutional data collaborative analysis and verification in their risk control, marketing, and anti-fraud operations.

[0003] However, the sensitivity of financial data, stringent privacy compliance requirements (such as the Data Security Law and the Personal Information Protection Law), and the needs of business development present multiple contradictions. On the one hand, data silos exist between institutions, making it difficult to directly share raw data for joint value mining or customer identity verification due to concerns about data leakage and compliance risks. On the other hand, data analysis within a single institution is limited in addressing increasingly sophisticated risks such as organized fraud and money laundering, making it difficult to form a holistic perspective. Furthermore, even when isolated technical means (such as simple data anonymization or traditional encryption) are used to attempt collaboration, the process often lacks unified and intelligent scheduling, and the operational chain is opaque, failing to meet the stringent requirements of the financial industry for end-to-end traceability and auditability. Existing technical solutions mostly focus on solving problems in single links, lacking a unified platform that can organically integrate data privacy protection, secure collaborative computing, intelligent risk identification, and end-to-end trusted auditing, resulting in low efficiency, difficulty in collaboration, and high compliance costs for cross-domain secure applications of financial data. Summary of the Invention

[0004] The purpose of this application is to provide a financial big data security management platform and its working method to solve the technical problems mentioned in the background.

[0005] To achieve the above objectives, this application discloses the following technical solutions: In the first aspect, this application discloses a financial big data security management platform, including: a collaborative strategy central module, a privacy computing and analysis module, a concealed verification service module, an intelligent cognitive engine module, and a full-link evidence storage module; The collaborative strategy central module is configured to receive and parse financial business requests, and generate and distribute a unified collaborative control strategy to the privacy computing and analysis module, the concealment verification service module and the intelligent cognitive engine module based on the business scenario identifier and associated financial data hierarchical label of the request. The privacy computing and analysis module is connected to and controlled by the collaborative strategy central module. It is configured to build federated computing tasks among multiple data participants based on the collaborative control strategy, and use homomorphic encryption technology to jointly model and analyze encrypted data to generate cross-domain security insight data. The hidden verification service module is connected to and controlled by the collaborative strategy central module. It is configured to call the secure multi-party computation protocol based on the collaborative control strategy to perform hidden matching calculations between the querying party and one or more data participants as verification objects, and generate encrypted verification assertions. The intelligent cognitive engine module is connected to the privacy computing and analysis module and the covert verification service module respectively. It is configured to integrate the cross-domain security insight data, the encrypted verification assertion and the real-time acquired internal and external security data streams, and perform dynamic risk assessment and attack tracing through multimodal analysis to generate comprehensive security situation intelligence. The full-link evidence storage module connects the collaborative strategy central module, the privacy computing and analysis module, the concealed verification service module, and the intelligent cognitive engine module. It is configured to capture the key operations and outputs of each module and record the collaborative control strategy, the cross-domain security insight data, the encrypted verification assertion, and the summary information of the comprehensive security situation intelligence in sequence on the blockchain to form a tamper-proof full lifecycle audit evidence chain.

[0006] Optionally, the collaborative strategy central module includes a strategy decision-making unit and a task orchestration unit; The strategy decision unit is configured to maintain a knowledge graph-based business scenario and data security strategy mapping library, and retrieve and trigger the corresponding composite security strategy rule set based on the received business scenario identifier and the financial data classification label; The task orchestration unit, connected to the policy decision unit, is configured to parse the composite security policy rule set into an executable task flow. The task flow is used to define the execution logic, data interaction interface, and constraints of the privacy computing analysis module, the concealment verification service module, and the intelligent cognitive engine module, and is encapsulated as the collaborative control policy.

[0007] Optionally, the strategy decision unit is further configured to: receive feedback information from the intelligent cognitive engine module that has threat pattern change characteristics, and based on the feedback information, incrementally update the composite security policy rule set in the business scenario and data security policy mapping library through a preset evolution algorithm, so as to drive the task orchestration unit to generate a collaborative control strategy that adapts to the latest threat situation.

[0008] Optionally, the privacy-preserving computation analysis module includes a federated task management unit and a secret-state fusion computation unit; The federated task management unit is configured to deploy standardized federated contracts with data alignment protocols, cryptographic algorithm identifiers, and contribution evaluation models to each data participant node according to the collaborative control strategy. The encrypted fusion computing unit is connected to the federated task management unit and is configured to coordinate each data participant node to process data locally using a homomorphic encryption algorithm according to the federated contract, and to aggregate and iterate the encrypted intermediate results through a secure aggregation protocol to finally generate the cross-domain security insight data.

[0009] Optionally, the covert verification service module includes a verification interface unit and a multi-party computation execution unit; The verification interface unit is configured to receive and standardize the query request to be verified according to the collaborative control strategy, and convert it into an input vector suitable for secure multi-party computation. The multi-party computation execution unit is connected to the verification interface unit and is configured to establish a secure channel between the querying party and one or more data participants as verification objects based on the input vector, and execute privacy matching logic based on obfuscated circuits, so that the data participants can obtain the encrypted verification assertion without decrypting the query vector and without the querying party accessing the full amount of data.

[0010] Optionally, the intelligent cognitive engine module includes a multi-source data fusion unit and a dynamic risk reasoning unit; The multi-source data fusion unit is configured to clean, normalize, and align entities of multi-source heterogeneous data, and inject the cross-domain security insight data and the encrypted verification assertion as key feature dimensions to construct a unified set of analytical features. The dynamic risk reasoning unit, connected to the multi-source data fusion unit, is configured to perform in-depth mining of the analysis feature set, identify hidden attack chains and assess entity risk scores, and generate the comprehensive security situation intelligence with attack path deduction and source tracing results.

[0011] Optionally, the dynamic risk reasoning unit is further configured to: construct an attack and defense game model based on historical security events and the current system state to simulate the evolution of potential threats, and output targeted security strategy adjustment suggestions to the collaborative strategy central module for optimization of the collaborative control strategy.

[0012] Optionally, the end-to-end evidence storage module includes an event capture unit and a blockchain anchoring unit; The event capture unit is configured to monitor in real time the collaborative control strategy, cross-domain security insight data, encrypted verification assertion, and comprehensive security situation intelligence output by each module to obtain capture information; The blockchain anchoring unit is connected to the event capturing unit and is configured to generate structured event records from the captured information, calculate their hash values, and anchor the hash values ​​to the permissioned blockchain according to the time sequence and event logic relationship, thereby forming the independently verifiable full lifecycle audit evidence chain.

[0013] Optionally, the blockchain anchoring unit is further configured to: when generating the event record, simultaneously generate a zero-knowledge proof that the event record satisfies preset compliance rules, and anchor the zero-knowledge proof and the hash value of the event record together to the permissioned blockchain.

[0014] Secondly, this application discloses a working method for a financial big data security management platform as described in any of the above-mentioned methods, the method comprising: Step 1: Receive and parse financial business requests, and generate and issue a unified collaborative control strategy based on the business scenario identifier and associated financial data hierarchical tags of the requests; Step 2: Based on the aforementioned collaborative control strategy, a federated computing task is constructed among multiple data participants, and homomorphic encryption technology is used to jointly model and analyze the encrypted data to generate cross-domain security insight data; Step 3: Based on the aforementioned collaborative control strategy, invoke the secure multi-party computation protocol to perform covert matching computation between the querying party and one or more data participants acting as verification objects, and generate encrypted verification assertions; Step 4: Integrate the cross-domain security insight data, the encrypted verification assertion, and the real-time acquired internal and external security data streams, and perform dynamic risk assessment and attack tracing through multimodal analysis to generate comprehensive security situation intelligence; Step 5: Capture the key operations and outputs from Steps 1 to 4, and record the summary information of the collaborative control strategy, the cross-domain security insight data, the encrypted verification assertion, and the comprehensive security situation intelligence in sequence on the blockchain to form a tamper-proof full lifecycle audit evidence chain.

[0015] Beneficial Effects: The financial big data security management platform and its working method of this application, through unified scheduling by a collaborative strategy central module and integration of privacy computation analysis, covert verification services, intelligent cognitive engines, and end-to-end evidence storage modules, achieve cross-domain collaborative security management capabilities for financial data. Specifically, through policy-driven approaches, specific business scenarios and security requirements are dynamically transformed into collaborative tasks that integrate privacy computation technologies such as federated learning and secure multi-party computation, enabling simultaneous data value mining and privacy protection. Simultaneously, through module collaboration, insights obtained from cross-domain computation and assertions derived from covert verification are intelligently fused and analyzed with real-time data streams to generate more comprehensive and accurate security intelligence. Every key operation and result in the entire process is automatically and immutably recorded on the blockchain, forming a complete audit evidence chain. This ensures data privacy while meeting the rigid requirements of compliance auditing, thereby improving the efficiency, intelligence, and compliance credibility of financial institutions conducting cross-institutional data collaboration while strictly adhering to data security bottom lines. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A structural block diagram of the financial big data security management platform provided in this application embodiment; Figure 2 A flowchart illustrating the working method of the financial big data security management platform provided in this application embodiment. Detailed Implementation

[0018] To facilitate understanding of the technical solutions provided in the embodiments of this application, the background technology involved in the embodiments of this application will be described below.

[0019] In the digital transformation of the financial industry, data-driven approaches have become central to business innovation and risk control. Whether it's anti-fraud, credit assessment, anti-money laundering, or precision marketing, financial institutions have an unprecedented need for cross-institutional data collaborative analysis and verification. By aggregating data resources from multiple sources, more comprehensive customer profiles can be built, and complex group risks can be identified earlier, thereby improving the quality, efficiency, and security of financial services.

[0020] However, this collaborative vision faces multiple and intertwined technical contradictions and compliance challenges in practice. The primary contradiction lies in the fundamental conflict between the utilization of data value and the protection of privacy and security. Financial data is highly sensitive and subject to stringent regulatory requirements, and the strong sense of data sovereignty has led to the formation of solid data silos among institutions. Traditional solutions, such as data anonymization or direct transmission of encrypted data, either cannot support complex joint computations or still carry the risk of raw data leakage or model reverse engineering attacks, causing financial institutions to be hesitant or unable to share data.

[0021] Secondly, in specific business scenarios, there is a conflict between the need for cross-institutional identity and information verification and the requirement for confidentiality in the verification process. For example, in credit approval, Bank A needs to verify whether a customer is on Bank B's blacklist, but neither party is willing to disclose details of their customer list. Existing point-to-point inquiries or methods using third-party intermediaries are technically insufficient to simultaneously guarantee the confidentiality of the inquiry, the accuracy of the results, and the fairness and auditability of the process.

[0022] Furthermore, faced with increasingly sophisticated and dynamically evolving financial crime methods (such as cross-border money laundering and high-tech fraud), there is a significant gap between the partial data view of a single institution and the panoramic view required to identify global and latent security threats. Even if individual institutions adopt advanced analytical models, the accuracy and foresight of their risk identification remain insufficient due to limitations in the dimensions of their input data.

[0023] Furthermore, from a compliance and governance perspective, any cross-agency data collaboration process must be transparent, traceable, and tamper-proof to meet the rigid requirements of internal and external audits and regulations such as the Data Security Law. However, existing collaboration models often lack standardized operational records and legally valid evidence preservation mechanisms, making the collaboration process a "black box," making it difficult to prove innocence in the event of disputes or regulatory reviews.

[0024] While current technological advancements offer solutions in certain areas—such as federated learning for joint modeling, secure multi-party computation for privacy queries, and blockchain for evidence storage—these solutions often exist in isolation, resulting in a collection of technologies. This situation leads to low system coupling, poor collaboration efficiency, slow response times, and an inability to form a closed loop from risk perception to strategy optimization, making it difficult to support the comprehensive requirements of financial operations for real-time performance, intelligence, and compliance.

[0025] The background described above reveals not just a single technical challenge, but a complex problem domain requiring systematic innovation at the architectural level. This application is proposed against this backdrop.

[0026] The technical solutions in the embodiments of this application will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application. In this document, the term "comprising" is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements, but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0027] In addition, it should be specifically noted that all data processing activities described in the embodiments of this application, including data collection, transmission, calculation and storage, are carried out in accordance with the prior explicit authorization of the data subject and in strict compliance with relevant laws, regulations and regulatory policies such as the Personal Information Protection Law and the Data Security Law. All technical means are aimed at achieving data usability without visibility, protecting the rights and interests of the data subject and meeting compliance audit requirements.

[0028] Firstly, the financial big data security management platform and its working method in this embodiment, such as... Figure 1 As shown, it includes: a collaborative strategy central module, a privacy computing and analysis module, an anonymous verification service module, an intelligent cognitive engine module, and a full-link evidence storage module, as detailed below.

[0029] In its implementation, the collaborative strategy hub module can be a software service running on one or more servers. Its configuration involves receiving and parsing financial business requests sent via APIs (Application Programming Interfaces) from external business systems (such as credit approval systems and anti-fraud systems). These requests must include a business scenario identifier (e.g., "anti-fraud joint modeling," "blacklist cross-verification") and associated financial data classification tags (e.g., "C3 level sensitive personal information"). Internally, the module uses a parsing engine to call the strategy engine based on the request's business scenario identifier and associated financial data classification tags. According to a pre-defined mapping relationship, it generates and distributes a unified, machine-readable collaborative control strategy (e.g., in JSON or XML format) to the privacy computing and analysis module, the anonymity verification service module, and the intelligent cognitive engine module. This collaborative control strategy document defines the specific goals, parameters, and constraints for subsequent collaboration among the modules.

[0030] The privacy-preserving computation and analytics module can be physically deployed as an independent microservice cluster. It connects to and is controlled by the collaborative policy central module via a service bus or API. Configured based on a collaborative control policy, this module first establishes secure communication connections with the back-end systems of multiple data participants (e.g., Bank A, Bank B, and Bank C) specified in the policy through its built-in task coordinator, negotiating and constructing a federated computation task. Next, the module's core computing engine employs homomorphic encryption techniques, such as the Paillier encryption algorithm or the CKKS scheme, allowing each participant to perform predetermined joint modeling (e.g., logistic regression, neural network training) or statistical analysis (e.g., summation, average calculation) on the encrypted data locally without decryption. Finally, the encrypted intermediate results from all parties are aggregated through a secure aggregation protocol (e.g., Secure Aggregation) to generate a cross-domain security insight data report, which itself may contain encrypted or anonymized statistical results.

[0031] The covert verification service module is also deployed as an independent microservice. It is connected to and controlled by the coordination strategy central module. This module is configured to invoke the Secure Multi-Party Computation (MPC) protocol based on the coordination control strategy. Specifically, when a querying party (such as Bank A) needs to verify customer information with one or more data participants (such as Bank B and Bank C) as verification objects, the MPC coordinator of this module establishes a secure channel (such as TLS 1.3) between the parties and coordinates the execution of a covert matching calculation logic. For example, using an MPC protocol based on Garbled Circuit, Bank B and Bank C can complete the matching operation in their local databases without knowing the specific query content of Bank A (customer's ID number), and only return an encrypted or obliviously transferred ciphertext verification assertion (such as an encrypted "match successful" or "match failed" flag) to Bank A.

[0032] The intelligent cognitive engine module is architecturally connected to the privacy computing and analysis module and the covert verification service module via data interfaces to obtain their outputs. This module is configured to, on the one hand, acquire internal and external security data streams in real time through a data acquisition agent, including internal network traffic mirroring, host security logs, and push notifications from external threat intelligence platforms; on the other hand, it integrates cross-domain security insight data from the privacy computing and analysis module (such as jointly identified abnormal transaction patterns) and encrypted verification assertions from the covert verification service module (such as confirming that an account is associated with a high-risk entity). Then, the module's built-in multimodal analysis engine (which can integrate natural language processing, graph computing, and time series analysis models) performs correlation and in-depth analysis on this heterogeneous information, performs dynamic risk assessment and attack attribution, and ultimately generates a comprehensive security situation intelligence report containing risk level, impact scope, and attack path predictions.

[0033] The end-to-end evidence storage module connects to and monitors the log output interfaces of the collaborative policy hub module, privacy computing and analysis module, covert verification service module, and intelligent cognitive engine module via a log broker or event listener. This module is configured to capture in real-time the summary information (typically its SHA-256 hash value) of key operational events (such as "policy issuance," "federated task initiation," "MPC verification request," and "risk event alert") and key output data (i.e., the aforementioned collaborative control policies, cross-domain security insight data, encrypted verification assertions, and comprehensive security situation intelligence) generated by these modules. The captured events and hash values ​​are encapsulated into blocks in chronological order and recorded on a permissioned blockchain (such as a consortium blockchain built on Hyperledger Fabric) through consensus nodes. These sequentially linked blocks form a tamper-proof, full-lifecycle audit evidence chain; any tampering with the records on the chain will be detected by other nodes.

[0034] Based on the above, the platform integrates previously isolated privacy computing, security verification, and intelligent analysis technologies into a cohesive whole through centralized scheduling of the collaborative strategy hub module. The privacy computing and analysis module achieves cross-domain value mining while protecting data privacy; the concealed verification service module completes trusted data verification while concealing query details; the intelligent cognitive engine module integrates information from multiple parties, improving the comprehensiveness and accuracy of risk identification; and the end-to-end evidence storage module provides tamper-proof audit evidence for the entire complex collaborative process. These modules work collaboratively to achieve secure, efficient, and intelligent cross-institutional collaborative governance of financial big data within a strict compliance framework.

[0035] Regarding the specific issue of how the collaborative strategy central module can realize intelligent strategy generation and task orchestration, as an optional implementation method in this embodiment, the collaborative strategy central module includes a strategy decision-making unit and a task orchestration unit.

[0036] In its implementation, the strategy decision-making unit can be a knowledge graph reasoning engine built on a graph database (such as Neo4j). The unit is configured to maintain a knowledge graph-based mapping library of business scenarios and data security policies. The nodes of this knowledge graph include various business scenarios (such as "pre-loan approval" and "anti-money laundering monitoring"), data classification and grading labels (such as "personal identity information" and "transaction records"), and security compliance rules (such as "data export restrictions" and "minimum necessity principle"). Edges represent the relationships between them (such as "pre-loan approval scenario involves personal identity information"). When a business scenario identifier and a financial data grading label are received, the strategy decision-making unit retrieves and triggers the corresponding composite security policy rule set through graph querying and reasoning based on these identifiers. For example, for "anti-money laundering monitoring" and "C3 level data," the rule set might include entries such as "federated learning must be used," "verification must use MPC," and "results must be anonymized."

[0037] In terms of software implementation, the task orchestration unit can be a workflow engine (such as Apache Airflow), which connects to the policy decision unit through internal function calls or message passing. Specifically, the task orchestration unit is configured to receive the composite security policy rule set output by the policy decision unit and parse it into an executable task flow. The task flow defines the execution logic (e.g., parallel execution of federated computation and MPC verification followed by fusion analysis), data interaction interfaces (e.g., specifying API endpoints and data formats for data transmission), and constraints (e.g., timeout periods and retry policies) of the privacy computation analysis module, covert verification service module, and intelligent cognitive engine module in the form of a directed acyclic graph (DAG). Finally, the orchestration unit encapsulates this flow definition and necessary parameters into a structured document of collaborative control policies.

[0038] Based on the above, this design transforms strategy generation from static configuration to a dynamic and intelligent reasoning process, while task orchestration ensures that complex processes across heterogeneous technology components can be precisely and automatically scheduled and executed, improving the platform's flexibility and processing efficiency in dealing with diverse business scenarios.

[0039] To address the problem that existing security strategies are static and rigid, making it difficult to adapt to the rapidly evolving security threats in the financial sector, as a preferred implementation of this embodiment, the strategy decision unit is further configured to: receive feedback information from the intelligent cognitive engine module that has threat pattern change characteristics, and based on the feedback information, incrementally update the composite security policy rule set in the business scenario and data security policy mapping library through a preset evolution algorithm, so as to drive the task orchestration unit to generate a collaborative control strategy that adapts to the latest threat situation.

[0040] In practice, when generating comprehensive security situation intelligence, the intelligent cognitive engine module will simultaneously extract new threat pattern features. (For example, the feature vector of a relational subgraph in a novel money laundering pattern), and sends it as feedback information to the policy decision-making unit. The policy decision-making unit contains a policy evolver based on a knowledge graph embedding and threat propagation model. The core of the evolution process is to compute the value of each rule in the current policy rule set. For new threats Defense urgency score The score is determined by the semantic relevance of the rule to the threat. and historical defense effectiveness Joint decision: in, Through calculation rules Embedding vectors in knowledge graphs Threat characteristics Embedded vector The cosine similarity between them is obtained, that is . It is based on historical event statistics and rules. The percentage of attacks that were successfully blocked or mitigated after being triggered. and These are preset weighting coefficients used to balance adaptability to new threats with historical reliability.

[0041] Meanwhile, the strategy evolver includes a threat propagation attenuation factor to simulate the diffusion effect of threats in the business association graph. When new threats Associated with a specific business node At the same time, other nodes that have direct data flow or business dependencies with it The urgency of the association rule will receive an increment: in, It is a node and The shortest path distance in the business graph. The evolutionary algorithm periodically (e.g., every 24 hours) calculates the shortest path distance for all rules. With possible ,right Above the threshold For rules with low urgency, automatically increase their weight in the rule set or decrease their trigger threshold; for rules with low urgency over a long period (… If the rules are incorrect, they will be subject to weight decay or archiving. The updated rule set is then used by the task orchestration unit to generate a collaborative control strategy that can more proactively cover threat propagation paths.

[0042] Based on the above, this design allows the evolution of security strategies to move beyond simple statistical analysis of historical events. Instead, it leverages knowledge graph semantics to understand the nature of new threats and pre-optimizes strategies based on potential propagation paths within the business network. This enables dynamic, proactive, and networked adaptation of strategies, enhancing the platform's overall defensive intelligence and resilience in the face of complex and cascading financial threats.

[0043] Existing technologies often face challenges in implementing cross-agency privacy-preserving computation collaboration, including inconsistent task deployment standards, complex computation process coordination, and a lack of effective mechanisms for measuring the contributions of participating parties. This results in low collaboration efficiency and difficulty in ensuring fairness. As a further optional implementation method in this embodiment, the privacy-preserving computation analysis module includes a federated task management unit and a secret-state fusion computation unit.

[0044] The Federation Task Management Unit is configured to deploy standardized federated contracts with data alignment protocols, cryptographic algorithm identifiers, and contribution evaluation models to each data participant node according to the collaborative control strategy.

[0045] The encrypted fusion computing unit, connected to the federated task management unit, is configured to coordinate the data participants' nodes to process data locally using homomorphic encryption algorithms according to the federated contract, and to aggregate and iterate the encrypted intermediate results through a secure aggregation protocol to ultimately generate cross-domain security insight data.

[0046] In its implementation, the Federation Task Management Unit can be a set of microservices running in a trusted environment. Based on the list of participants and computational objectives (e.g., joint anti-fraud model training) specified in the collaborative control strategy, it generates a machine-readable, standardized federated contract document. This contract document, defined in JSON or YAML format, explicitly includes: 1) a data alignment protocol, which may specify the use of Private Set Intersection (PSI) technology to securely align shared user identifiers among participants without exposing non-intersecting parts; 2) an encryption algorithm identifier, such as specifying the use of Paillier homomorphic encryption or the CKKS scheme for data encryption, and indicating key length, security parameters, etc.; 3) a contribution evaluation model, such as defining an approximate computation framework based on Shapley values ​​for post-hoc evaluation of each participant's data contribution to the final model, providing a basis for possible incentive mechanisms. This unit deploys the contract to the designated receiving endpoints of each data participant node via a secure HTTPS channel.

[0047] The encrypted fusion computing unit can physically be a dedicated server cluster for high-performance homomorphic cryptographic computation, connected to the federated task management unit via internal RPC (Remote Procedure Call). This unit acts as a central coordinator, and its workflow includes: First, it broadcasts the computation start instruction and federated contract to all participants; then, in each iteration, each participant locally encrypts its data using the homomorphic encryption algorithm and public key specified in the contract to obtain encrypted data, and calculates local model updates (such as gradients); next, each party uploads its encrypted local updates to the encrypted fusion computing unit; this unit utilizes the additive homomorphism of homomorphic encryption to perform secure aggregation operations, such as calculating weighted averages, on all uploaded encrypted updates without decryption; finally, it sends the aggregated encrypted global update back to each participant to update their local models. This process iterates until the model converges or reaches a predetermined number of rounds, ultimately generating an encrypted or anonymized joint model or statistical report, i.e., cross-domain security insight data. The secure aggregation process can employ existing secure aggregation protocols, such as the scheme proposed by Google in federated learning, to prevent a central coordinator from spying on updates from individual participants.

[0048] Based on the above, standardized contracts clarify the collaboration rules, and professional dense-state fusion computing units ensure the security and efficiency of the computing process. This enables cross-institutional federated learning tasks to be executed in a standardized and automated manner, while also taking into account the evaluability of the contributions of the participants, thereby improving the reliability, efficiency, and fairness of cross-domain data value mining.

[0049] Existing technologies suffer from several drawbacks when processing cross-agency data verification: a disconnect between the verification process and secure computation protocols, inconsistent query formats, low computational efficiency, and high development complexity in achieving two-way privacy protection. As a further optional implementation of this embodiment, the covert verification service module includes a verification interface unit and a multi-party computation execution unit. The verification interface unit is configured to receive and standardize the query request to be verified according to the collaborative control strategy, and convert it into an input vector suitable for secure multi-party computation; The multi-party computation execution unit is connected to the verification interface unit and is configured to establish a secure channel between the querying party and one or more data participants as verification objects based on the input vector, and execute privacy matching logic based on obfuscated circuits, so that the data participants can obtain the encrypted verification assertion without decrypting the query vector and without the querying party accessing the full amount of data.

[0050] The verification interface unit is specifically implemented as an API gateway service. It receives verification requests from business systems (such as credit approval systems), which contain information such as the business transaction number and fields to be verified (e.g., the hash value of a customer's ID card number). Based on the verification type defined in the collaborative control strategy (e.g., blacklist verification), this unit calls the corresponding data formatting template to convert the unstructured request into a structured intermediate representation. Then, according to the specific input format required by the backend multi-party computation execution unit, this intermediate representation is further processed into an input vector. For example, if the backend uses a Boolean circuit-based protocol, each bit of the ID card number hash value is converted into a binary bit and combined into a binary vector; if an arithmetic circuit protocol is used, it can be converted into an integer vector over a finite field. This standardization process ensures that queries from different sources can enter the secure computation process in a unified and compliant format.

[0051] The Multi-Party Computation Execution Unit (MPC) is a secure MPC engine that connects to the verification interface unit via a message queue or internal API. At its core, it integrates a garbled circuit compiler and executor. Upon receiving a standardized input vector, this unit first establishes a secure, mutually authenticated channel between the querying party and one or more data participants via TCP connection and based on the TLS protocol. Subsequently, the executor coordinates the parties to execute an MPC protocol based on a garbled circuit, according to predefined matching logic (e.g., determining whether the query vector equals any item in the data participant's database). The specific steps are as follows: 1) The matching logic is compiled into a Boolean circuit by the unit or a designated third party; 2) An obfuscated version of the circuit is generated, i.e., the truth table of each logic gate in the circuit is encrypted (obfuscated); 3) The querying party obtains the encrypted input tags corresponding to its input vectors; 4) The data participants, as circuit evaluators, evaluate the obfuscated circuit gate by gate using the tags corresponding to these obfuscated inputs and their own inputs (such as the hash values ​​of database entries) without decrypting the meaning of any tags; 5) Finally, only the querying party can decrypt the evaluation results and obtain a ciphertext verification assertion (e.g., an encrypted Boolean value) representing "match" or "no match". Throughout the process, the data participants cannot know the specific content of the query, and the querying party cannot obtain the full dataset information of the data party.

[0052] Based on the above, business queries are seamlessly integrated into a secure computing protocol through standardized interfaces, and two-way privacy protection is reliably achieved through mature obfuscation circuit technology. This engineers and modularizes complex cryptographic protocols, lowering the technical threshold for integrating privacy verification capabilities into financial services. Under the premise of safeguarding data sovereignty and privacy, it provides a practical solution for cross-institutional trusted verification.

[0053] In financial risk control scenarios, insights from privacy computing and covert verification are isolated from massive, heterogeneous real-time security data. Traditional analysis methods struggle to effectively correlate and deeply integrate these insights, leading to fragmented risk identification and difficulty in discovering complex cross-domain and cross-link attack patterns. As an optional implementation in this embodiment, the intelligent cognitive engine module includes a multi-source data fusion unit and a dynamic risk reasoning unit. The multi-source data fusion unit is configured to clean, normalize, and align entities of multi-source heterogeneous data, and inject cross-domain security insight data and encrypted verification assertions as key feature dimensions to build a unified set of analytical features. The multi-source heterogeneous data includes network traffic, endpoint behavior logs, and threat intelligence, etc. The dynamic risk reasoning unit, connected to the multi-source data fusion unit, is configured to perform in-depth analysis of feature sets, identify hidden attack chains and assess entity risk scores, and generate comprehensive security situation intelligence with attack path deduction and source tracing results.

[0054] In its implementation, the multi-source data fusion unit can be a streaming and batch data processing platform based on Apache Flink or Spark Streaming. It continuously receives cross-domain security insight data from the privacy computing and analysis module (e.g., decrypted or anonymized lists of high-risk user groups), encrypted verification assertions (decrypted results) from the covert verification service module, and internal and external security data streams from various sources. For network traffic data, the unit extracts features such as source / destination IPs, ports, protocols, and byte counts by parsing NetFlow or full-packet capture files; for endpoint behavior logs, it extracts sequences such as processes, files, and registry operations by parsing Syslog or EDR (Endpoint Detection and Response) events; and for external threat intelligence, it parses STIX / TAXII format feeds to obtain information such as malicious IPs, domain names, and file hashes. The unit performs the following core operations: cleaning (removing duplicate and invalid records), normalization (unifying timestamps from different logs to UTC and IP addresses to integer form), and entity alignment (using entity resolution technology to associate records from different data sources pointing to the same user, device, or account, and assigning a unique ID to each entity). Finally, the unit combines the processed cross-domain security insight data and verification assertions as two highly weighted feature dimensions with the features of real-time security data to construct a unified high-dimensional, time-series analytical feature vector set for each entity or event.

[0055] At the software level, the dynamic risk reasoning unit can be a containerized service integrating multiple machine learning models. It loads the analytical feature set produced by the multi-source data fusion unit and first uses unsupervised learning algorithms (such as Isolation Forest or autoencoders) for anomaly detection, identifying behaviors that deviate from normal patterns. Next, the unit employs graph computing technology, constructing a dynamic heterogeneous graph network with entities as nodes and their interactions (such as fund transfers and logins) as edges. Based on this, the unit runs a graph neural network model, such as a graph attention network, which aggregates information from neighboring nodes through a message passing mechanism, learning a deep representation of each entity node. Based on this representation, the unit can: 1) calculate a risk score for each entity (such as a user account) through a supervised classification layer; 2) identify subgraph structures connecting multiple high-risk entities, i.e., hidden attack chains (e.g., multi-layered fund transfer paths), by analyzing the weights and paths of edges in the graph; and 3) when a high-risk event is detected, traverse the entity's associated paths and historical interactions in the graph to infer possible entry points and propagation paths of the attack, achieving source tracing and localization. Finally, the unit integrates the above analysis results to generate a structured comprehensive security situation intelligence report.

[0056] Based on the above, through systematic data engineering, multi-source heterogeneous information is integrated into features that can be analyzed in depth, and advanced graph neural network models are used for correlation reasoning. This enables a leap from point-based risk warnings to global attack chain cognition, improving the platform's ability to discover, understand, and trace complex and hidden financial security threats.

[0057] Existing risk control systems typically respond based on historical rules or a single model, lacking the ability to simulate dynamic game theory between attack and defense. This prevents them from predicting the evolution of attack strategies and proactively optimizing defense strategies, resulting in defense systems always lagging behind emerging threats. As a further optional implementation in this embodiment, the dynamic risk reasoning unit is also configured to: construct an attack and defense game model based on historical security events and the current system state to simulate the evolution of potential threats, and output targeted security strategy adjustment suggestions to the collaborative strategy central module for optimization of collaborative control strategies.

[0058] In practice, this function is implemented by a game theory component within the dynamic risk reasoning unit. This component maintains a historical security event database, recording the characteristics of various attack events, the techniques and tactics used, their success or failure, and the defensive measures taken by the platform at the time (i.e., the parameters of the collaborative control strategy at that time). The current system state includes real-time assessments of network vulnerabilities, asset value distribution, and activated security rules. The game theory component is activated periodically (e.g., hourly) or when a new significant threat pattern is discovered. It first encodes historical events and the current state, abstractly defining the game participants: the attacker (Adversary) and the defender (Defender, i.e., the platform). The attacker's strategy set... Based on historical attack patterns, this may include: Etc. The defensive side's strategy set. These correspond to adjustable parameters in the collaborative control strategy, such as... .

[0059] The game model employs either a stochastic game or a repeated game framework. The components are for each pair of strategies. Define a payoff matrix. Defender's payoff. Taking into account both defense costs (such as increased verification time) and defense effectiveness (such as the probability of attack being blocked and the reduction of losses), the attacker's gains are... This involves considering the attack cost, success probability, and expected benefits. The benefit value is obtained through statistical analysis of historical data and a weighted calculation based on the current system state.

[0060] The deduction process simulates the evolution of potential threats and optimal defense responses by solving for the Nash Equilibrium of the game or the Stackelberg Equilibrium for the platform as the leader. For example, in the Stackelberg game, the platform (leader) first announces its strategy. The attacker (follower) observes and chooses the optimal response. The platform's goal is to select... To maximize one's own gains while inducing the attacker's optimal response: in, .

[0061] After solving the problem using methods such as iterative calculation or linear programming, the game theory simulation component will determine the defensive strategies that the platform should prioritize or adjust under the current situation. The component will... This is transformed into specific, actionable security policy adjustment suggestions, such as "It is recommended that the concealment verification threshold for cross-border transfer transactions be lowered from 500,000 yuan to 200,000 yuan within the next 2 hours," and this suggestion is sent to the policy decision-making unit of the collaborative policy hub module through an internal interface to drive it to optimize the policy library and subsequent task orchestration.

[0062] Based on the above, game theory is introduced into proactive financial security defense. Through formal modeling and deduction, the platform can predictively adjust its strategies, shifting from passively responding to events to proactively shaping a more favorable security posture, thereby enhancing the intelligence and proactivity of the overall defense system.

[0063] Financial data collaboration is complex and involves multiple parties. Traditional log systems record data in a scattered manner, are easily tampered with, and struggle to prove their integrity. This results in the inability to provide a complete, reliable, and tamper-proof chain of operational evidence in the event of disputes or audits. As an optional implementation method in this embodiment, the end-to-end evidence storage module includes an event capture unit and a blockchain anchoring unit. The event capture unit is configured to monitor the collaborative control policies, cross-domain security insight data, encrypted verification assertions, and comprehensive security situation intelligence output by each module in real time to obtain captured information. The blockchain anchoring unit, connected to the event capture unit, is configured to generate structured event records from captured information, calculate their hash values, and anchor the hash values ​​to the permissioned blockchain according to the time sequence and event logic, forming an independently verifiable full lifecycle audit evidence chain.

[0064] The event capture unit is implemented as a lightweight log agent, deployed on the servers of the Collaborative Policy Hub module, Privacy Computation and Analysis module, Hidden Verification Service module, and Intelligent Cognitive Engine module. Each agent collects key operational events and their output data generated by these modules in real time by listening to the application's standard output, log files, or specific auditing APIs. For example, it captures events such as "The Policy Hub module generated a policy P for scenario S at time T1," "The Privacy Computation module completed a federated task F at time T2, with a result hash of H1," and "The Verification Service module returned an assertion A for query Q at time T3." The captured raw information (capture information) includes a timestamp, module identifier, event type, and key summaries of relevant data (such as the SHA-256 hash value of the data). After preliminary serialization (e.g., conversion to JSON format), the agent sends the captured information to the blockchain anchoring unit.

[0065] The blockchain anchoring unit receives serialized information from various event capturing units. First, it encapsulates the received information into structured, immutable event records according to a predefined format template. Each event record contains at least the following fields: unique record ID, hash of the previous record (used for linking), timestamp, event source, event type, and event content digest. Next, the unit uses a cryptographic hash function (e.g., SHA-256) to calculate the digital fingerprint, or hash value, of the event record. Then, instead of storing each record in isolation, the anchoring unit organizes the hash values ​​of these event records according to the chronological order of events and considering the logical relationships between events (e.g., associating all sub-events belonging to the same business request). One specific implementation is to construct a Merkle tree: using event records within a time window as leaf nodes, calculating hashes for each pair, and progressing upwards layer by layer to ultimately generate a Merkle root hash. Finally, the anchoring unit invokes a smart contract deployed on a permissioned blockchain (e.g., a consortium blockchain built on Hyperledger Fabric and maintained by participating institutions) to hash the Merkle root hash. Key information such as the time window identifier is packaged into a transaction, submitted to the blockchain network for consensus, and recorded in a new block. This is permanently recorded on the blockchain. This is a cryptographic commitment to all event records within that time period. Any alteration to the original event records will result in a discrepancy between the recalculated Merkle root hash and the on-chain record.

[0066] Based on the above, the distributed log collection ensures the breadth of record sources, the cryptographic hashing and Merkle tree structure ensure the integrity and immutability of records, and the distributed consensus mechanism of permissioned blockchain ensures the independent verifiability and durability of the evidence chain, thus building a solid and credible compliance foundation for the entire financial data security collaboration process.

[0067] Directly publishing the hash value or Merkle root of event records on the blockchain still poses a risk of leaking business privacy through reverse engineering or correlation analysis of hash values ​​in certain highly sensitive scenarios. Furthermore, external auditors may need to verify whether a certain attribute (such as "operation authorized") is true when verifying compliance, but they do not have the right to view the specific authorization information in the record. As a further optional implementation of this embodiment, the blockchain anchoring unit is also configured to: simultaneously generate a zero-knowledge proof that the event record meets preset compliance rules when generating the event record, and anchor the zero-knowledge proof and the hash value of the event record together to the permissioned blockchain.

[0068] In practical implementation, this function enhances the capabilities of blockchain anchoring units. Assume a preset compliance rule is... "The operation must occur within the data subject's authorization validity period (start and end time)." "Inside". When the anchoring unit generates a line containing sensitive operation time (Private information) event logs At that time, in addition to calculating its hash value It will also launch a zero-knowledge proof generator. This generator is implemented based on existing zero-knowledge proof system libraries (e.g., libsnark, bulletproofs). The generator will apply the rules... Public parameters ( ) and private input (operation time) () as input.

[0069] The generator first asserts compliance. "Transform into a computable arithmetic or Boolean circuit" Then, a zero-knowledge proof generation algorithm (e.g., the generation process of zk-SNARKs) is run to produce a short zero-knowledge proof. This proof It has the following key properties: it does not contain any information about The information, but any validator can use the public parameters ( )and To verify the "circuit" For some unknown but satisfying condition The statement "the calculation output is true" can be described in formulaic terms as follows: in, Public verification algorithms representing zero-knowledge proofs; It is an existential quantifier, indicating "the existence of a certain..." ”; Indicate membership. Generate zero-knowledge proofs. Then, the blockchain anchor unit will record the hash value of the event. and zero-knowledge proof Along with the necessary public parameters (but excluding) They are packaged together and anchored to a permissioned blockchain.

[0070] External auditors (or regulatory agencies) can access the blockchain at any time to obtain the hash of a record of an event. and its corresponding zero-knowledge proof And public parameters. The auditor runs a verification algorithm; if the verification passes (output is 1), then it can be confirmed that the hash is consistent with the public parameters. Corresponding original event log Hidden operation time The rules are indeed met. (That is, within the authorization period), and the auditor was unaware of it from beginning to end. What is its specific value?

[0071] Based on the above, zero-knowledge proofs, a cryptographic primitive, were used to achieve verifiable assertions on key compliance attributes without disclosing any sensitive business details. This enables the platform to provide irrefutable compliance evidence to auditors while meeting the most stringent privacy protection requirements, resolving the conflict between privacy protection and audit oversight.

[0072] Secondly, this embodiment provides a working method for the financial big data security management platform as described above, such as... Figure 2 As shown, the method includes: Step 1: Receive and parse financial business requests, and generate and issue unified collaborative control strategies based on the business scenario identifier and associated financial data hierarchical tags of the requests; Step 2: Based on the collaborative control strategy, a federated computing task is built among multiple data participants, and homomorphic encryption technology is used to jointly model and analyze the encrypted data to generate cross-domain security insight data; Step 3: Based on the collaborative control strategy, invoke the secure multi-party computation protocol to perform covert matching calculations between the querying party and one or more data participants acting as verification objects, and generate encrypted verification assertions; Step 4: Integrate cross-domain security insight data, encrypted verification assertions, and real-time acquired internal and external security data streams, and conduct dynamic risk assessment and attack tracing through multimodal analysis to generate comprehensive security situation intelligence; Step 5: Capture the key operations and outputs from Steps 1 to 4, and record the summary information of collaborative control strategies, cross-domain security insight data, encrypted verification assertions, and comprehensive security situation intelligence in sequence on the blockchain to form a tamper-proof full lifecycle audit evidence chain.

[0073] It should be noted that this working method corresponds to the aforementioned financial big data security management platform. Therefore, for the parts not described in detail in this working method (including but not limited to specific implementation methods and technical effects), please refer to the relevant descriptions in the aforementioned financial big data security management platform. This text will not repeat them here.

[0074] In the embodiments provided in this application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any suitable combination thereof. For hardware implementation, the processor may be implemented in one or more of the following: application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, other electronic units designed to implement the functions described herein, or combinations thereof. For software implementation, some or all of the processes of the embodiments may be performed by a computer program instructing the associated hardware. During implementation, the program may be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media may be any available medium accessible to a computer. Computer-readable storage media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code having the form of instructions or data structures and accessible to a computer.

[0075] Finally, it should be noted that the above description is only a preferred embodiment of this application and is not intended to limit this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A financial big data security management platform, characterized in that, include: The module includes a collaborative strategy hub, a privacy computing and analysis module, an anonymous verification service module, an intelligent cognitive engine module, and a full-link evidence storage module. The collaborative strategy central module is configured to receive and parse financial business requests, and generate and distribute a unified collaborative control strategy to the privacy computing and analysis module, the concealment verification service module and the intelligent cognitive engine module based on the business scenario identifier and associated financial data hierarchical label of the request. The privacy computing and analysis module is connected to and controlled by the collaborative strategy central module. It is configured to build federated computing tasks among multiple data participants based on the collaborative control strategy, and use homomorphic encryption technology to jointly model and analyze encrypted data to generate cross-domain security insight data. The hidden verification service module is connected to and controlled by the collaborative strategy central module. It is configured to call the secure multi-party computation protocol based on the collaborative control strategy to perform hidden matching calculations between the querying party and one or more data participants as verification objects, and generate encrypted verification assertions. The intelligent cognitive engine module is connected to the privacy computing and analysis module and the covert verification service module respectively. It is configured to integrate the cross-domain security insight data, the encrypted verification assertion and the real-time acquired internal and external security data streams, and perform dynamic risk assessment and attack tracing through multimodal analysis to generate comprehensive security situation intelligence. The full-link evidence storage module connects the collaborative strategy central module, the privacy computing and analysis module, the concealed verification service module, and the intelligent cognitive engine module. It is configured to capture the key operations and outputs of each module and record the collaborative control strategy, the cross-domain security insight data, the encrypted verification assertion, and the summary information of the comprehensive security situation intelligence in sequence on the blockchain to form a tamper-proof full lifecycle audit evidence chain.

2. The financial big data security management platform according to claim 1, characterized in that, The collaborative strategy central module includes a strategy decision-making unit and a task orchestration unit; The strategy decision unit is configured to maintain a knowledge graph-based business scenario and data security strategy mapping library, and retrieve and trigger the corresponding composite security strategy rule set based on the received business scenario identifier and the financial data classification label; The task orchestration unit, connected to the policy decision unit, is configured to parse the composite security policy rule set into an executable task flow. The task flow is used to define the execution logic, data interaction interface, and constraints of the privacy computing analysis module, the concealment verification service module, and the intelligent cognitive engine module, and is encapsulated as the collaborative control policy.

3. The financial big data security management platform according to claim 2, characterized in that, The strategy decision-making unit is further configured to: receive feedback information from the intelligent cognitive engine module that has threat pattern change characteristics, and based on the feedback information, incrementally update the composite security policy rule set in the business scenario and data security policy mapping library through a preset evolution algorithm, so as to drive the task orchestration unit to generate a collaborative control strategy that adapts to the latest threat situation.

4. The financial big data security management platform according to claim 2, characterized in that, The privacy-preserving computation and analysis module includes a federated task management unit and a secret-state fusion computation unit; The federated task management unit is configured to deploy standardized federated contracts with data alignment protocols, cryptographic algorithm identifiers, and contribution evaluation models to each data participant node according to the collaborative control strategy. The encrypted fusion computing unit is connected to the federated task management unit and is configured to coordinate each data participant node to process data locally using a homomorphic encryption algorithm according to the federated contract, and to aggregate and iterate the encrypted intermediate results through a secure aggregation protocol to finally generate the cross-domain security insight data.

5. The financial big data security management platform according to claim 2, characterized in that, The concealed verification service module includes a verification interface unit and a multi-party computation execution unit; The verification interface unit is configured to receive and standardize the query request to be verified according to the collaborative control strategy, and convert it into an input vector suitable for secure multi-party computation. The multi-party computation execution unit is connected to the verification interface unit and is configured to establish a secure channel between the querying party and one or more data participants as verification objects based on the input vector, and execute privacy matching logic based on obfuscated circuits, so that the data participants can obtain the encrypted verification assertion without decrypting the query vector and without the querying party accessing the full amount of data.

6. The financial big data security management platform according to claim 1, characterized in that, The intelligent cognitive engine module includes a multi-source data fusion unit and a dynamic risk reasoning unit; The multi-source data fusion unit is configured to clean, normalize, and align entities of multi-source heterogeneous data, and inject the cross-domain security insight data and the encrypted verification assertion as key feature dimensions to construct a unified set of analytical features. The dynamic risk reasoning unit, connected to the multi-source data fusion unit, is configured to perform in-depth mining of the analysis feature set, identify hidden attack chains and assess entity risk scores, and generate the comprehensive security situation intelligence with attack path deduction and source tracing results.

7. The financial big data security management platform according to claim 6, characterized in that, The dynamic risk reasoning unit is also configured to: construct an attack and defense game model based on historical security events and the current system state to simulate the evolution of potential threats, and output targeted security strategy adjustment suggestions to the collaborative strategy central module for optimization of the collaborative control strategy.

8. The financial big data security management platform according to claim 1, characterized in that, The end-to-end evidence storage module includes an event capture unit and a blockchain anchoring unit; The event capture unit is configured to monitor in real time the collaborative control strategy, cross-domain security insight data, encrypted verification assertion, and comprehensive security situation intelligence output by each module to obtain capture information; The blockchain anchoring unit is connected to the event capturing unit and is configured to generate structured event records from the captured information, calculate their hash values, and anchor the hash values ​​to the permissioned blockchain according to the time sequence and event logic relationship, thereby forming the independently verifiable full lifecycle audit evidence chain.

9. The financial big data security management platform according to claim 8, characterized in that, The blockchain anchoring unit is further configured to: when generating the event record, simultaneously generate a zero-knowledge proof that the event record meets preset compliance rules, and anchor the zero-knowledge proof and the hash value of the event record together to the permissioned blockchain.

10. A method for operating a financial big data security management platform as described in any one of claims 1-9, characterized in that, The method includes: Step 1: Receive and parse financial business requests, and generate and issue a unified collaborative control strategy based on the business scenario identifier and associated financial data hierarchical tags of the requests; Step 2: Based on the aforementioned collaborative control strategy, a federated computing task is constructed among multiple data participants, and homomorphic encryption technology is used to jointly model and analyze the encrypted data to generate cross-domain security insight data; Step 3: Based on the aforementioned collaborative control strategy, invoke the secure multi-party computation protocol to perform covert matching computation between the querying party and one or more data participants acting as verification objects, and generate encrypted verification assertions; Step 4: Integrate the cross-domain security insight data, the encrypted verification assertion, and the real-time acquired internal and external security data streams, and perform dynamic risk assessment and attack tracing through multimodal analysis to generate comprehensive security situation intelligence; Step 5: Capture the key operations and outputs from Steps 1 to 4, and record the summary information of the collaborative control strategy, the cross-domain security insight data, the encrypted verification assertion, and the comprehensive security situation intelligence in sequence on the blockchain to form a tamper-proof full lifecycle audit evidence chain.

Images